26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ulise.Generic Sample ea1884498f38… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ea1884498f38…. Malware family: Ulise.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 10 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b","keywords":["Malicious","Ulise.Generic","malware analysis","sandbox report","threat intelligence","ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ulise.Generic","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T61c,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00001284.00000000.168324.89120000.00000004.mdmp, 00000000-00001284.00000000.168324.A34A0000.00000004.mdmp, 00000000-00001284.00000000.168324.A34F3000.00000004.mdmp, 00000000-00001284.00000001.169666.89120000.00000004.mdmp, 00000000-00001284.00000001.169666.A34F3000.00000004.mdmp, 00000000-00001284.00000001.169666.A3897000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00001284.00000000.168324.89120000.00000004.mdmp, 00000000-00001284.00000001.169666.89120000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::new($_.Exception,"NewTemporaryFileWriteError", "WriteError", &" (Source: "00000000-00001284.00000000.168324.A3830000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -ErrorId "FormatHex" (Source: "00000000-00001284.00000000.168324.A3830000.00000004.mdmp"), Found string "System.Management.Automationr" (Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp"), Found string "System.Management.Automation.resources" (Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp"), Found string "file:///C:/WINDOWS/System32/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources/System.Management.Automation.resources.EXE" (Source: "00000000-00001284.00000001.169666.A3897000.00000004.mdmp")28:Tb72,Found reference string "cmd.exe /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"" (Indicator: "add-mppreference"; Source: "00000000-00005080-00000C46-5124127819") Found reference string "cmd.exe /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\,'%ALLUSERSPROFILE%\Windows\Microsoft','%ALLUSERSPROFILE%\Microsoft\Windows'"" (Indicator: "add-mppreference"; Source: "00000000-00005080-00000C46-82258039852"), Found reference string "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"" (Indicator: "add-mppreference"; Source: "00000000-00008424-00000C47-815307895"), Found reference string "Add-MpPreference -ExclusionPath $env:TEMP" (Indicator: "add-mppreference"; File: "AMSI"), Found reference string "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\ '%ALLUSERSPROFILE%\Windows\Micr" (Indicator: "add-mppreference"; Source: "00000000-00005400-00000C47-938071202"), Found reference string "Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'" (Indicator: "add-mppreference"; File: "AMSI"), Found reference string "/C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\ '%ALLUSERSPROFILE%\Windows\Microsoft' '%ALLUSERSPROFILE%\Microsoft\Windows'"" (Indicator: "add-mppreference"; File: "cmd.exe") Found reference string "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\,'%ALLUSERSPROFILE%\Windows\Microsoft','%ALLUSERSPROFILE%\Microsoft\Windows'"" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"" (Indicator: "add-mppreference"; Source: "00000000-00001284.00000000.168324.89120000.00000004.mdmp, 00000000-00001284.00000001.169666.89120000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $env:TEMP" (Indicator: "add-mppreference"; Source: "00000000-00001284.00000000.168324.89120000.00000004.mdmp, 00000000-00001284.00000000.168324.89380000.00000004.mdmp, 00000000-00001284.00000000.168324.8ABD0000.00000004.mdmp, 00000000-00001284.00000001.169666.89120000.00000004.mdmp, 00000000-00001284.00000001.169666.89380000.00000004.mdmp, 00000000-00001284.00000001.169666.A3897000.00000004.mdmp") Found reference string "HostApplication=powershell -NoProfile -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath $env:TEMP" (Indicator: "add-mppreference"; Source: "00000000-00001284.00000001.169666.89120000.00000004.mdmp")29:Tba1,"ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" queried SystemProcessInformation at 00000000-00009064-00000C15-827572783 [PID: 9064] "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" queried SystemProcessInformation at 00000000-00009064-00000C15-827580030 [PID: 9064] "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" queried SystemProcessInformation at 00000000-00009064-00000C15-827777321 [PID: 9064] "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" queried SystemProcessInformation at 00000000-00009064-00000C15-827785590 [PID: 9064] "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" queried SystemProcessInformation at 00000000-00005080-00000C15-830616305 [PID: 5080] "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" queried SystemProcessInformation at 00000000-00005080-00000C15-830623318 [PID: 5080] "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" queried SystemProcessInformation at 00000000-00005080-00000C15-830784387 [PID: 5080] "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" queried SystemProcessInformation at 00000000-00005080-00000C15-830791614 [PID: 5080] "cmd.exe" queried SystemProcessInformation at 00000000-00008424-00000C15-832968848 [PID: 8424] "cmd.exe" queried SystemProcessInformation at 00000000-00008424-00000C15-832975921 [PID: 8424] "cmd.exe" queried SystemProcessInformation at 00000000-00008424-00000C15-833146148 [PID: 8424] "cmd.exe" queried SystemProcessInformation at 00000000-00008424-00000C15-833153422 [PID: 8424] "powershell.exe" queried SystemProcessInformation at 00000000-00001284-00000C15-833642415 [PID: 1284] "powershell.exe" queried SystemProcessInformation at 00000000-00001284-00000C15-833650722 [PID: 1284] "powershell.exe" queried SystemProcessInformation at 00000000-00001284-00000C15-833822480 [PID: 1284] "powershell.exe" queried SystemProcessInformation at 00000000-00001284-00000C15-833830497 [PID: 1284] "powershell.exe" queried SystemProcessInformation at 00000000-00001284-00000C15-835963433 [PID: 1284] "powershell.exe" queried SystemProcessInformation at 00000000-00001284-00000C15-835970951 [PID: 1284] "powershell.exe" queried SystemProcessInformation at 00000000-00001284-00000C15-836597044 [PID: 1284] "powershell.exe" queried SystemProcessInformation at 00000000-00001284-00000C15-836604809 [PID: 1284] "powershell.exe" queried SystemProcessInformation at 00000000-00001284-00000C15-836789838 [PID: 1284] "powershell.exe" queried SystemProcessInformation at 00000000-00001284-00000C15-836800889 [PID: 1284] "powershell.exe" queried SystemProcessInformation at 00000000-00001284-00000C15-839193002 [PID: 1284] "powershell.exe" queried SystemProcessInformation at 00000000-00001284-00000C15-840134044 [PID: 1284] "powershell.exe" queried SystemProcessInformation at 00000000-00001284-00000C15-840148994 [PID: 1284]2a:T4285,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDV/poQLjVsb85LnwsCuA0OwrdhOgJ9Idx88iVA/crVxKCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d5fe9a102e356c6fce4b9f0b02b80d0ec2b7613a027d21dc7cf22540fdcad5c4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d5fe9a102e356c6fce4b9f0b02b80d0ec2b7613a027d21dc7cf22540fdcad5c4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCCGKubREngV5EFDodK5brTAqlkaVHav/M+SkqGWqFKKqCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCHnmKbck0ySOYBbtr7gcHQVsdIM0PxB7sZ2FyCQLdcFaCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420879e629b724d3248e6016edafb81c1d056c7483343f107bb19d85c8240b75c15a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420879e629b724d3248e6016edafb81c1d056c7483343f107bb19d85c8240b75c15a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD1Ic9VXSKRHe3vJHTviA7n2oanD+d84ekkYUUIWGAvN6CCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420f521cf555d22911dedef2474ef880ee7da86a70fe77ce1e92461450858602f37a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"}2b:T71c6,Assembly shows XOR instruction xor ecx B5F98B7Ch