24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 63:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ab,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSILHeracles.Generic Sample 008f7eb9ebb7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 008f7eb9ebb7…. Malware family: MSILHeracles.Generic. Threat score 100/100. 9/28 AV engines flagged this file. 8 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/008f7eb9ebb7a65d3887f263f6c91f8ef340eb220f2167642202b565794fad17","keywords":["Malicious","MSILHeracles.Generic","malware analysis","sandbox report","threat intelligence","008f7eb9ebb7a65d3887f263f6c91f8ef340eb220f2167642202b565794fad17"],"about":{"@type":"SoftwareApplication","name":"#SKA131-025.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"008f7eb9ebb7a65d3887f263f6c91f8ef340eb220f2167642202b565794fad17","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSILHeracles.Generic","antivirusDetections":{"malicious":9,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":29},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tfce,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002920.00000000.102581.029A0000.00000004.mdmp, 00000000-00002920.00000001.103507.029C0000.00000004.mdmp, 00000000-00002920.00000001.103507.07142000.00000004.mdmp, 00000000-00002920.00000001.103507.07198000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002920.00000000.102581.029A0000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00002920.00000000.102581.029A0000.00000004.mdmp, 00000000-00002920.00000001.103507.029C0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00002920.00000000.102581.029A0000.00000004.mdmp, 00000000-00002920.00000000.102581.04B40000.00000004.mdmp, 00000000-00002920.00000001.103507.029C0000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp, 00000000-00002920.00000000.102581.0717B000.00000004.mdmp, 00000000-00002920.00000001.103507.07142000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp, 00000000-00002920.00000001.103507.08090000.00000004.mdmp") Found string "file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "System.Management.Automation.resources, Version=3.0.0.0, Culture=en-US, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput($inputScript, $cursorColumn," (Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "[System.Management.Automation.Language.Ast] $ast," (Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "[System.Management.Automation.Language.Token[]] $tokens," (Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "[System.Management.Automation.Language.IScriptPosition] $positionOfCursor," (Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput(" (Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "# .ExternalHelp System.Management.Automation.dll-help.xml" (Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "[System.Management.Automation.PSCredential]" (Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('New-Item', [System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Out-String',[System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\System.Management.Automation.dll" (Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "System.Management.Automation.dll-Help.xml" (Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp")26:T559,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp")27:T83a,Found reference to API "LoadLibrary of %s failed with error, hResult = 0x%x." (Indicator: "LoadLibrary"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "LoadLibrary failed in GetCoCreateInstanceAsAdminHandle. GLE = %#x" (Indicator: "LoadLibrary"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "LoadLibrary failed in SetShieldIcon. GLE = %#x" (Indicator: "LoadLibrary"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "LoadLibrary failed in RemoveShieldIcon. GLE = %#x" (Indicator: "LoadLibrary"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "ppvPfn=%p] LoadLibrary() failed." (Indicator: "LoadLibrary"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp")28:T511,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp")29:T91b,"#SKA131-025.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP") "#SKA131-025.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\PROGID") "#SKA131-025.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\PROGID") "#SKA131-025.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\PROGID") "#SKA131-025.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\PROGID") "#SKA131-025.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610") "#SKA131-025.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610") "#SKA131-025.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN") "#SKA131-025.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN") "#SKA131-025.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER") "#SKA131-025.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER") "#SKA131-025.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER") "#SKA131-025.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\POLICIES") "#SKA131-025.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\SECURITY") "#SKA131-025.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE") "#SKA131-025.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY")2a:Ta1b,"#SKA131-025.exe" queried SystemProcessInformation at 00000000-00007348-00000C15-537210744 [PID: 7348] "#SKA131-025.exe" queried SystemProcessInformation at 00000000-00007348-00000C15-537220318 [PID: 7348] "#SKA131-025.exe" queried SystemProcessInformation at 00000000-00007348-00000C15-537402246 [PID: 7348] "#SKA131-025.exe" queried SystemProcessInformation at 00000000-00007348-00000C15-537430237 [PID: 7348] "#SKA131-025.exe" queried SystemProcessInformation at 00000000-00007348-00000C15-537550766 [PID: 7348] "#SKA131-025.exe" queried SystemProcessInformation at 00000000-00007348-00000C15-537559541 [PID: 7348] "#SKA131-025.exe" queried SystemProcessInformation at 00000000-00007348-00000C15-539617216 [PID: 7348] "#SKA131-025.exe" queried SystemProcessInformation at 00000000-00007348-00000C15-539626093 [PID: 7348] "#SKA131-025.exe" queried SystemProcessInformation at 00000000-00007348-00000C15-539779838 [PID: 7348] "#SKA131-025.exe" queried SystemProcessInformation at 00000000-00007348-00000C15-539788699 [PID: 7348] "#SKA131-025.exe" queried SystemProcessInformation at 00000000-00007348-00000C15-541836074 [PID: 7348] "#SKA131-025.exe" queried SystemProcessInformation at 00000000-00007348-00000C15-541846382 [PID: 7348] "#SKA131-025.exe" queried SystemProcessInformation at 00000000-00007348-00000C15-542195371 [PID: 7348] "#SKA131-025.exe" queried SystemProcessInformation at 00000000-00007348-00000C15-542204387 [PID: 7348] "powershell.exe" queried SystemProcessInformation at 00000000-00002920-00000C15-549542444 [PID: 2920] "powershell.exe" queried SystemProcessInformation at 00000000-00002920-00000C15-549556998 [PID: 2920] "powershell.exe" queried SystemProcessInformation at 00000000-00002920-00000C15-549705739 [PID: 2920] "powershell.exe" queried SystemProcessInformation at 00000000-00002920-00000C15-549712491 [PID: 2920] "powershell.exe" queried SystemProcessInformation at 00000000-00002920-00000C15-551023794 [PID: 2920] "powershell.exe" queried SystemProcessInformation at 00000000-00002920-00000C15-551036177 [PID: 2920] "powershell.exe" queried SystemProcessInformation at 00000000-00002920-00000C15-551933519 [PID: 2920] "powershell.exe" queried SystemProcessInformation at 00000000-00002920-00000C15-551941934 [PID: 2920] "powershell.exe" queried SystemProcessInformation at 00000000-00002920-00000C15-552278710 [PID: 2920] "powershell.exe" queried SystemProcessInformation at 00000000-00002920-00000C15-552304861 [PID: 2920] "powershell.exe" queried SystemProcessInformation at 00000000-00002920-00000C15-552415711 [PID: 2920]2b:Ta22,Found api reference "Error 0x%x during CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found api reference "Error 0x%x during CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found api reference "Error 0x%x during CryptDeriveKey" (Indicator: "CryptDeriveKey"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found api reference "CryptDeriveKey" (Indicator: "CryptDeriveKey"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found api reference "CryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp")2c:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2d:T7f6,Found XOR loop in file "sample.bin" at offset 352575; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 395167; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 438744; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 461021; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 543586; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 574073; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 598240; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 620262; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 700689; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 209165; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 370322; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 373422; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 382974; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 412252; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 415249; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 623507; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 668836; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 719385; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 732187; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4520; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10278; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 45748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 253658; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 267918; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 322866; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 378477; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 429938; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 617170; code bytes = 80302e:T45a,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007348-00000C2C-538226834") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00007348-00000C2C-538227455") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00007348-00000C2C-548443232") Found reference to API "CheckTokenMembershipW" (Indicator: "CheckTokenMembership"; Source: "00000000-00007348-00000C2C-548443276") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp")2f:T203d,"#SKA131-025.