21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 5e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4be,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Yogi.Generic Sample 0c422e9fc527… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0c422e9fc527…. Malware family: Yogi.Generic. Threat score 100/100. 4/26 AV engines flagged this file. 5 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0c422e9fc527cc1d97a81606a42a6bea2c83295552ec3ebd49adcb41e50650c8","keywords":["Malicious","Yogi.Generic","malware analysis","sandbox report","threat intelligence","0c422e9fc527cc1d97a81606a42a6bea2c83295552ec3ebd49adcb41e50650c8"],"about":{"@type":"SoftwareApplication","name":"0c422e9fc527cc1d97a81606a42a6bea2c83295552ec3ebd49adcb41e50650c8.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"0c422e9fc527cc1d97a81606a42a6bea2c83295552ec3ebd49adcb41e50650c8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Yogi.Generic","antivirusDetections":{"malicious":4,"total":26},"behavioralIndicators":{"malicious":5,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:Te00,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAKRUlEQVR4XqVXB1dU1xaetSwJxgIBEQRhAEWKSKjDDNPvNKYxwzBD7wIqxpjEmFheoiBWmqgUURTUWLD3ghgTNZry/tL3vnNRV15W3orvvbvWXufcc885+9vf3meffRWK93hWrVqIAlUErLY4VFSmob09D59/ocPWbQZ8uVWNjZty0NiyGmXliZCsy1FQEAmxJipmDhYsUODP+/1XT1ZWOPTGGPi5+brWNGz9Kh97uw3o6XNgYNCNviN2HDiox649BLV1DVpaVslzjeZoiLUrVoRh8eK5/xsItToKfn882tpWY/uuT3C4twijYyacv+DBteuVuHGzBtduhHD5qgcTZyUMjRTjUF8BduzKRtv61fCXrYC6OAqpqYsQFTUX8+f/F2yYLbGor1+Jbd9koadXhfEJPaauWHDnngfTP1TgpxfNePFzK168bMLMsxAePfHg1h07Ll8x4dRpDdcUYtuOtahvXAmLJQYZGUsQHf3B+4FwOOKxrj0Ve7pzMTKqwaUpCfce2PHkqQfPX4bw6tdG/Pp7O2UjfvmtFS9f1RCQH09/dOLxjAO371q5xoiRExp07c1FKxm02+OQmRkhg/izPvkJD5/1k82xHG3taejan0dL9KTYhgfTLm5eiuc/h/DydT1e/96G3/65idKB17+t41gVfnpZhmc/uclGCWae2vHgkR1Xb0jcQyvvJfYUewsm3up694SFKZC08iM52JpaaHlXHk6eMuDqdTvuPyrF02fl+PFFDSlvwqtf2qh0I17/2sF+O0E14MfnQRngzDM3nvzgIlMlmJ4pwb2HdkxdkzA2ruWeuTwpqTBSx0rqeheY8+YpSEsY8go+RqgiGdt35jCYdPSlA/cflmHmh0pa1kDq1+HFq3bKBlmev2yl4gYqrSDtPsaAi1LyRpyyPJx24NZdGy5eNmFouJh7Z6OyMonHNArLl8/HPHFEIyLmMEoXw06/d2xeg74BDc5/L/wYwOMnNbS+hYraKOvx7Hk7wbRwrIlW1vJ7CA8flxKoi+JgnFBEK4tgwIG7D2y4ftOKs+eN6B0oxKbN6ShxxSMtbTEiouZAkZCwgEkmClXVKfj2uwKMnbJwgY8b12D6aQsZaJuVZ814MlNHpZV48Lgc9+6XySfi9l0nrbTLcvsPcueeHXfv29jaeDosuDBl5hHWYue3OaiqSYGKOpXKhVBkZi6BhRluQ0cment1OHfBy4XVBNCM6SctlCY8mq5jLFTQGiq976UyN67fchKoHddu2ihWuRWW3rwtUSyy3LojySLGLl2RcHrCgEM9hWjvyICNOjOzIqBQqZahzJ+Er7bl0/c2XLkWIoAGUrqOkVxPpZW0qAw3bjP53CxhZIs5ViYfG0W0lncyRbl6XaKY38m1m2bONxOAGWfOGtA/qMKXX61lklJCpV4KhUmKQ11dGr7brcHJcSq5UUvamgmiETduVVGhj5FcwqAUZ5sbTZlwiUH1/SXRN+MC2wuX2b8szfYvzrbyt8tvhO/fXySASQOOHVdjx85PUF2XAhOTncLlTkTzuix07zdxQoA0NpCyRrbVuDjlZwQ7qExi+jXRPUZZzlMmzzMlXzRw41kR3yfPmRhsszJ5zsw55jfvbM8JAHocG1Jjd2cemppXwelaAYXfn4z1Gz+hb6zM50FaWk8qa2lJgJs6SJsAZpDpG58wyn4cP2OU+xPn9PI3MSZk4izHzoq+mCdErBWKJfmuEHOODTEndBbIicnnT4QiEEjGho25vNHs3LiSFtfRokpMnvVyoYVJRE/X/LucOKnHqTN6ztfz1PCdIrKmPMZ2bNxAEXeCUGrlPjayYGPfQgBGJiUV2tenwx9IgsJHBto3EMABO7NfBXNADemr4GIXj40Zw6N6OTENjWjftDqO6QhiVkbHODaqlY/Y6JuxkRNGApNwZkIodtFtHrIpDHLj+KidALQEwEAMpEDh9iQx/Wajs1viJuX0VRVOT4a4mRPHh004ekyHwWNaSrEsx4ffigCkxdHjs9/EmLiOh4YFYHEHOGQWz18oJ6MVskzSxUMjXnR2WtDamgufbxUUkhSP6toMbN9hxOBRP07TDadOh3gLurmZSVbeN1AsZ8iBoxocoQwMzrZCcf8RjfxNtAODAgzT7ohwZymtDxJANY2qJ6u1dEEN9wxi9x47g7AAJc7VUBRpYlDqT8WWzzU42OMhfRUYO1mB4ZFSWmdBb7+OhYiaQVrEvhp9/bMK+9jv7S/C4R4halZIBDWoo48lgvdSWTmVVskyfrqa7q3k3kGu8+Gb7VZmw3yYTalgyRXJgkHJo5hHZFayEMCJsRCRBjBwxEElBirQYN8BFfYfLJKBHOpR4eBhvouxN+M9vVqCMBC0nQaUUSFdeSbEfoAx4+G4i8odPIJWbOzQwuNdi8JCJRQpKYsgsmGwIkMuNA8d8nJykD4N0iIvF1moTIeufUXo6laxHixkkfFHUeHAIQ1B6jlXwrFhDw0IkoUqshigQU709knYt1/UjVp89nkRqqqyodenID