in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax 58FC4473h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax 469492F7h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax 6D7680DDh in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax 2FADDB7Fh in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax F18D86A0h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax 5FACAB7Bh in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax AFCA60A8h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax ecx in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax 76583E20h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax 9F49B566h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor ecx eax in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor ecx 577E4EFFh in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor ecx r8d in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor edx 577E4EFFh in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor edx ecx in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax 6529CA42h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor ecx 6529CA42h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax C136C5A5h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor ecx edx in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor ecx 4DDE679Dh in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor ecx 97C852D7h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor edx 97C852D7h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor ecx 143BD1EBh in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor ecx FB079B7Ch in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor edx C1A5E3F7h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor r8d C1A5E3F7h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax C1A5E3F7h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor ecx C57FCB2Ch in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor al 83h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax 2B9802CAh in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax 038C2733h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor edx r8d in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor edx eax in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax EA56CFF6h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor ecx 77056B0Fh in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor edx 77056B0Fh in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax 64DB4111h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax 91DCA03Dh in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax F0EC848Ah in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax 3642262Fh in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor ecx C3276F09h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor edx C3276F09h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax FB241E55h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax edx in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor ecx FB241E55h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax 17383C0Eh in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax 26E9B598h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor ecx 76C55BD3h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor edx 76C55BD3h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax F6A30432h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax FD795D5Ah in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor ecx 06713FF4h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor edx 06713FF4h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor byte ptr [rdi] cl in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax C37C9D6Eh in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax 1F1B8381h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax 80BB9AA9h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax 58D3D7E7h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor ecx 58D3D7E7h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax F8E08B51h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax C2A12A51h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor ecx C2A12A51h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax E0E1C9D9h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax 63ADAA51h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor ecx 60F055F7h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor edx 60F055F7h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax ED961E62h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor ecx E8F873C6h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor edx E8F873C6h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax 3C698C3Eh in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax B31A2822h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor ecx E510F9E6h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor edx E510F9E6h in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor edx r9d in Stream UID: 11966-1-0000000140001000 Assembly shows XOR instruction xor eax ecx in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax DDB2C351h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx eax in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax 4A401F0Fh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax F7634691h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx 70920186h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx 70920186h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx dword ptr [rbx-74CBDBBCh] in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax 63CB25CCh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx 63CB25CCh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax AF9C8187h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax 2190D1B8h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx 07CBCD5Fh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor r8d ecx in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx 07CBCD5Fh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx ecx in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor byte ptr [rdi] cl in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax 93627569h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax 2E38D47Ch in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor al 0Fh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax DFEB6753h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx 935122FDh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx r8d in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx 935122FDh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor al 48h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax 49FD5024h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax 6EAA4DDDh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx 71A83269h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx 71A83269h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax EA49ACA8h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx B80BB1ACh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx B80BB1ACh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax CA5306E6h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx 4E746017h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx 4E746017h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor r9d r10d in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx edx in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax 3EF95DF1h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx eax in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx 3EF95DF1h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax F269DEB0h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax 578FB6BCh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx r8d in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx 2A223909h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx 2A223909h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax 7B87BFE2h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx C032052Eh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx C032052Eh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax DE6C333Dh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx DE6C333Dh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax ECE18B98h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx 43E90B7Fh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx 43E90B7Fh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax BFA5EB55h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx BFA5EB55h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax B2EE211Ah in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax 9AD01545h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax C769E3B7h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax 3911D71Eh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax DA9FEBB4h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor r8d FFFFFFFFh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax FFFFFFFFh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx FFFFFFFFh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx FFFFFFFFh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor r8d eax in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax 9C489DF4h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax 76C52C5Ch in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx r11d in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx ebx in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx 3185B4A1h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor r11d 8552BDF3h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ebx 8552BDF3h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor esi FFFFFFFFh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edi FFFFFFFFh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx esi in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx AA5DCA16h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ebx FFFFFFFFh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax edx in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx 4D39CA63h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax D0FACBA9h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor r11d 9D4DAFCCh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ebx 9D4DAFCCh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax esi in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx A6144D4Fh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax B01C4C67h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx 0DDE14A0h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx 5FF783F3h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx 526C0C20h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor r11d FFFFFFFFh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx 549DFE8Ah in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx 6D65DC7Ah in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx D6064BB3h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx CF525DE4h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx 42CDA7C2h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax AA52B687h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx 36C9AFD4h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx r11d in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx ebx in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor ecx 87A7F811h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx 80E213AEh in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax ACAF8C17h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax FB6F39F6h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax 76365599h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor r8d 9607BA86h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor eax 9607BA86h in Stream UID: 11966-45-0000000140002A6E Assembly shows XOR instruction xor edx r8d in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor edx eax in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax ecx in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax B2DE749Dh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx eax in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax 06C0E8F9h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 06C0E8F9h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax 86F60956h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax 2C4F7D74h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax 1DE1E5ACh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 37BAC692h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor edx 37BAC692h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax 806C1A1Eh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax edx in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 806C1A1Eh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx edx in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 6755E3CFh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor al 83h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx AFA41418h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor dword ptr [rdi] ecx in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 4E317EE9h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax 191D3FC9h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 1B0D527Eh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r8d ecx in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor edx 1B0D527Eh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor edx ecx in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax 5A3ACA97h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax 0643E520h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax 21430CBCh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 01h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 49DD04C3h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r8d FFFFFFFFh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax FFFFFFFFh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d FFFFFFFFh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx FFFFFFFFh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 166484DBh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d 7F0E4631h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 7F0E4631h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d 9828E8F2h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 9828E8F2h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d r10d in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r8d r9d in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r10d FFFFFFFFh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor edx FFFFFFFFh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx r8d in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d ecx in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r8d 9E035B7Eh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax 9E035B7Eh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d 2F4F612Dh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 2F4F612Dh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx F6CAD2C1h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d FCFD9195h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx FCFD9195h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d D344A4E9h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx D344A4E9h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d 0DFF7E1Ch in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 0DFF7E1Ch in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d 0654439Ah in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 0654439Ah in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d BB4D39B0h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx BB4D39B0h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d 515873D2h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 515873D2h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 954BC0E7h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d