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000110000009e297d7740b3e3020000000028000000240000000000e20240eeaf000000000000000000000000000000000000000000d007c1023000000000000000110000000000c102000000009d0000000000000000000000e8afe302e8b8e2021100000000000000200000000000c102d001c102040bc10200000000000bc1020000000038eeaf0050f57c7740b3e302a0eeaf00eceeaf00 (UID: 00000000-00007348) "#SKA131-025.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007348) "#SKA131-025.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007348) "#SKA131-025.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000088d0af002cd0af00226e457400002203000000002d6e4574a5671b152d000000ecb74275b0d0af000000c10210a4e9028892e8020e00000080000000f0cfaf000000c10274d0af0070c8467471c6ff61feffffff2d000000d0cc51752700000044d0af00856a47741c234c7484d0af00f85f477408000000bb694674b26946740d671b152d000000ecb7427527000000d0cc517558d0af002d000000d0cc51752700000088d0af00856a47741c234c74d0d0af007e8a5075ee8c5075738a5075311d8ef22d000000ecb7427527000000d0cc5175b413220348132203311d8ef298d0af00fc528e7584d1af00e0845075d93cad87feffffff738a5075 (UID: 00000000-00007348) "#SKA131-025.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000005470187d547000000000d0a92f740000287490112974b05ce702482ce30250b2e90248e6af00fefffffff0e8af00506a807773d188c7feffffff08e7af00eaa97c77b05ce7020000000050b2e902a11400000a000b00b29754705c7654706876547050b2e9025001ea02140000000000000000000000b05ce70230e7af00cc2d817750b2e902000000005cb2e90200000000f8004d7000000000cc0d24385ce87f7768407e77d4030000190000001100000010000000b8bee20268e7af008d9a0c74d8bae2025c1be8020000000088e7af002c05e2025c1be802a0e7af0000004d70feffffff0400000020af0c74000000000000000000004d7090e7af00 (UID: 00000000-00007348) "#SKA131-025.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000e7025005fd6f000000002a003a70fc8633702a003a70fb8c7d771800000000000000fc86337024dfaf00d4deaf0000000000000000002a003a70090000002055e70209000000fc863370ff2906745005fd6fe99c7e0000000000000000000000000000000000b3b81fe7abfaafb0e0deaf00698e0474000000003fb81fe70000000000000000838e04749cdeaf0008dfaf000cdfaf0018dfaf00000000000100000000000000010000000000000008dfaf000000000018dfaf00000000000cdfaf000000000000000000000000003fb81fe780e1af00c5d806740000000024dfaf0084dae1740100000003faafb028dfaf00dab9e1740000f46f1cdfaf00 (UID: 00000000-00007348) "#SKA131-025.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000c74000000001b8b7d770000000011b9e174000000001c0000000000220388d8af00000000009fa3ec6fa3017d77b3fdafb0187efd07d0077e07280000004fddec6f3800000000007e07000000003cea000200000000e90300eaa0e42203a08122030f000000000000002000000000007e07cc017e0794087e070000000090087e0730d7af0080d8af0059167d771c000000000000000407e76f000022031b8b7d772800000000000000000000000500000002000000000022031c00000000000000102f2203a0d8af00ee137d771c000000ee137d7700000000000000001c000000ffffffffc0d8af005072457400002203000000001c0000000407e76f (UID: 00000000-00007348) "#SKA131-025.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000007c779847ff079847ff0700000000808eff0778e0fe07d03bff073500000088e0fe071100340050f57c774878fe074878fe07000000002d6f1b15e0d3fd075069fe072b000000f0d3fd070a00240050f57c774085ff074085ff07000000009847ff0718e1fe07f083ff070900000028e1fe072e000900c8097e0764000000656f1b154878fe074878fe0700000000feffffff8470457418d9af0065704574000022030000000084704574916e1b154085ff074085ff0700000000e32ee36f4878fe07b5cedf6fa3851051e0d8af00176fe06f74d9af0070c84674a9c5ff61feffffff847045740a8ee26f4085ff07f08de26f40d9af00a7cedf6f01000000 (UID: 00000000-00007348) "#SKA131-025.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000007c77a045ff07a045ff07000000000000000078e0fe07d03bff072c00000050f57c774878fe074878fe070000000084704574e0d3fd075069fe072b000000f0d3fd070a002c00d80d7e076400000050f57c772086ff072086ff0700000000a045ff0718e1fe07f083ff071000000028e1fe072e001000c8097e07640000004878fe074878fe0700000000feffffff8470457414d9af00657045740000220300000000847045749d6e1b152086ff072086ff0700000000e32ee36f4878fe07b5cedf6f5f841051dcd8af00176fe06f74d9af0070c84674a9c5ff61feffffff847045740a8ee26f2086ff07f08de26f3cd9af00a7cedf6f01000000504be06f (UID: 00000000-00007348) "#SKA131-025.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000078bfd10a38cf7d779c38e202e4bfd10a010000005038e2029c38e2025038e202040000000400000000e0ed7400100000e4bfd10a010000005038e202cd977d779c977d77f7e6d1bab50fe4745038e20200007d770000000014231c6a0000000080eeea740100000000000000f8e2ed74000000000400000080a90c744840ec74f8e2ed74e8bfd10a80e88776d055e70280e88776e4bfd10a0000000080e887760000000000000000bcccd10a506a8077abd088c7feffffff48c0d10ab7167d7700080000080800000000000034c0d10a000800000000e2020000000000000000ffffffff0000000000000000000000008e97ed02a497ed02 (UID: 00000000-00007348) "#SKA131-025.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000078bfd10a38cf7d779c38e202e4bfd10a010000005038e2029c38e2025038e202040000000400000000e0ed7400100000e4bfd10a010000005038e202cd977d779c977d77f7e6d1bab50fe4745038e20200007d770000000014231c6a0000000080eeea740100000000000000f8e2ed74000000000400000080a90c744840ec74f8e2ed74e8bfd10a80e88776d055e70280e88776e4bfd10a0000000080e887760000000000000000bcccd10a506a8077abd088c7feffffff48c0d10ab7167d7700080000080800000000000034c0d10a000800000000e2020000000000000000ffffffff000000000000000000000000963ee802ae3ee802 (UID: 00000000-00007348) "#SKA131-025.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000078bfd10a38cf7d779c38e202e4bfd10a010000005038e2029c38e2025038e202040000000400000000e0ed7400100000e4bfd10a010000005038e202cd977d779c977d77f7e6d1bab50fe4745038e20200007d770000000014231c6a0000000080eeea740100000000000000f8e2ed74000000000400000080a90c744840ec74f8e2ed74e8bfd10a80e88776d055e70280e88776e4bfd10a0000000080e887760000000000000000bcccd10a506a8077abd088c7feffffff48c0d10ab7167d7700080000080800000000000034c0d10a000800000000e2020000000000000000ffffffff0000000000000000000000002619e8023a19e802 (UID: 00000000-00007348) "#SKA131-025.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000078bfd10a38cf7d779c38e202e4bfd10a010000005038e2029c38e2025038e202040000000400000000e0ed7400100000e4bfd10a010000005038e202cd977d779c977d77f7e6d1bab50fe4745038e20200007d770000000014231c6a0000000080eeea740100000000000000f8e2ed74000000000400000080a90c744840ec74f8e2ed74e8bfd10a80e88776d055e70280e88776e4bfd10a0000000080e887760000000000000000bcccd10a506a8077abd088c7feffffff48c0d10ab7167d7700080000080800000000000034c0d10a000800000000e2020000000000000000ffffffff0000000000000000000000004e3be802663be802 (UID: 00000000-00007348)30:T42b,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp")31:Tb34,"#SKA131-025.exe" queries volume information of "C:\#SKA131-025.exe" at 00000000-00007348-00000C17-538538041 "#SKA131-025.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00007348-00000C17-538721083 "#SKA131-025.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00007348-00000C17-538894301 "#SKA131-025.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00007348-00000C17-540112151 "#SKA131-025.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00007348-00000C17-542977952 "#SKA131-025.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00007348-00000C17-543054220 "#SKA131-025.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Design.dll" at 00000000-00007348-00000C17-543113240 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00002920-00000C17-551231516 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00002920-00000C17-553534175 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002920-00000C17-556848139 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002920-00000C17-559499350 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002920-00000C17-561750722 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002920-00000C17-562253402 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002920-00000C17-56239519432:T3ace,"#SKA131-025.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007348) "#SKA131-025.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007348) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00002920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00002920)33:Te14f,"#SKA131-025.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetThemeAppPropertiesW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter OpenThemeDataW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetSysColorW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipGetFamilyName (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter SaveDC (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateFontIndirect (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetMapMode (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter DrawTextExWW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipCreateFontFamilyFromName (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetTextExtentPoint32W (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipGetLogFontW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ND_WU1 (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ND_WU1_RetAddr (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter SetTimer (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter KillTimer (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipCreateSolidFill (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipLoadImageFromStream (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipImageForceValidation (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipGetImageType (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipGetImageRawFormat (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipBitmapGetPixel (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipBitmapSetPixel (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter DestroyWindowW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CloseThemeDataW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter RestoreDC (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter GdipDeleteBrush (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007348) "#SKA131-025.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007348) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutput (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutputW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutput (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutputW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002920) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00002920)34:T7fed,Found reference to API (Indicator: "GetObject"; File: "#SKA131-025.exe") Found reference to API (Indicator: "InitializeConditionVariable"; File: "00000000-00002920.00000001.103507.008F1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "00000000-00002920.00000001.103507.008F1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "00000000-00002920.00000001.103507.008F1000.00000020.