19GRTR0QvYIQtWJQvKXOz6h8QFpfSxABBg30kLTVSkJUNF+G5PIdsCZk5KZyH27lPzO4EflsiYm5muHMeHKhm8Qa51kzkz12qY/Qqw5Ysc1DdkwGpXsmCNRlwcL6NFi+YgPn4h8vOXMSpT0dFRJAdJT28ZfS028dPCElpuYgIRSURkMhW+3aOS03f3Ph0OHDYzTtzoHxAWV1B5ORnxcI2Zc9T4ensuYywbjU1pcHuUsq7ERF7HEfMhFyTh4XPk6kSni0cwmIGOT4upyM5N/AQRoM99tMRJF1jQuddAgDqCMPA8G2m9hcpdBErA/QJwgEnNg84uCTt3aXjJ5WLzliw0NzPzlSVBo4nmP8NiREayIJn3FwWq0biCVUsWC4dibmCjhT4CIAsH/fSjhyCcBOEgrQ5+c3HcS/qFqwJkzY/ubjcBmvH1N2r+tOTQmCweuTT59tPrY+VCJDr6Q4gy8M+65SczMxImUyL/gNZgwwZa8LWVbDhJp5fKfLy0fDKo7n0EdKCMpyBAYKJlgumysewy8o9JRQNyWA2vQW1dKjylSdDqY5DOqjg2dgEWLvybH5V0gtDpVqDUl4bGxjxs/syAbQSyc5eTYIQiMrG3lBnNy6B0Y+duBxWb8MWXamz6NJ8/JVloaExHeWgVSkoSSHsM0tIjWAeG4aOPZt39t09qajjPaSzr+ZUIBNcwegt4afEYbTExmi1UZuGxNfNdT6Ua3qj5aGZKr61LZ3G7Ei5XIkzmOOTlL2UVLGj/4P2Vv30SEhYic00kioriIFmSSaWwai2qa7JRV5+HuoYc1NSx0q3ORDC0Gl5vMotb+tq4HPmFS/kjEg6xR2TkPHz44X/w+fs8SuUSCLfk5S2DpjgeRlMC/4KV/FtOpihhkhKg08dDrY5BTu5SrE5fggTlIiyNCYM45nPn/h/K3z6xsWFQJi+WfZmdHUUw0SgojKGbYuS+GEtP/xjJnCPmRkTM4685Kf+ro/aH51+p67A/Gi7r/wAAAABJRU5ErkJggg==23:T712,"powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\") "powershell.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PHYSICALSTORES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES")24:T889,Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00000412.00000000.277559.CB630000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00000412.00000000.277559.CB650000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00000412.00000000.277559.CB650000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00000412.00000000.277559.CB6D0000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00000412.00000000.277559.CB730000.00000004.mdmp, 00000000-00000412.00000001.277788.CB730000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00000412.00000000.277559.CB730000.00000004.mdmp, 00000000-00000412.00000001.277788.CB730000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00000412.00000000.277559.CB730000.00000004.mdmp, 00000000-00000412.00000001.277788.CB730000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00000412.00000001.277788.73E20000.00000004.mdmp") Found string "passwordStrengthRegularExpression=""" (Indicator: "password"; Source: "00000000-00000412.00000001.277788.73E20000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00000412.00000001.277788.CB670000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00000412.00000001.277788.CB670000.00000004.mdmp") Found string "adminpasswordstatus" (Indicator: "password"; Source: "00000000-00000412.00000001.277788.CB750000.00000004.mdmp") Found string "resetcomputermachinepasswordcommand" (Indicator: "password"; Source: "00000000-00000412.00000001.277788.CB750000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00001584.00000000.276975.CB640000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00001584.00000000.276975.CB640000.00000004.mdmp")25:Tb23,"python313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI46642\python313.dll]- [targetUID: 00000000-00004664] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI46642\libcrypto-3.dll]- [targetUID: 00000000-00004664] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI46642\VCRUNTIME140.dll]- [targetUID: 00000000-00004664] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\_MEI46642\python3.dll]- [targetUID: 00000000-00004664] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\VCRUNTIME140_1.dll]- [targetUID: 00000000-00004664] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\unicodedata.pyd]- [targetUID: 00000000-00004664] "pyarmor_runtime.pyd" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 11 sections"- Location: [%TEMP%\_MEI46642\pyarmor_runtime_000000\pyarmor_runtime.pyd]- [targetUID: 00000000-00004664] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\_decimal.pyd]- [targetUID: 00000000-00004664] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\_lzma.pyd]- [targetUID: 00000000-00004664] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\_ctypes.pyd]- [targetUID: 00000000-00004664] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\_bz2.pyd]- [targetUID: 00000000-00004664] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\_socket.pyd]- [targetUID: 00000000-00004664] "_psutil_windows.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\psutil\_psutil_windows.pyd]- [targetUID: 00000000-00004664] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\_hashlib.pyd]- [targetUID: 00000000-00004664] "_wmi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\_wmi.pyd]- [targetUID: 00000000-00004664] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\select.pyd]- [targetUID: 00000000-00004664] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\_uuid.pyd]- [targetUID: 00000000-00004664]26:T4df,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match – cryptographic algorithms27:Tb23,"python313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI46642\python313.dll]- [targetUID: 00000000-00004664] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI46642\libcrypto-3.dll]- [targetUID: 00000000-00004664] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI46642\VCRUNTIME140.dll]- [targetUID: 00000000-00004664] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\_MEI46642\python3.dll]- [targetUID: 00000000-00004664] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\VCRUNTIME140_1.dll]- [targetUID: 00000000-00004664] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\unicodedata.pyd]- [targetUID: 00000000-00004664] "pyarmor_runtime.pyd" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 (stripped to external PDB) 11 sections"- Location: [%TEMP%\_MEI46642\pyarmor_runtime_000000\pyarmor_runtime.pyd]- [targetUID: 00000000-00004664] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\_decimal.pyd]- [targetUID: 00000000-00004664] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\_lzma.pyd]- [targetUID: 00000000-00004664] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\_ctypes.pyd]- [targetUID: 00000000-00004664] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\_bz2.pyd]- [targetUID: 00000000-00004664] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\_socket.pyd]- [targetUID: 00000000-00004664] "_psutil_windows.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\psutil\_psutil_windows.pyd]- [targetUID: 00000000-00004664] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\_hashlib.pyd]- [targetUID: 00000000-00004664] "_wmi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\_wmi.pyd]- [targetUID: 00000000-00004664] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\select.pyd]- [targetUID: 00000000-00004664] "_uuid.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI46642\_uuid.pyd]- [targetUID: 00000000-00004664]28:T94d,Process " (Source: "00000000-00000412.00000001.277788.10000000.00000004.mdmp") file/memory contains long string(Source: "00000000-00000412.00000001.277788.10000000.00000004.mdmp") Found string "if ($__cmdletization_objectModelWrapper -is [System.Management.Automation.IDynamicParameters])" (Source: "00000000-00000412.00000001.277788.10000000.00000004.mdmp") Found string "([System.Management.Automation.IDynamicParameters]$__cmdletization_objectModelWrapper).GetDynamicParameters()" (Source: "00000000-00000412.00000001.277788.10000000.00000004.mdmp")44:Tb36,Spawned process "