A4416FD9h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx A4416FD9h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r8d 0298D6C1h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax 0298D6C1h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d 0812E475h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 0812E475h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r11d FFFFFFFFh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ebx FFFFFFFFh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor esi FFFFFFFFh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx edi in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx r9d in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d 92107066h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 92107066h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r8d BC490A99h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax BC490A99h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor edx r9d in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d 61464AAFh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 61464AAFh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d edx in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r8d 27D0F9D3h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax 27D0F9D3h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d 8F83D4B7h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 8F83D4B7h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d 76F3E5E2h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 76F3E5E2h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r8d BF25CF8Fh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax BF25CF8Fh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d r8d in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor edx E81F8F3Ah in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d 22920EEEh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 22920EEEh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d C5FCAAA9h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx C5FCAAA9h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r10d B60A1A1Bh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor edx B60A1A1Bh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d r11d in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx ebx in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r8d EA500DAAh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax EA500DAAh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r8d edx in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d 9200F59Bh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 9200F59Bh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor edx r11d in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor edx ebx in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor edx DF59AA98h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d 92C0C16Dh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 92C0C16Dh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d FA5F2B85h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx FA5F2B85h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r9d D6DD8F94h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx D6DD8F94h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r8d F4CF58F6h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax F4CF58F6h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r10d 22C980C9h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor edx 22C980C9h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor r10d 8E080282h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor edx 8E080282h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax B71C455Eh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax E25012C2h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx E25012C2h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax 701B1425h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax 84BF9E5Dh in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax 6F14B6C3h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor ecx 6F14B6C3h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor eax C321BC67h in Stream UID: 11966-294-000000014001FFE5 Assembly shows XOR instruction xor edx eax in Stream UID: 00000000-00009064-18336-1294-98F4A017 Assembly shows XOR instruction xor edx 1AD02575h in Stream UID: 00000000-00009064-18336-1294-98F4A017 Assembly shows XOR instruction xor edx 7F9E11B5h in Stream UID: 00000000-00009064-18336-1294-98F4A017 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00009064-18336-1294-98F4A017 Assembly shows XOR instruction xor edx 14983859h in Stream UID: 00000000-00009064-18336-1294-98F4A017 Assembly shows XOR instruction xor edx 69E4DAD5h in Stream UID: 00000000-00009064-18336-1294-98F4A017 Assembly shows XOR instruction xor edx BB133AC0h in Stream UID: 00000000-00009064-18336-1294-98F4A017 Assembly shows XOR instruction xor edx 901E081Dh in Stream UID: 00000000-00009064-18336-1294-98F4A017 Assembly shows XOR instruction xor edx 65A55945h in Stream UID: 00000000-00009064-18336-1294-98F4A0172c:T149a,Found XOR loop in file "sflcnpuiokavdbai.exe" at offset 172989; code bytes = 30d0 Found XOR loop in file "sflcnpuiokavdbai.exe" at offset 564693; code bytes = 30d0 Found XOR loop in file "sflcnpuiokavdbai.exe" at offset 564721; code bytes = 30d0 Found XOR loop in file "sflcnpuiokavdbai.exe" at offset 161505; code bytes = 33c1 Found XOR loop in file "sflcnpuiokavdbai.exe" at offset 161526; code bytes = 33c1 Found XOR loop in file "sflcnpuiokavdbai.exe" at offset 546684; code bytes = 33c1 Found XOR loop in file "sflcnpuiokavdbai.exe" at offset 13156; code bytes = 8030 Found XOR loop in file "sflcnpuiokavdbai.exe" at offset 105844; code bytes = 8030 Found XOR loop in file "sflcnpuiokavdbai.exe" at offset 201300; code bytes = 8030 Found XOR loop in file "sflcnpuiokavdbai.exe" at offset 561604; code bytes = 8030 Found XOR loop in file "sflcnpuiokavdbai.exe" at offset 598112; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1060643; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2328385; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2627554; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4759237; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5013751; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5587658; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6508293; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6527173; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6631109; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6760837; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6806533; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6973637; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7017285; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7026053; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7176197; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7774405; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7964549; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8299653; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8732421; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8818978; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8836997; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8966533; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9044357; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9046917; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9076613; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9085893; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9086661; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9110341; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9194882; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9219264; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9243077; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9266501; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9314309; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9315461; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 