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00001084.00000000.102588.00D82000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "SetNamedSecurityInfoW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetSidLengthRequired"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "InitializeSid"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "AddAccessAllowedAceEx"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CryptAcquireContextA"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CryptDeriveKey"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CryptDestroyKey"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "RegCreateKeyW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetPrivateProfileSectionW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "WritePrivateProfileSectionW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "SHGetMalloc"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "SHFileOperationW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "SHGetDesktopFolder"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "CharPrevW"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp")35:T1e7e,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 49071-158-008FD560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 49071-193-008F8190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 49071-193-008F8190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 49071-193-008F8190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 49071-195-008FBFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 49071-206-008F8AF0 "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp 00000000-00001084.00000000.102588.05490000.00000040.mdmp "SOFTWARE\Microsoft\Connection Manager\Mappings" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp 00000000-00001084.00000000.102588.05490000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp 00000000-00001084.00000000.102588.05490000.00000040.mdmp "SOFTWARE\Microsoft\Connection Manager\" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp 00000000-00001084.00000000.102588.05490000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Network\Network Connections" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp 00000000-00001084.00000000.102588.05490000.00000040.mdmp "MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CMEXCEPT" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp 00000000-00001084.00000000.102588.05490000.00000040.mdmp "Software\Policies\Microsoft\Windows\Network Connections" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp 00000000-00001084.00000000.102588.05490000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Desktop\NameSpace" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp 00000000-00001084.00000000.102588.05490000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp 00000000-00001084.00000000.102588.05490000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp 00000000-00001084.00000000.102588.05490000.00000040.mdmp "SOFTWARE\Microsoft\Connection Manager\UserInfo\" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp 00000000-00001084.00000000.102588.05490000.00000040.mdmp "SOFTWARE\Microsoft\Connection Manager\SingleUserInfo\" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp 00000000-00001084.00000000.102588.05490000.00000040.mdmp "SOFTWARE\Microsoft\Connection Manager\Guid Mappings" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp 00000000-00001084.00000000.102588.05490000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp 00000000-00001084.00000000.102588.05490000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMAK.EXE" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp 00000000-00001084.00000000.102588.05490000.00000040.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002920.00000000.102581.029A0000.00000004.mdmp 00000000-00002920.00000001.103507.029C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002920.00000000.102581.029A0000.00000004.mdmp 00000000-00002920.00000001.103507.029C0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002920.00000001.103507.008F1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002920.00000001.103507.008F1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002920.00000001.103507.008F1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002920.00000001.103507.008F1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002920.00000001.103507.008F1000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002920.00000001.103507.008F1000.00000020.mdmp36:T953,Process #SKA131-025.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7348:168:WilStaging_02" Process #SKA131-025.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process #SKA131-025.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7348:64:WilError_01" Process #SKA131-025.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process #SKA131-025.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process #SKA131-025.exe created mutex with name "SM0:7348:168:WilStaging_02" Process #SKA131-025.exe created mutex with name "Local\SM0:7348:168:WilStaging_02" Process #SKA131-025.exe created mutex with name "Local\SM0:7348:64:WilError_01" Process #SKA131-025.exe created mutex with name "Local\ZonesCacheCounterMutex" Process #SKA131-025.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process #SKA131-025.exe created mutex with name "SM0:7348:64:WilError_01" Process #SKA131-025.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process #SKA131-025.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7348:168:WilStaging_02" Process #SKA131-025.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7348:64:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2920:168:WilStaging_02" Process powershell.exe created mutex with name "SM0:2920:168:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:2920:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2920:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process cmstp.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7544:168:WilStaging_02" Process cmstp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7544:168:WilStaging_02" Process cmstp.exe created mutex with name "\BaseNamedObjects\884B9844F1EZYLEz" Process cmstp.exe created mutex with name "\BaseNamedObjects\0K330SS7V7468WZz" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2140:304:WilStaging_02"37:Tf75,"#SKA131-025.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "#SKA131-025.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "#SKA131-025.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "#SKA131-025.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "#SKA131-025.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "#SKA131-025.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "#SKA131-025.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "#SKA131-025.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "#SKA131-025.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135]38:T2d2b,"SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp "SOFTWARE\Microsoft\Connection Manager\Mappings" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp "SOFTWARE\Microsoft\Connection Manager\" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Network\Network Connections" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp "MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CMEXCEPT" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp "Software\Policies\Microsoft\Windows\Network Connections" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Desktop\NameSpace" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp "SOFTWARE\Microsoft\Connection Manager\UserInfo\" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp "SOFTWARE\Microsoft\Connection Manager\SingleUserInfo\" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp "SOFTWARE\Microsoft\Connection Manager\Guid Mappings" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMAK.EXE" in Source: 00000000-00001084.00000000.102588.033A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE" in Source: 00000000-00001084.00000000.102588.05490000.00000040.mdmp "SOFTWARE\Microsoft\Connection Manager\Mappings" in Source: 00000000-00001084.00000000.102588.05490000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001084.00000000.102588.05490000.00000040.mdmp "SOFTWARE\Microsoft\Connection Manager\" in Source: 00000000-00001084.00000000.102588.05490000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Network\Network Connections" in Source: 00000000-00001084.00000000.102588.05490000.00000040.mdmp "MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CMEXCEPT" in Source: 00000000-00001084.00000000.102588.05490000.00000040.mdmp "Software\Policies\Microsoft\Windows\Network Connections" in Source: 00000000-00001084.00000000.102588.05490000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Desktop\NameSpace" in Source: 00000000-00001084.00000000.102588.05490000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001084.00000000.102588.05490000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001084.00000000.102588.05490000.00000040.mdmp "SOFTWARE\Microsoft\Connection Manager\UserInfo\" in Source: 00000000-00001084.00000000.102588.05490000.00000040.mdmp "SOFTWARE\Microsoft\Connection Manager\SingleUserInfo\" in Source: 00000000-00001084.00000000.102588.05490000.00000040.mdmp "SOFTWARE\Microsoft\Connection Manager\Guid Mappings" in Source: 00000000-00001084.00000000.102588.05490000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s" in Source: 00000000-00001084.00000000.102588.05490000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMAK.EXE" in Source: 00000000-00001084.00000000.102588.05490000.00000040.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002920.00000000.102581.029A0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002920.00000000.102581.029A0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00002920.00000000.102581.04B40000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002920.00000001.103507.008F1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002920.00000001.103507.008F1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002920.00000001.103507.008F1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002920.00000001.103507.008F1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002920.00000001.103507.008F1000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002920.00000001.103507.008F1000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002920.00000001.103507.029C0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00002920.00000001.103507.029C0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}" in Source: 00000000-00002920.00000001.103507.029C0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{E7D35CFA-348B-485E-B524-252725D697CA}" in Source: 00000000-00002920.00000001.103507.029C0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}" in Source: 00000000-00002920.00000001.103507.029C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002920.00000001.103507.029C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002920.00000001.103507.08090000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007348.00000000.101795.02E20000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007348.00000000.101795.02E20000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00007348.00000000.101795.04FC0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00007348.00000000.101795.04FC0000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00007348.00000000.101795.04FC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00007348.00000000.101795.04FC0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007348.00000001.102278.02E20000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007348.00000001.102278.02E20000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007348.00000001.102278.02E20000.00000004.mdmp "-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007348.00000001.102278.09642000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007348.00000001.102278.09642000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00007348.00000001.102278.6FDE1000.00000020.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00007348.00000001.102278.6FDE1000.00000020.mdmp "HKLM\" in Source: 00000000-00007348.00000001.102278.6FDE1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00007348.00000001.102278.6FDE1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007348.00000001.102278.6FDE1000.00000020.mdmp39:T4f68,"GET /v1/eus011/8838e7bf-6921-481f-b92b-85cd2e150b9f/b5502674-e198-409c-95fd-d67c29114d98_650.mp4 HTTP/1.1 Host: prod-streaming-video-msn-com.akamaized.net Connection: keep-alive sec-ch-ua-platform: "Windows" Accept-Encoding: identity;q=1, *;q=0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: video Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Accept-Language: en-US,en;q=0.9 Range: bytes=4128768-4174783 If-Range: "0x8DF111191A4CAB7"" Response ==> HTTP/1.1 206 Partial Content Content-Type: video/mp4 Last-Modified: Sat 12 Sep 2026 21:05:26 GMT ETag: "0x8DF111191A4CAB7" x-ms-request-id: bedf68d5-501e-0022-4ffa-42d50c000000 x-ms-version: 2025-05-05 x-ms-meta-videofiletype: progressive x-ms-creation-time: Sat 12 Sep 2026 21:05:26 GMT x-ms-blob-content-md5: FK+CBoDjAJQheoLMIvTL2Q== x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob x-ms-server-encrypted: true x-ms-access-tier: Hot x-ms-access-tier-inferred: true x-ms-last-access-time: Sat 12 Sep 2026 21:05:26 GMT Access-Control-Allow-Origin: * x-azure-ref: 20260912T211903Z-178b6ff8fcbdbbw7hC1BY1wq2g0000000ebg0000000032es x-fd-int-roxy-purgeid: 0 rule: eus011 Accept-Ranges: bytes Cache-Control: public max-age=2200429 Date: Wed 14 Oct 2026 05:18:02 GMT Content-Range: bytes 4128768-4174783/4174784 Content-Length: 46016 Connection: keep-alive with response body ==>C28F5DC3A223C39266C2B838C393C38029C292C38D1CC284600EC3B8C2AAC2862BC3BE06165C233BC29F51C39EC2B11DC2A0C29BC3966CC3923E05C2B001C2B0....... "GET /v1/eus011/8838e7bf-6921-481f-b92b-85cd2e150b9f/b5502674-e198-409c-95fd-d67c29114d98_650.mp4 HTTP/1.1 Host: prod-streaming-video-msn-com.akamaized.net Connection: keep-alive sec-ch-ua-platform: "Windows" Accept-Encoding: identity;q=1, *;q=0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: video Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Accept-Language: en-US,en;q=0.9 Range: bytes=163840-4128767 If-Range: "0x8DF111191A4CAB7"" Response ==> HTTP/1.1 206 Partial Content Content-Type: video/mp4 Last-Modified: Sat 12 Sep 2026 21:05:26 GMT ETag: "0x8DF111191A4CAB7" x-ms-request-id: bedf68d5-501e-0022-4ffa-42d50c000000 x-ms-version: 2025-05-05 x-ms-meta-videofiletype: progressive x-ms-creation-time: Sat 12 Sep 2026 21:05:26 GMT x-ms-blob-content-md5: FK+CBoDjAJQheoLMIvTL2Q== x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob x-ms-server-encrypted: true x-ms-access-tier: Hot x-ms-access-tier-inferred: true x-ms-last-access-time: Sat 12 Sep 2026 21:05:26 GMT Access-Control-Allow-Origin: * x-azure-ref: 20260912T211903Z-178b6ff8fcbdbbw7hC1BY1wq2g0000000ebg0000000032es x-fd-int-roxy-purgeid: 0 rule: eus011 Accept-Ranges: bytes Cache-Control: public max-age=2200427 Date: Wed 14 Oct 2026 05:18:04 GMT Content-Range: bytes 163840-4128767/4174784 Content-Length: 3964928 Connection: keep-alive with response body ==>C2BB57C39B7EC299C29FC39C086AC2BB3DC3BA753AC2B64577C2B7C287C287C3ADC3B6C380446813342010C2B6C38F56C3B3C29DC2AFC3A1C38308C29BC3BB18....... "GET /v1/eus011/8838e7bf-6921-481f-b92b-85cd2e150b9f/b5502674-e198-409c-95fd-d67c29114d98_650.mp4 HTTP/1.1 Host: prod-streaming-video-msn-com.akamaized.net Connection: keep-alive sec-ch-ua-platform: "Windows" Accept-Encoding: identity;q=1, *;q=0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: video Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Accept-Language: en-US,en;q=0.9 Range: bytes=4173824-4174783 If-Range: "0x8DF111191A4CAB7"" Response ==> HTTP/1.1 206 Partial Content Content-Type: video/mp4 Last-Modified: Sat 12 Sep 2026 21:05:26 GMT ETag: "0x8DF111191A4CAB7" x-ms-request-id: bedf68d5-501e-0022-4ffa-42d50c000000 x-ms-version: 2025-05-05 x-ms-meta-videofiletype: progressive x-ms-creation-time: Sat 12 Sep 2026 21:05:26 GMT x-ms-blob-content-md5: FK+CBoDjAJQheoLMIvTL2Q== x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob x-ms-server-encrypted: true x-ms-access-tier: Hot x-ms-access-tier-inferred: true x-ms-last-access-time: Sat 12 Sep 2026 21:05:26 GMT Access-Control-Allow-Origin: * x-azure-ref: 20260912T211903Z-178b6ff8fcbdbbw7hC1BY1wq2g0000000ebg0000000032es x-fd-int-roxy-purgeid: 0 rule: eus011 Accept-Ranges: bytes Cache-Control: public max-age=2200426 Date: Wed 14 Oct 2026 05:18:05 GMT Content-Range: bytes 4173824-4174783/4174784 Content-Length: 960 Connection: keep-alive with response body ==>661C0030702600307FC3950030C282C2BB0030C28EC3870030C29B160030C2A6C2830030C2B0C2A10030C2B31C0030C2BB0F0030C38A5A0030C392550030C39C....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.pcguide.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Date: Wed 14 Oct 2026 05:17:47 GMT Server: cloudflare X-Ua-Compatible: IE=edge Expires: Wed 14 Oct 2026 05:46:50 GMT Cf-Ray: a4a41ea57b6a46f8-SJC Vary: Accept-Encoding X-Redirect-By: Yoast SEO Cf-Edge-Cache: cache platform=wordpress Cf-Cache-Status: HIT Speculation-Rules: "/cdn-cgi/speculation" Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Location: https://www.pcguide.com Cf-Apo-Via: origin qs X-Cache: MISS Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=HHFj3qFx9813Qq7kGvZoGdo1AfJd%2BRkYb9FoDCH%2FV%2F%2BczWPNkBcyI6MGR2ygaoT7ORwpRJzuL8sgL2E9fEGoZBBygskz4y%2BnCnD%2BzFJOv%2Bxr7BT1OlBQr9SW%2FsvqwkhAlg%3D%3D"}]} Cache-Control: max-age=14400 Alt-Svc: h3=":443"; ma=86400 Age: 1856 with no response body "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: finance.biggo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/x-icon Date: Wed 14 Oct 2026 05:17:47 GMT Last-Modified: Tue 13 Oct 2026 09:17:16 GMT Server: istio-envoy X-Envoy-Upstream-Service-Time: 1 Vary: Origin Accept-Encoding Content-Encoding: zstd Etag: W/"3c2e-1a1348d4560" Accept-Ranges: bytes Cache-Control: public max-age=0 with no response body "GET /favicon?url=wccftech.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Wed 14 Oct 2026 05:17:48 GMT X-Msedge-Ref: Ref A: C540EDE71E5E4EC5A9CB9DF4CF8EAA05 Ref B: SJC211051204031 Ref C: 2026-10-14T05:17:48Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: C540EDE71E5E4EC5A9CB9DF4CF8EAA05 Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS00000V_FABRICROUTER-AZUREGLOBALPRIVATE-866488D5BF-8RZXS Ref C: 2026-10-14T05:17:48Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET / HTTP/2 Host: www.pcguide.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: text/html; charset=UTF-8 Date: Wed 14 Oct 2026 05:17:48 GMT Server: cloudflare X-Ua-Compatible: IE=edge Expires: Wed 14 Oct 2026 04:53:07 GMT Cf-Ray: a4a41eaaca96e0ce-SJC Vary: Accept-Encoding Content-Encoding: br Cf-Edge-Cache: cache platform=wordpress Cf-Cache-Status: HIT Speculation-Rules: "/cdn-cgi/speculation" Last-Modified: Wed 14 Oct 2026 04:53:09 GMT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Cf-Apo-Via: tcache X-Cache: HIT Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=QEWjflPy8W9gggxXg7ZwamzrK7ch%2BNlMvF85sFYHioKOKdDmlvAW4Mnbqa7H%2FxSxHw2BU1szJ1JApvjrDggqJ%2Bf5UyNggsu4AyPOKezOUp%2BK%2BEw4JF0oqcVD9LisN0pVQA%3D%3D"}]} Cache-Control: max-age=0 Alt-Svc: h3=":443"; ma=86400 Age: 128 with response body ==>BINARY_CONTENT....... "GET /favicon?url=makeuseof.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Wed 14 Oct 2026 05:17:48 GMT X-Msedge-Ref: Ref A: B482642CEFCA4B64879A258D67E9E1B2 Ref B: BY1AA1072319029 Ref C: 2026-10-14T05:17:49Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: B482642CEFCA4B64879A258D67E9E1B2 Ref B: SC-WUS2-1Y052_AKS-GEN02-14570707-VMSS000001_FABRICROUTER-AZUREGLOBALPRIVATE-866488D5BF-TXPP5 Ref C: 2026-10-14T05:17:49Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=mmafighting.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Wed 14 Oct 2026 05:17:48 GMT X-Msedge-Ref: Ref A: 9B5F4706C4F54961B43727FF5174A9DB Ref B: BY1AA1072319029 Ref C: 2026-10-14T05:17:49Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 9B5F4706C4F54961B43727FF5174A9DB Ref B: SC-WUS2-1Y052_AKS-GEN00-14570707-VMSS00000F_FABRICROUTER-AZUREGLOBALPRIVATE-866488D5BF-5F5B6 Ref C: 2026-10-14T05:17:49Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: modernetdigital.cat User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Date: Wed 14 Oct 2026 05:17:49 GMT Server: cloudflare Cf-Ray: a4a41eb1a986938c-SJC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Location: https://www.modernetdigital.cat/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Kfzd7upogwSJIZ4ujQJ2QgvjEt9glTqKDTP28sy8TrRJN%2Bt8GNfLnlBwdqL8w0HgFtb8GQLjpi2wd3HYrZDBj0rjlFttwKt0BVuPxJ4E9hgEgAbKsbZtkLsMXawCpYWjRj5itGq3"}]} with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C626F6479....... "GET /favicon?url=news.futunn.