643695; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 643727; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1978624; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3587109; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4028237; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4482466; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4838278; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4839630; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5083744; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6641664; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7252196; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8859395; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9059270; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9084614; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9134208; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1113182; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2491264; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3654228; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4730118; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5143922; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5330546; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6191629; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6472970; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7131873; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7974818; code bytes = 80302d:T2608,"ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009064) "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a0000020000000000000000000000000000006053eb725a0200001019e251fb7f000000000000000000000000f14ffb7f00000000000000000000ee26534ffb7f0000070000000000000000ba5fc39600000000ba5fc396000000400e614ffb7f00000000f14ffb7f00007b63a14ffb7f0000020000000000000000000000000000009200000000000000a0046150fb7f0000f0b95fc396000000bb5f534ffb7f00000d000000fb7f0000a0046150fb7f000092000000000000000000000000000000a0046150fb7f00001c5b534ffb7f0000000000000000000092000000000000000d000000fb7f00000d00000000000000aa00000000000000d2450250fb7f0000a03a0750 (UID: 00000000-00009064) "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005080) "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005080) "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005080) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008424) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008424) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001284) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001284) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000010eb4aa3b20100001019e251fb7f000000000000000000000000f14ffb7f00000000000000000000ee26534ffb7f00000700000000000000d0c71f0698000000d0c71f0698000000400e614ffb7f00000000f14ffb7f00007b63a14ffb7f0000030000000000000000000000000000009200000000000000a0046150fb7f0000c0c71f0698000000bb5f534ffb7f00000d000000fb7f0000a0046150fb7f000092000000000000000000000000000000a0046150fb7f00001c5b534ffb7f0000000000000000000092000000000000000d000000fb7f00000d00000000000000aa00000000000000d2450250fb7f0000a03a0750 (UID: 00000000-00001284) "powershell.exe" called "RtlGetVersion" with parameter 240100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001284) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004668) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004668) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005400) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005400)2e:T52d,"ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS")2f:T1643,"powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00001284-00000C17-835424911 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00001284-00000C17-835428734 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00001284-00000C17-837685836 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00001284-00000C17-838005280 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001284-00000C17-838441507 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001284-00000C17-839716695 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00001284-00000C17-840663078 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00001284-00000C17-841965079 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00001284-00000C17-842354968 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.5915.cat" at 00000000-00001284-00000C17-842642668 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.5794.cat" at 00000000-00001284-00000C17-842732425 "powershell.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll" at 00000000-00001284-00000C17-843071027 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00001284-00000C17-843369601 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00001284-00000C17-843375078 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00001284-00000C17-843375462 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00001284-00000C17-843676321 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.4717.cat" at 00000000-00001284-00000C17-843737324 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00001284-00000C17-843879886 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00001284-00000C17-844082798 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00001284-00000C17-844224696 "powershell.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll" at 00000000-00001284-00000C17-844370262 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00003328-00000C17-867501823 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00003328-00000C17-867504716 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00003328-00000C17-869697194 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00003328-00000C17-87012573530:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")31:T583,"ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "CreateProcessA" with parameter "cmd.exe /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"" - (UID: 00000000-00005080) "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "CreateProcessA" with parameter "cmd.exe /C gpupdate /force" - (UID: 00000000-00005080) "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "CreateProcessA" with parameter "cmd.exe /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\,'%ALLUSERSPROFILE%\Windows\Microsoft','%ALLUSERSPROFILE%\Microsoft\Windows'"" - (UID: 00000000-00005080), "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "CreateProcessW" with parameter ""%ALLUSERSPROFILE%\sflcnpuiokavdbai.exe"" - (UID: 00000000-00005080), "cmd.exe" called "CreateProcessW" with parameter "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"" - (UID: 00000000-00008424), "cmd.exe" called "CreateProcessW" with parameter "gpupdate /force" - (UID: 00000000-00004668), "cmd.exe" called "CreateProcessW" with parameter "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\ '%ALLUSERSPROFILE%\Windows\Micr" - (UID: 00000000-00005400)32:T6a13,"ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "LoadLibrary" with a parameter ole32 (UID: 00000000-00009064) "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005080) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\704b6614c4744d16332d08daf175deed\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\ed7aa14224280131dbac4b6e4881239a\Microsoft.Management.Infrastr (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\afd58c711db7cac7f0d5caf525ce8d6c\System.DirectoryServices.ni.d (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\8ecda6b0ffa321000faffbdcdb86175b\System.Management.ni.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter Kernel32 (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter NtDll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\8990b2f5a93202518a0040e15b565f36\System.Data.ni.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\11606f766159ae0c6dc59f2c053f4db7\Microsoft.PowerShell.Security (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\beabd14f0ab9a67d348911645772e933\System.Transactions.ni.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\9c3b10f6a55214655267f1cbc0e14caa\Microsoft.Management.Infrastr (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\b91d832f8c25f4f949d6dc38b3fe41ac\Microsoft.PowerShell.Commands (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\9594c82af7b396b5ee8b0ef1d461cea2\System.Configuration.Install. (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\4775ea5a6170c0859c5278277c31b0ca\Microsoft.PowerShell.Commands (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00001284) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\704b6614c4744d16332d08daf175deed\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\ed7aa14224280131dbac4b6e4881239a\Microsoft.Management.Infrastr (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\afd58c711db7cac7f0d5caf525ce8d6c\System.DirectoryServices.ni.d (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\8ecda6b0ffa321000faffbdcdb86175b\System.Management.ni.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter Kernel32 (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter NtDll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\8990b2f5a93202518a0040e15b565f36\System.Data.ni.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\11606f766159ae0c6dc59f2c053f4db7\Microsoft.PowerShell.Security (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\beabd14f0ab9a67d348911645772e933\System.Transactions.ni.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\4775ea5a6170c0859c5278277c31b0ca\Microsoft.PowerShell.Commands (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\9c3b10f6a55214655267f1cbc0e14caa\Microsoft.Management.Infrastr (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00003328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00003328)33:T13af4,"ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00009064) "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00009064) "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00009064) "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00009064) "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00009064) "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00009064) "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00009064) "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005080) "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005080) "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005080) "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005080) "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005080) "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005080) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008424) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008424) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008424) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008424) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008424) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008424) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2A (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2 (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryAllFeatureConfigurations (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObjectW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnum (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnumW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter MI_Application_InitializeV1 (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeStreamedParameterResultCallback (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativePromptUserCallback (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutput (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutputW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutput (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutputW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_GetInstance (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsShuttingDown (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_SessionHandle_OnReleaseHandleCompleted (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_SetAppDomainIsUnloading (UID: 00000000-00001284) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_ScheduleCleanupCallback (UID: 00000000-00001284) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004668) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004668) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004668) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004668) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004668) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004668) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005400) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005400) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005400) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005400) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005400) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005400) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2A (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2 (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryAllFeatureConfigurations (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter MI_Application_InitializeV1 (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeStreamedParameterResultCallback (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativePromptUserCallback (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutput (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutputW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutput (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutputW (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_GetInstance (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00003328) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003328) "sflcnpuiokavdbai.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008508) "sflcnpuiokavdbai.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008508) "sflcnpuiokavdbai.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008508) "sflcnpuiokavdbai.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008508) "sflcnpuiokavdbai.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008508) "sflcnpuiokavdbai.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008508) "sflcnpuiokavdbai.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00008508)34:T4dd6,Found reference to API (Indicator: "RegSetValueExW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "LocalFree"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "HeapAlloc"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "VirtualProtect"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "GetTickCount"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "LocalAlloc"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "MessageBoxW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "CoUninitialize"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "ExitProcess"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "DeleteFileW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "GetSystemTime"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "GetProcAddress"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "CloseHandle"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "Sleep"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "GetVersionExW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "TerminateProcess"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "GetLastError"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "lstrcpyA"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "lstrlenW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "GetTickCount64"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "CreateFileA"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "CreateProcessW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "CreateMutexA"