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Wed 14 Oct 2026 05:17:49 GMT X-Msedge-Ref: Ref A: 55671F79BF1847A3874BC9FD752BCBC7 Ref B: BY1AA1072319029 Ref C: 2026-10-14T05:17:50Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 55671F79BF1847A3874BC9FD752BCBC7 Ref B: SC-WUS2-1Y052_AKS-GEN02-14570707-VMSS000001_FABRICROUTER-AZUREGLOBALPRIVATE-866488D5BF-TXPP5 Ref C: 2026-10-14T05:17:50Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.modernetdigital.cat User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/x-icon Date: Wed 14 Oct 2026 05:17:50 GMT Cdn-Requestpullcode: 200 Server: BunnyCDN-NY1-1313 Cdn-Pullzone: 5347633 Cdn-Requesttime: 0 Cdn-Cache: HIT Cdn-Requestpullsuccess: True Cdn-Requestcountrycode: US Via: Opennemas Proxy Server Cdn-Requestid: 575df63e9bef1258a543e4fa2bbb5af4 Last-Modified: Fri 09 Oct 2026 09:25:35 GMT Cdn-Proxyver: 1.71 Cdn-Edgestorageid: 885 X-Powered-By: OpenNemas X-Cache: MISS Cdn-Status: 200 Cache-Control: public max-age=31536000 immutable Accept-Ranges: bytes Cdn-Cachedat: 10/11/2026 02:29:52 Age: 0 with no response body "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: roihacks.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 404 Not Found Content-Type: text/html Date: Wed 14 Oct 2026 05:17:51 GMT Server: cloudflare Cf-Ray: a4a41eba1d6e3023-SJC Vary: Accept-Encoding Content-Encoding: zstd X-Turbo-Charged-By: LiteSpeed Cf-Cache-Status: HIT Platform: hostinger Last-Modified: Thu 15 Jan 2026 04:31:46 GMT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=YwaVfU6wJE8icUtEUceyT10eZLYmwhq3Uh6mTAQALCQcNDz6A%2Bf6fCEY0gYtAmHPWEa2MWeeaTtctKXwa5VYvDDIexuFimBdXMpq%2Fu5K0B7GHLiiCTsxlM5nKEAES%2Bs%3D"}]} Panel: hpanel Alt-Svc: h3=":443"; ma=86400 Cache-Control: max-age=31536000 Age: 10 with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: aiemaily.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/x-icon Date: Wed 14 Oct 2026 05:17:51 GMT Server: cloudflare Cf-Ray: a4a41ebcde171975-SJC Vary: rsc next-router-state-tree next-router-prefetch next-router-segment-prefetch Content-Encoding: gzip Cf-Cache-Status: HIT Last-Modified: Wed 14 Oct 2026 05:17:45 GMT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} X-Nextjs-Cache: HIT Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=b%2FLz%2F7VsypU0OkbWItkjykINJrs6HJ8zTSjEKFnHsYebGKEc79N3FtNvvvq18c55mKJYgol5DCis36YTRXAGke8NKUM4PtLVtMVuW%2BNC15DuqZnuiMQPY7LXMd5xVeQ%3D"}]} Alt-Svc: h3=":443"; ma=86400 Cache-Control: public max-age=604800 stale-while-revalidate=2592000 Content-Signal: search=yes ai-train=no ai-input=yes Age: 5 with response body ==>BINARY_CONTENT.......3a:T496,Launches browser "msedge.exe" (UID: 00000000-00002140) Launches browser "msedge.exe" (UID: 00000000-00001044) Launches browser "msedge.exe" (UID: 00000000-00003892) Launches browser "msedge.exe" (UID: 00000000-00002448) Launches browser "msedge.exe" (UID: 00000000-00007860) Launches browser "msedge.exe" (UID: 00000000-00004632) Launches browser "msedge.exe" (UID: 00000000-00007424) Launches browser "msedge.exe" (UID: 00000000-00006440) Launches browser "msedge.exe" (UID: 00000000-00007296) Launches browser "msedge.exe" (UID: 00000000-00000636) Launches browser "msedge.exe" (UID: 00000000-00002412) Launches browser "msedge.exe" (UID: 00000000-00004944) Launches browser "msedge.exe" (UID: 00000000-00005324) Launches browser "msedge.exe" (UID: 00000000-00007868) Launches browser "msedge.exe" (UID: 00000000-00001532) Launches browser "msedge.exe" (UID: 00000000-00001332) Launches browser "msedge.exe" (UID: 00000000-00007188) Launches browser "msedge.exe" (UID: 00000000-00004600) Launches browser "msedge.exe" (UID: 00000000-00004352) Launches browser "msedge.exe" (UID: 00000000-00008028) Launches browser "msedge.exe" (UID: 00000000-00007716)3b:T2752,"#SKA131-025.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73f20000 "#SKA131-025.exe" loaded module "ADVAPI32.DLL" at base 74200000 "#SKA131-025.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74d30000 "#SKA131-025.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74d30000 "#SKA131-025.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74d30000 "#SKA131-025.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73e70000 "#SKA131-025.exe" loaded module "SHLWAPI.DLL" at base 74b80000 "#SKA131-025.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74400000 "#SKA131-025.exe" loaded module "VERSION.DLL" at base 73e60000 "#SKA131-025.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 736b0000 "#SKA131-025.exe" loaded module "USER32.DLL" at base 74280000 "#SKA131-025.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 74d30000 "#SKA131-025.exe" loaded module "MSCOREE.DLL" at base 74140000 "#SKA131-025.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 74f60000 "#SKA131-025.exe" loaded module "PSAPI.DLL" at base 74bd0000 "#SKA131-025.exe" loaded module "RPCRT4.DLL" at base 77050000 "#SKA131-025.exe" loaded module "KERNEL32.DLL" at base 74740000 "#SKA131-025.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 721d0000 "#SKA131-025.exe" loaded module "OLE32.DLL" at base 76f50000 "#SKA131-025.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 72150000 "#SKA131-025.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 74f60000 "#SKA131-025.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74d30000 "#SKA131-025.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 720c0000 "#SKA131-025.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 71660000 "#SKA131-025.exe" loaded module "UXTHEME.DLL" at base 72150000 "#SKA131-025.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 70ee0000 "#SKA131-025.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 706c0000 "#SKA131-025.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 705b0000 "#SKA131-025.exe" loaded module "NTDLL.DLL" at base 77790000 "#SKA131-025.exe" loaded module "SHELL32.DLL" at base 75400000 "#SKA131-025.exe" loaded module "BCRYPT.DLL" at base 70590000 "#SKA131-025.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 70560000 "#SKA131-025.exe" loaded module "IMM32.DLL" at base 741d0000 "#SKA131-025.exe" loaded module "COMCTL32.DLL" at base 704d0000 "#SKA131-025.exe" loaded module "GDI32.DLL" at base 775f0000 "#SKA131-025.exe" loaded module "GDIPLUS.DLL" at base 70330000 "#SKA131-025.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 70330000 "#SKA131-025.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 74d30000 "#SKA131-025.exe" loaded module "OLEAUT32" at base 748f0000 "#SKA131-025.exe" loaded module "OLEAUT32.DLL" at base 748f0000 "#SKA131-025.exe" loaded module "WINDOWSCODECS.DLL" at base 6ff40000 "#SKA131-025.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 74f60000 "#SKA131-025.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74660000 "#SKA131-025.exe" loaded module "WLDP.DLL" at base 6ff20000 "#SKA131-025.exe" loaded module "AMSI.DLL" at base 6ff10000 "#SKA131-025.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73e60000 "#SKA131-025.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6fec0000 "#SKA131-025.exe" loaded module "KERNEL32" at base 74740000 "#SKA131-025.exe" loaded module "%WINDIR%\SYSWOW64\SXU3BE0K.DLL" at base 6fe80000 "#SKA131-025.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6fde0000 "#SKA131-025.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 74740000 "#SKA131-025.exe" loaded module "USERENV.DLL" at base 6fee0000 "#SKA131-025.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74200000 "#SKA131-025.exe" loaded module "NTDLL" at base 77790000 "#SKA131-025.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 6f910000 "#SKA131-025.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76760000 "#SKA131-025.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 6fbf0000 "#SKA131-025.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74740000 "#SKA131-025.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 6f400000 "#SKA131-025.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75400000 "#SKA131-025.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 6f6b0000 "#SKA131-025.exe" loaded module "MSISO.DLL" at base 6f3a0000 "#SKA131-025.exe" loaded module "SSPICLI.DLL" at base 741b0000 "#SKA131-025.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d30000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 740e0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 74200000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74d30000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74d30000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74d30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73e70000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 74b80000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74400000 "powershell.exe" loaded module "VERSION.DLL" at base 740d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 736c0000 "powershell.exe" loaded module "USER32.DLL" at base 74280000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 74d30000 "powershell.exe" loaded module "MSCOREE.DLL" at base 74140000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 74f60000 "powershell.exe" loaded module "PSAPI.DLL" at base 74bd0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 77050000 "powershell.exe" loaded module "KERNEL32.DLL" at base 74740000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 72200000 "powershell.exe" loaded module "OLE32.DLL" at base 76f50000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 74f60000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 748f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73f50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74660000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74d30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72170000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 71710000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 70ef0000 "powershell.exe" loaded module "COMBASE.DLL" at base 74f60000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 74f60000 "powershell.exe" loaded module "NTDLL.DLL" at base 77790000 "powershell.exe" loaded module "SHELL32.DLL" at base 75400000 "powershell.exe" loaded module "WINTRUST.DLL" at base 74f10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 70770000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 74f10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 744d0000 "powershell.exe" loaded module "AMSI.DLL" at base 740a0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 744d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 702e0000 "powershell.exe" loaded module "SECUR32.DLL" at base 70170000 "powershell.exe" loaded module "SSPICLI.DLL" at base 741b0000 "powershell.exe" loaded module "WLDP.DLL" at base 6fe80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 6fe00000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74740000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6f470000 "powershell.exe" loaded module "OLEAUT32" at base 748f0000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 6f460000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 74d30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6f2f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6f230000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 74d30000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 74d30000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 747400003c:Ta8a,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp")3d:T1622,"#SKA131-025.