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "CompareStringOrdinal"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "lstrlenA"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "CreateProcessA"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "VirtualFree"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "CopyFileW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "lstrcpynW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "HeapFree"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "lstrcmpA"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "WriteProcessMemory"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "lstrcatW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "OpenProcess"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "lstrcatA"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "ResumeThread"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "SetEvent"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "RtlAddFunctionTable"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "CreateEventW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "lstrcpynA"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "CreateThread"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp, 00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "K32GetModuleFileNameExW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp")35:Tcc7,"\REGISTRY\MACHINE\Software\WOW6432Node\Microsof" in Source: 00000000-00001284.00000000.168324.89120000.00000004.mdmp 00000000-00001284.00000001.169666.89120000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001284.00000000.168324.89120000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001284.00000000.168324.89120000.00000004.mdmp 00000000-00001284.00000001.169666.89120000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001284.00000000.168324.A34F3000.00000004.mdmp 00000000-00001284.00000001.169666.A34F3000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp "achine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00001284.00000001.169666.89120000.00000004.mdmp "INE\Software\WOW6432Node" in Source: 00000000-00001284.00000001.169666.A3830000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00001284.00000001.169666.A3897000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001284.00000001.169666.A3897000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001284.00000001.169666.A3897000.00000004.mdmp "\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001284.00000001.169666.A3897000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001284.00000001.169666.A3897000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\HAPUBWS\AppData\Roaming\nvm;%NVM_SYMLINK%;C:\WINDOWS\System32\OpenSSH\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\Scripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python31\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00001284.00000001.169666.A399D000.00000004.mdmp "USERDOMAIN=hszSjnVnpOA\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00001284.00000001.169666.A399D000.00000004.mdmp36:Taac,Process ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:9064:304:WilStaging_02" Process ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:9064:304:WilStaging_02" Process ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:9064:120:WilError_03" Process ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe created mutex with name "SM0:9064:304:WilStaging_02" Process ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe created mutex with name "SM0:9064:120:WilError_03" Process ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe created mutex with name "Local\SM0:9064:304:WilStaging_02" Process DllHost.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6596:304:WilStaging_02" Process DllHost.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6596:120:WilError_03" Process DllHost.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process DllHost.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process DllHost.exe created mutex with name "Local\SM0:6596:120:WilError_03" Process DllHost.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process DllHost.exe created mutex with name "Local\SM0:6596:304:WilStaging_02" Process DllHost.exe created mutex with name "SM0:6596:304:WilStaging_02" Process DllHost.exe created mutex with name "Local\ZonesCacheCounterMutex" Process DllHost.exe created mutex with name "SM0:6596:120:WilError_03" Process DllHost.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6596:120:WilError_03" Process DllHost.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6596:304:WilStaging_02" Process ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5080:304:WilStaging_02" Process ea1884498f38a8a93063b5d333cd9d16ee822814fb35dc287d6726e287cf270b.exe created mutex with name "SM0:5080:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8424:304:WilStaging_02" Process cmd.exe created mutex with name "SM0:8424:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1284:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:1284:120:WilError_03" Process powershell.exe created mutex with name "SM0:1284:304:WilStaging_02"37:T1292,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]38:T217f,"\REGISTRY\MACHINE\Software\WOW6432Node\Microsof" in Source: 00000000-00001284.00000000.168324.89120000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001284.00000000.168324.89120000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001284.00000000.168324.89120000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001284.00000000.168324.A34F3000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001284.00000001.169666.4DB8B000.00000002.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsof" in Source: 00000000-00001284.00000001.169666.89120000.00000004.mdmp "achine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00001284.00000001.169666.89120000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001284.00000001.169666.89120000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001284.00000001.169666.A34F3000.00000004.mdmp "INE\Software\WOW6432Node" in Source: 00000000-00001284.00000001.169666.A3830000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00001284.00000001.169666.A3897000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001284.00000001.169666.A3897000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001284.00000001.169666.A3897000.00000004.mdmp "\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001284.00000001.169666.A3897000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001284.00000001.169666.A3897000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\HAPUBWS\AppData\Roaming\nvm;%NVM_SYMLINK%;C:\WINDOWS\System32\OpenSSH\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\Scripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python31\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00001284.00000001.169666.A399D000.00000004.mdmp "USERDOMAIN=hszSjnVnpOA\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00001284.00000001.169666.A399D000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00003328.00000000.170384.C3B50000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003328.00000000.170384.C3B50000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}f01.3.6.1." - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0_nfa" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcarsmmscorlibarsmmscorlib0*gq?o311.12.1.10.1.1qoz" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?elobapw" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mn" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>olic)http:tartcom.org/intermediate.pdf0" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>" - Source: "00000000-00001284.00000000.168324.A34F3000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkidm" - Source: "00000000-00001284.00000000.168324.A3830000.00000004.mdmp") Found URL "http://www.microsoft.com020251011013926.217z0washington1redmond1microsoft" - Source: "00000000-00001284.00000000.168324.A3830000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00001284.00000000.168324.A3830000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00001284.00000000.168324.A3830000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00001284.00000000.168324.A3830000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00001284.00000001.169666.89120000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00001284.00000001.169666.89120000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00001284.00000001.169666.89120000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001284.00000001.169666.89120000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00001284.00000001.169666.A34A0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00001284.00000001.169666.A34A0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00001284.00000001.169666.A34A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0m$57wjuo" - Source: "00000000-00001284.00000001.169666.A34A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmk>f01.3.6.1." - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0_nfa" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czc+;*bsystem.core'0arsmsystem.xml$%system.numerics*gq?o311.12.1.10.1.1system.directoryservicestionsystem.dataqoz" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?elobapw" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00001284.00000001.169666.A34F3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zdmon4ld" - Source: "00000000-00001284.00000001.169666.A3670000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00001284.00000001.169666.A3670000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00001284.00000001.169666.A3830000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00001284.00000001.169666.A3830000.00000004.mdmp") Found URL "http://m/pki/certs/microoceraut_2010-06-23.crt0e0-d-starpori/m7x6\iy$f;!tkjeaf=iai" - Source: "00000000-00001284.00000001.169666.A3830000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00001284.00000001.169666.A3830000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0a08." - Source: "00000000-00001284.00000001.169666.A399D000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00001284.00000001.169666.A399D000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0'.b!" - Source: "00000000-00001284.00000001.169666.A399D000.00000004.mdmp") Found URL "http://w@_2pz+)washington1redmond1microsoft" - Source: "00000000-00001284.00000001.169666.A399D000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0mpfa=" - Source: "00000000-00001284.00000001.169666.A399D000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0gv" - Source: "00000000-00001284.00000001.169666.A399D000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00001284.00000001.169666.A399D000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00001284.00000001.169666.A39D3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0:'l$zmsnc" - Source: "00000000-00001284.00000001.169666.A39D3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0!2es" - Source: "00000000-00001284.00000001.169666.A39D3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0qhwbs-ztxnw,xzz" - Source: "00000000-00001284.00000001.169666.A39D3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0vd!7i6u4$i<-o_-!dq" - Source: "00000000-00001284.00000001.169666.A39D3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00003328.00000000.170384.C3B50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00003328.00000000.170384.C5A1C000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003328.00000000.170384.C5A1C000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003328.00000000.170384.C5A1C000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003328.00000000.170384.C5A1C000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?egeotrust" - Source: "00000000-00003328.00000000.170384.C5A1C000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003328.00000000.170384.C5A1C000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czctii" - Source: "00000000-00003328.00000000.170384.C5A1C000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00003328.00000000.170384.C5A1C000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00003328.00000000.170384.C5A1C000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00003328.00000000.170384.C5A1C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00003328.00000000.170384.C5A1C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00003328.00000000.170384.C5A1C000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00003328.00000000.170384.C5A1C000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00003328.00000000.170384.C5A1C000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00003328.00000000.170384.C5A1C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00003328.00000000.170384.DDFA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/ce6ooceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsofation1.0,%microsoft" - Source: "00000000-00003328.00000000.170384.DDFA0000.00000004.mdmp") Found URL "http://www.microsoft.com020251011013926.217z0washington1redmond1microsoft" - Source: "00000000-00003328.00000000.170384.DDFA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00003328.00000000.170384.DDFA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pkoducts/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxxsu$was.,k" - Source: "00000000-00003328.00000000.170384.DDFA0000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00003328.00000000.170384.DDFA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003328.00000000.170384.DDFA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00003328.00000000.170384.DDFA0000.00000004.mdmp") Found URL "http://www.mi(!tkjeaf=iai" - Source: "00000000-00003328.00000000.170384.DDFA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00003328.00000001.171449.C3B50000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003328.00000001.171449.C59D0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003328.00000001.171449.C59D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?egeotrust" - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czctii" - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.aq" - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "http://www.microsoft.comwrapnonexceptionthrows1402http://www.microsoft.com" - Source: "00000000-00003328.00000001.171449.C5A1C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003328.00000001.171449.DDFA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0'.b!" - Source: "00000000-00003328.00000001.171449.DDFA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00003328.00000001.171449.DDFA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003328.00000001.171449.DDFAE000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00003328.00000001.171449.DDFAE000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0]bbae" - Source: "00000000-00003328.00000001.171449.DDFAE000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0a08." - Source: "00000000-00003328.00000001.171449.DDFAE000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00003328.00000001.171449.DE006000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003328.00000001.171449.DE006000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt00_1t?lvbp)r" - Source: "00000000-00003328.00000001.171449.DE006000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0::vm4" - Source: "00000000-00003328.00000001.171449.DE006000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0ahq.a)d$g5" - Source: "00000000-00003328.00000001.171449.DE006000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0vd!7i6u4$i<-o_-!dq" - Source: "00000000-00003328.00000001.171449.DE006000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" - Source: "00000000-00003328.00000001.171449.DE006000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiopebsjbv4.0.30319" - Source: "00000000-00003328.00000001.171449.DE006000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0!2es