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "#SKA131-025.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "#SKA131-025.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "#SKA131-025.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "#SKA131-025.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "#SKA131-025.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "#SKA131-025.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "#SKA131-025.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "#SKA131-025.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "#SKA131-025.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "#SKA131-025.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "#SKA131-025.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "#SKA131-025.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "#SKA131-025.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "#SKA131-025.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "#SKA131-025.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "#SKA131-025.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "#SKA131-025.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "#SKA131-025.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "#SKA131-025.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "#SKA131-025.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "#SKA131-025.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "#SKA131-025.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "#SKA131-025.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "#SKA131-025.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "#SKA131-025.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "#SKA131-025.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "#SKA131-025.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "#SKA131-025.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "#SKA131-025.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "#SKA131-025.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "#SKA131-025.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "#SKA131-025.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PROGID") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS")3e:T48c,"#SKA131-025.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3f:T2c11,Process "powershell.exe" (UID: 00000000-00002920) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "powershell.exe" (UID: 00000000-00002920) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "cmstp.exe" (UID: 00000000-00007544) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "cmstp.exe" (UID: 00000000-00007544) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "cmd.exe" (UID: 00000000-00007548) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00007548) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00002140) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00002140) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00001044) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_2140_UKZHZZBEZVPMXHYG", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="2140"" Process "msedge.exe" (UID: 00000000-00003892) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="7", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00007860) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00006440) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="Y1YAd66ZYVrxvKR", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="ahaEWVW", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="Y1YAd66ZYVrxvKR", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\ahaEWVW", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\ahaEWVW", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00000636) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00004944) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="Y1YAd66ZYVrxvKR", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="ahaEWVW", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="Y1YAd66ZYVrxvKR", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\ahaEWVW", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\ahaEWVW", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00005324) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00007188) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="Y1YAd66ZYVrxvKR", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="ahaEWVW", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="Y1YAd66ZYVrxvKR", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\ahaEWVW", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\ahaEWVW", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00004600) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00008028) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="Y1YAd66ZYVrxvKR", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="ahaEWVW", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="Y1YAd66ZYVrxvKR", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\ahaEWVW", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\ahaEWVW", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00007716) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH"40:T738,"#SKA131-025.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "#SKA131-025.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "#SKA131-025.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "#SKA131-025.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "#SKA131-025.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "#SKA131-025.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "#SKA131-025.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "#SKA131-025.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "#SKA131-025.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "#SKA131-025.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "#SKA131-025.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "#SKA131-025.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "#SKA131-025.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "#SKA131-025.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH")41:Tf28,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007348-00000C2B-537786467] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007348-00000C2B-538087876] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007348-00000C2B-538169398] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007348-00000C2B-538228337] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007348-00000C2B-538501493] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007348-00000C2B-538538831] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007348-00000C2B-538583315] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007348-00000C2B-538671458] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00007348-00000C2B-538765256] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00007348-00000C2B-538844865] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00007348-00000C2B-538989396] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00007348-00000C2B-539104733] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00007348-00000C2B-539392605] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00007348-00000C2B-539417432] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00007348-00000C2B-539739035] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007348-00000C2B-540445628] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007348-00000C2B-541382028] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007348-00000C2B-541401719] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00007348-00000C2B-541422182] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" [Source: 00000000-00007348-00000C2B-541656317] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007348-00000C2B-541994184] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00007348-00000C2B-542337535] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00007348-00000C2B-542425302] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007348-00000C2B-548461109] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00002920-00000C2B-550949841]42:Tcea,Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "C:\\#SKA131-025.exe"" (UID: 00000000-00002920) Spawned process "#SKA131-025.exe" (UID: 00000000-00001084) Spawned process "cmstp.exe" (UID: 00000000-00007544) Spawned process "cmd.exe" with commandline "/c del "C:\\#SKA131-025.exe"" (UID: 00000000-00007548) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00002140) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00001044), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003892), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00002448), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007860), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00004632), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00007424), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=audio.mojom.AudioService --lan ..." (UID: 00000000-00006440), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00007296), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00000636), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00002412), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00004944), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00005324), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007868), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00001532), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00001332), Spawned process "msedge.exe" with commandline "--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu ..." (UID: 00000000-00007188), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00004600), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00004352), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=on_device_model.mojom.OnDevice ..." (UID: 00000000-00008028), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007716)43:Tcea,Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "C:\\#SKA131-025.exe"" (UID: 00000000-00002920) Spawned process "#SKA131-025.exe" (UID: 00000000-00001084) Spawned process "cmstp.exe" (UID: 00000000-00007544) Spawned process "cmd.exe" with commandline "/c del "C:\\#SKA131-025.exe"" (UID: 00000000-00007548) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00002140) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00001044), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003892), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00002448), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007860), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00004632), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00007424), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=audio.mojom.AudioService --lan ..." (UID: 00000000-00006440), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00007296), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00000636), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00002412), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00004944), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00005324), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007868), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00001532), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00001332), Spawned process "msedge.exe" with commandline "--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu ..." (UID: 00000000-00007188), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00004600), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00004352), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=on_device_model.mojom.OnDevice ..." (UID: 00000000-00008028), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007716)44:T11a6,The input sample is signed with a certificate issued by "CN=WR3, O=Google Trust Services, C=US" (SHA1: 51:7A:A2:26:49:2C:70:60:03:DB:D1:48:F5:AF:94:D0:47:F3:D4:AE; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: E2:51:CB:7D:AF:59:31:04:5A:80:45:45:A0:F4:5B:C2:26:A0:BD:76; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 4B:52:6B:32:4D:A4:76:C2:1B:38:0F:B1:9E:79:75:72:DA:0A:2E:35; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 ECC CA OCSP 06, O=Microsoft Corporation, C=US" (SHA1: 2B:56:9D:5A:30:51:78:CD:39:CD:44:E3:B0:28:BA:2E:14:DF:82:41; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS ECC Root G2, O=Microsoft Corporation, C=US" (SHA1: 9B:C5:75:46:AC:BD:B2:9E:38:8C:D1:79:1B:43:DE:4F:65:9B:84:4B; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7F:A0:5A:CF:9B:4A:AB:B0:DE:0C:FA:FA:29:7D:DF:92:FD:C5:F3:F5; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7E:04:DE:89:6A:3E:66:6D:00:E6:87:D3:3F:FA:D9:3B:E8:3D:34:9E; see report for more information) The input sample is signed with a certificate issued by "CN=YR2, O=Let's Encrypt, C=US" (SHA1: EA:D4:6F:AF:8E:7B:B5:42:57:FF:00:6D:47:19:5C:CA:2E:72:B1:F3; see report for more information) The input sample is signed with a certificate issued by "CN=Root YR, O=ISRG, C=US" (SHA1: 2D:74:D6:DF:D9:6E:EA:55:AD:7B:AA:FA:0D:3C:65:52:B2:DA:DC:37; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: AB:9D:02:63:24:4D:D0:32:6E:B6:70:15:70:5A:66:7E:79:CF:E9:98; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 94:EB:74:C2:23:4F:88:4C:55:3D:5D:DE:52:D6:B2:80:24:3F:F7:9B; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G3 TLS ECC SHA384 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 80:B2:9F:CE:36:F7:1B:99:CD:BB:71:38:B2:10:7D:02:2D:47:8A:F9; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 95:77:F9:1F:E8:6C:27:D9:91:21:29:73:0E:81:66:37:3F:C2:EE:B8; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 10, O=Microsoft Corporation, C=US" (SHA1: B6:35:D5:85:3C:04:0E:36:4F:C7:61:D8:EE:82:32:53:C8:78:2A:AF; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: B6:63:D8:41:3C:A3:5F:3F:22:64:3C:CB:C2:D3:25:07:00:91:6B:1A; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 67:F2:9D:D4:FD:F8:FB:79:12:E1:BA:9A:5B:63:C0:38:7F:14:F0:91; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB" (SHA1: 48:62:BA:29:DB:48:52:50:EC:DE:95:62:15:70:58:A6:E2:13:BC:AE; see report for more information)45:T712,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp")46:T6bc,Found reference to API "LoadLibrary of %s failed with error, hResult = 0x%x." (Indicator: "LoadLibrary"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "LoadLibrary failed in GetCoCreateInstanceAsAdminHandle. GLE = %#x" (Indicator: "LoadLibrary"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "LoadLibrary failed in SetShieldIcon. GLE = %#x" (Indicator: "LoadLibrary"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "LoadLibrary failed in RemoveShieldIcon. GLE = %#x" (Indicator: "LoadLibrary"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "ppvPfn=%p] LoadLibrary() failed." (Indicator: "LoadLibrary"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002920.00000000.102581.00901000.00000002.mdmp, 00000000-00002920.00000001.103507.70715000.00000002.mdmp")47:T5b0,"#SKA131-025.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "#SKA131-025.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "#SKA131-025.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "#SKA131-025.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "#SKA131-025.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "#SKA131-025.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "#SKA131-025.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "#SKA131-025.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\APPLICATIONS\#SKA131-025.EXE"; Key: ""; Value: "") "#SKA131-025.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "")48:Tea6,"#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPX"; Key: "ALLOWDEVELOPMENTWITHOUTDEVLICENSE"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODELUNLOCK"; Key: "ALLOWDEVELOPMENTWITHOUTDEVLICENSE"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\APPCOMPAT"; Key: "RAISEDEFAULTAUTHNLEVEL"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "DEFAULTACCESSPERMISSION"; Value: "") "#SKA131-025.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "ANONYMOUSAPPCONTAINERIMPERSONATIONLEVELCHECK"; Value: "")49:T849,"#SKA131-025.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "#SKA131-025.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "#SKA131-025.exe" trying to access non-existent file "C:\FLTLIB.DLL" "#SKA131-025.exe" trying to access non-existent file "C:\MSVCP140.DLL" "#SKA131-025.exe" trying to access non-existent file "C:\MSVCP140.dll" "#SKA131-025.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "#SKA131-025.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "#SKA131-025.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll"4a:T7d3,"#SKA131-025.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "#SKA131-025.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\MSCOREE.DLL.local" "#SKA131-025.exe" trying to access non-existent file "C:\#SKA131-025.EXE.CONFIG" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "#SKA131-025.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\#SKA131-025.EXE.LOG" "#SKA131-025.exe" trying to access non-existent file "C:\#SKA131-025.exe.config" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\FANT" "#SKA131-025.exe" trying to access non-existent file "C:\#SKA131-025.INI" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "#SKA131-025.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING" "#SKA131-025.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DRAWING.INI" "#SKA131-025.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI" "#SKA131-025.exe" trying to access non-existent file "C:\POSTAVKE.XML"4b:T1bfd,Pattern match: "https://www.bing.com/api/v1/mediation/tracking?d=-2zgwtsjypfudwadwov" Heuristic match: "o/.pt" Heuristic match: "jn.lt" Heuristic match: "=n.ec" Pattern match: "http://tempuri.org/dataset1.xsd" Heuristic match: "redteam.com" Pattern match: "www.msn.com/en-us/news/other/the-island-where-locals-say-data-centres-are-taking-their-water/ar-aa2esfsezuxmod" Heuristic match: "prod-streaming-video-msn-com.akamaized.net" Pattern match: "https://ntp.msn.com/accept-language" Pattern match: "www.pcguide.com" Heuristic match: "finance.biggo.com" Heuristic match: "services.bingapis.com" Heuristic match: "modernetdigital.cat" Pattern match: "www.modernetdigital.cat" Heuristic match: "roihacks.com" Heuristic match: "aiemaily.com" Heuristic match: "a.nel.cloudflare.com" Pattern match: "https://ntp.msn.com/,sampling_fraction:1.0,server_ip:172.67.189.224,status_code:404,type:http.error},type:network-error,url:https://roihacks.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t,user_agent:mozilla/5.0" Pattern match: "https://ntp.msn.com/,sampling_fraction:1.0,server_ip:172.67.71.73,status_code:200,type:abandoned},type:network-error,url:https://www.pcguide.com/,user_agent:mozilla/5.0" Heuristic match: "edge-consumer-static.azureedge.net" Heuristic match: "r.msftstatic.com" Heuristic match: "sb.scorecardresearch.com" Heuristic match: "this.name" Pattern match: "tempuri.org/dataset1.xsd" Heuristic match: "cmexcept.cat" Heuristic match: "2dk.cl" Heuristic match: "sk.gt" Heuristic match: "d8.tc" Heuristic match: "mn9iqmgvw,czcnew" - Source: "00000000-00002920.00000000.102581.029A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002920.00000000.102581.029A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00002920.00000000.102581.029A0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00002920.00000000.102581.02C80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002920.00000000.102581.02C80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002920.00000000.102581.02C80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002920.00000000.102581.07142000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002920.00000000.102581.07142000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.cr" - Source: "00000000-00002920.00000000.102581.0717B000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002920.00000000.102581.0717B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002920.00000000.102581.0717B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002920.00000001.103507.029C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00002920.00000001.103507.029C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002920.00000001.103507.029C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00002920.00000001.103507.029C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czcnew" - Source: "00000000-00002920.00000001.103507.029C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002920.00000001.103507.029C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lpzmo4;i26" - Source: "00000000-00002920.00000001.103507.029C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002920.00000001.103507.07142000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002920.00000001.103507.07142000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002920.00000001.103507.07142000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00002920.00000001.103507.07198000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00002920.00000001.103507.08080000.00000004.mdmp") Found URL "http://wwoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_29.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002920.00000001.103507.08090000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0washington1redmond1microsoft" - Source: "00000000-00002920.00000001.103507.08090000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!9]mwyprg?j?" - Source: "00000000-00002920.00000001.103507.08090000.00000004.mdmp") Found URL "http://crl.mrosoftjsystem.management.automation.resourcesmicrosoft" - Source: "00000000-00002920.00000001.103507.08090000.00000004.mdmp") Found URL "http://crl.microsoft.col/products/mictimstapca_2010-07-01.crl0z\n0l0j>http://www.microsoftr/certs/mictimstapca_2010-07-01.crt0elq6wwashington1redmond1icrosoft" - Source: "00000000-00002920.00000001.103507.08090000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0washington1redmond1microsoft" - Source: "00000000-00002920.00000001.103507.08116000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00002920.00000001.103507.08116000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrmicrosoft.management.infrastructure.userfilteredexceptionhandlingrefemit_inmemorymanifestmodulemscorlibsystem.diagnosticsdebuggableattributedebuggingmodes.ctorsystem.runtime.compilerservicesruntimecompatibilityattributesystemobjectuserfilteredexceptionhandlingexceptionactioninvokefunc" - Source: "00000000-00002920.00000001.103507.08116000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00002920.00000001.103507.70701000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007348.00000000.101795.02E20000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\" - Source: "00000000-00007348.00000000.101795.04FC0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007348.00000000.101795.04FC0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007348.00000000.101795.04FC0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007348.00000001.102278.02E20000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json10/14" - Source: "00000000-00007348.00000001.102278.07800000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,010/14" - Source: "00000000-00007348.00000001.102278.07800000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00007348.00000001.102278.6FDE1000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00007348.00000001.102278.6FDE1000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00007348.00000001.102278.6FDE1000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007348.00000001.102278.6FEC1000.00000020.mdmp")4d:T2427,GET /v1/eus011/8838e7bf-6921-481f-b92b-85cd2e150b9f/b5502674-e198-409c-95fd-d67c29114d98_650.mp4 HTTP/1.1 Host: prod-streaming-video-msn-com.akamaized.net Connection: keep-alive sec-ch-ua-platform: "Windows" Accept-Encoding: identity;q=1 *;q=0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: video Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Accept-Language: en-US en;q=0.9 Range: bytes=4128768-4174783 If-Range: "0x8DF111191A4CAB7" GET /v1/eus011/8838e7bf-6921-481f-b92b-85cd2e150b9f/b5502674-e198-409c-95fd-d67c29114d98_650.mp4 HTTP/1.1 Host: prod-streaming-video-msn-com.akamaized.net Connection: keep-alive sec-ch-ua-platform: "Windows" Accept-Encoding: identity;q=1 *;q=0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: video Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Accept-Language: en-US en;q=0.9 Range: bytes=163840-4128767 If-Range: "0x8DF111191A4CAB7" GET /v1/eus011/8838e7bf-6921-481f-b92b-85cd2e150b9f/b5502674-e198-409c-95fd-d67c29114d98_650.mp4 HTTP/1.1 Host: prod-streaming-video-msn-com.akamaized.net Connection: keep-alive sec-ch-ua-platform: "Windows" Accept-Encoding: identity;q=1 *;q=0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: video Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Accept-Language: en-US en;q=0.9 Range: bytes=4173824-4174783 If-Range: "0x8DF111191A4CAB7" GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.pcguide.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: finance.biggo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=wccftech.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET / HTTP/2 Host: www.pcguide.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=makeuseof.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=mmafighting.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: modernetdigital.cat User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=news.futunn.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.modernetdigital.cat User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: roihacks.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: aiemaily.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image 4e:T69b,Contains base62 string in header "YwaVfU6wJE8icUtEUceyT10eZLYmwhq3U" in header "POST /report/v4?s=YwaVfU6wJE8icUtEUceyT10eZLYmwhq3Uh6mTAQALCQcNDz6A%2Bf6fCEY0gYtAmHPWEa2MWeeaTtctKXwa5VYvDDIexuFimBdXMpq%2Fu5K0B7GHLiiCTsxlM5nKEAES%2Bs%3D HTTP/2Host: a.nel.cloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/reports+jsonAccept-Language: en-US,en;q=0.9Origin: https://roihacks.comPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstd" Contains base62 string in header "2Bf6fCEY0gYtAmHPWEa2MWeeaTtctKXwa" in header "POST /report/v4?s=YwaVfU6wJE8icUtEUceyT10eZLYmwhq3Uh6mTAQALCQcNDz6A%2Bf6fCEY0gYtAmHPWEa2MWeeaTtctKXwa5VYvDDIexuFimBdXMpq%2Fu5K0B7GHLiiCTsxlM5nKEAES%2Bs%3D HTTP/2Host: a.nel.cloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/reports+jsonAccept-Language: en-US,en;q=0.9Origin: https://roihacks.comPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstd" Contains base62 string in header "2BNlMvF85sFYHioKOKdDmlvAW4Mnbqa7H" in header "POST /report/v4?s=QEWjflPy8W9gggxXg7ZwamzrK7ch%2BNlMvF85sFYHioKOKdDmlvAW4Mnbqa7H%2FxSxHw2BU1szJ1JApvjrDggqJ%2Bf5UyNggsu4AyPOKezOUp%2BK%2BEw4JF0oqcVD9LisN0pVQA%3D%3D HTTP/2Host: a.nel.cloudflare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/reports+jsonAccept-Language: en-US,en;q=0.9Origin: https://www.pcguide.comPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstd"4f:T845,Found HTTPS GET request to https://prod-streaming-video-msn-com.akamaized.net/v1/eus011/8838e7bf-6921-481f-b92b-85cd2e150b9f/b5502674-e198-409c-95fd-d67c29114d98_650.mp4 Found HTTPS GET request to https://www.pcguide.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://finance.biggo.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=wccftech.com?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://www.pcguide.com/ Found HTTPS GET request to https://services.bingapis.com/favicon?url=makeuseof.com?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=mmafighting.com?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://modernetdigital.cat/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=news.futunn.com?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://www.modernetdigital.cat/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://roihacks.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://aiemaily.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS OPTIONS request to https://a.nel.cloudflare.com/report/v4?s=YwaVfU6wJE8icUtEUceyT10eZLYmwhq3Uh6mTAQALCQcNDz6A%2Bf6fCEY0gYtAmHPWEa2MWeeaTtctKXwa5VYvDDIexuFimBdXMpq%2Fu5K0B7GHLiiCTsxlM5nKEAES%2Bs%3D Found HTTPS OPTIONS request to https://a.nel.cloudflare.com/report/v4?s=QEWjflPy8W9gggxXg7ZwamzrK7ch%2BNlMvF85sFYHioKOKdDmlvAW4Mnbqa7H%2FxSxHw2BU1szJ1JApvjrDggqJ%2Bf5UyNggsu4AyPOKezOUp%2BK%2BEw4JF0oqcVD9LisN0pVQA%3D%3D Found HTTPS POST request to https://a.nel.cloudflare.com/report/v4?s=YwaVfU6wJE8icUtEUceyT10eZLYmwhq3Uh6mTAQALCQcNDz6A%2Bf6fCEY0gYtAmHPWEa2MWeeaTtctKXwa5VYvDDIexuFimBdXMpq%2Fu5K0B7GHLiiCTsxlM5nKEAES%2Bs%3D Found HTTPS POST request to https://a.nel.cloudflare.com/report/v4?s=QEWjflPy8W9gggxXg7ZwamzrK7ch%2BNlMvF85sFYHioKOKdDmlvAW4Mnbqa7H%2FxSxHw2BU1szJ1JApvjrDggqJ%2Bf5UyNggsu4AyPOKezOUp%2BK%2BEw4JF0oqcVD9LisN0pVQA%3D%3D50:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp")51:T4d9,Found registry query API: "RegQueryValueExW" in "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00001084.00000000.102588.033A0000.00000004.mdmp, 00000000-00001084.00000000.102588.05490000.00000040.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002920.00000000.102581.00901000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00002920.00000000.102581.00901000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002920.00000000.102581.00901000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00002920.00000000.102581.00901000.00000002.mdmp"52:T9b4,"#SKA131-025.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00007348) "#SKA131-025.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007348)53:Tc15,Found string "TeaEstate.Properties" (Indicator: "aes"; File: "#SKA131-025.exe") Found string "TeaEstate.Properties.Resources.resources" (Indicator: "aes"; File: "#SKA131-025.exe") Found string "TeaEstate.xsd" (Indicator: "aes"; File: "#SKA131-025.exe") Found string "TeaEstate.Properties.Resources" (Indicator: "aes"; File: "#SKA131-025.exe") Found string "TeaEstate" (Indicator: "aes"; File: "#SKA131-025.exe") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00002920.00000001.103507.008F1000.00000020.mdmp") Found string "/report/v4?s=YwaVfU6wJE8icUtEUceyT10eZLYmwhq3Uh6mTAQALCQcNDz6A%2Bf6fCEY0gYtAmHPWEa2MWeeaTtctKXwa5VYvDDIexuFimBdXMpq%2Fu5K0B7GHLiiCTsxlM5nKEAES%2Bs%3D" (Indicator: "aes"; File: "PCAP") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aes"; File: "AMSI") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; File: "AMSI") Found string "eaEstate.xsd" (Indicator: "aes"; Source: "00000000-00001084.00000000.102588.00D82000.00000002.mdmp") Found string "eaEstate" (Indicator: "aes"; Source: "00000000-00001084.00000000.102588.00D82000.00000002.mdmp") Found string "eaEstate.Properties.Resources" (Indicator: "aes"; Source: "00000000-00001084.00000000.102588.00D82000.00000002.mdmp") Found string "TeaEstate.Properties" (Indicator: "aes"; Source: "00000000-00001084.00000000.102588.00D82000.00000002.mdmp") Found string "TeaEstate.Properties.Resources.resources" (Indicator: "aes"; Source: "00000000-00001084.00000000.102588.00D82000.00000002.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00002920.00000000.102581.029A0000.00000004.mdmp, 00000000-00002920.00000000.102581.07142000.00000004.mdmp, 00000000-00002920.00000001.103507.029C0000.00000004.mdmp, 00000000-00002920.00000001.103507.07142000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002920.00000000.102581.029A0000.00000004.mdmp, 00000000-00002920.00000001.103507.029C0000.00000004.mdmp, 00000000-00002920.00000001.103507.07142000.00000004.mdmp, 00000000-00002920.00000001.103507.08090000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00002920.00000000.102581.04B40000.00000004.mdmp") Found string "[-WindowStyle