24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 65:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T480,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious VBS/Agent.CRE Sample 1fe351bc4667… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1fe351bc4667…. Malware family: VBS/Agent.CRE. Threat score 100/100. 1/26 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1fe351bc4667f19ed55a0dd3b3ccbf974353e1386e503fc1c42335a7d34e111d","keywords":["Malicious","VBS/Agent.CRE","malware analysis","sandbox report","threat intelligence","1fe351bc4667f19ed55a0dd3b3ccbf974353e1386e503fc1c42335a7d34e111d"],"about":{"@type":"SoftwareApplication","name":"Contracts_doc.vbs","applicationCategory":["script","vbs"],"identifier":"1fe351bc4667f19ed55a0dd3b3ccbf974353e1386e503fc1c42335a7d34e111d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"VBS/Agent.CRE","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":8,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T5b1,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp")26:T756,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp")27:T446,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.263C0000.00000004.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp")28:T511,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp")29:T60c,Found reference to "Aesso" (Indicator: "Aes"; Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp, 00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp, 00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found reference to "TripleDES" (Indicator: "TripleDES"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to "LegalKeySizesValue" (Indicator: "KeySizes"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to "Rijndael" (Indicator: "Rijndael"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to "KeySizes" (Indicator: "KeySizes"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp")2a:T47c,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION") "powershell.exe" (Access type: "OPEN"; Path: "HKLM") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\FEATUREDEVELOPMENTPROPERTIES") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS") "powershell.exe" (Access type: "QUERY"; Path: "HKCU\LOCAL SETTINGS") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\OLE\FEATUREDEVELOPMENTPROPERTIES")2b:Ta14,"WScript.exe" queried SystemProcessInformation at 00000000-00004384-00000C15-1358520889 [PID: 4384] "WScript.exe" queried SystemProcessInformation at 00000000-00004384-00000C15-1358529159 [PID: 4384] "WScript.exe" queried SystemProcessInformation at 00000000-00004384-00000C15-1358970466 [PID: 4384] "WScript.exe" queried SystemProcessInformation at 00000000-00004384-00000C15-1358978802 [PID: 4384] "WScript.exe" queried SystemProcessInformation at 00000000-00004384-00000C15-1359190906 [PID: 4384] "WScript.exe" queried SystemProcessInformation at 00000000-00004384-00000C15-1359199731 [PID: 4384] "powershell.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-1364168806 [PID: 1408] "powershell.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-1364176902 [PID: 1408] "powershell.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-1365760114 [PID: 1408] "powershell.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-1365768455 [PID: 1408] "powershell.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-1366819315 [PID: 1408] "powershell.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-1366829019 [PID: 1408] "powershell.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-1366898152 [PID: 1408] "powershell.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-1366908111 [PID: 1408] "powershell.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-1367301754 [PID: 1408] "powershell.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-1367310580 [PID: 1408] "powershell.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-1368387406 [PID: 1408] "powershell.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-1369273672 [PID: 1408] "powershell.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-1369281802 [PID: 1408] "powershell.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-1369655186 [PID: 1408] "powershell.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-1369663230 [PID: 1408] "powershell.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-1371556018 [PID: 1408] "powershell.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-1371564902 [PID: 1408] "powershell.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-1371758030 [PID: 1408] "powershell.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-1371765459 [PID: 1408]2c:Tbba,Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "BCryptDestroyHash"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "BCryptCreateHash"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found api reference "BCryptFinishHash" (Indicator: "BCryptFinishHash"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHash"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHashData"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp")2d:T43c,file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00001408.00000000.153313.0B470000.00000004.mdmp, 00000000-00001408.00000000.153313.0B670000.00000004.mdmp, 00000000-00001408.00000000.153313.0B790000.00000004.mdmp, 00000000-00001408.00000000.153313.0CF50000.00000004.mdmp, 00000000-00001408.00000000.153313.259C0000.00000004.mdmp, 00000000-00001408.00000000.153313.25FE0000.00000004.mdmp, 00000000-00001408.00000001.154382.0B470000.00000004.mdmp, 00000000-00001408.00000001.154382.0B670000.00000004.mdmp, 00000000-00001408.00000001.154382.0CF50000.00000004.mdmp, 00000000-00001408.00000001.154382.259E4000.00000004.mdmp, 00000000-00001408.00000001.154382.26031000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00001408.00000001.154382.26031000.00000004.mdmp") Found reference to API "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp")2e:T545,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to decode base64 data Matched sigs: Contains CRYPTO related strings Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Able to perform cryptographic operations Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: HTTP requests contain Base64 strings Matched sigs: HTTP request contains Base64 encoded artifacts Matched sigs: YARA signature match – Encryption algorithm2f:T1daa,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004384) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004384) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac244bff7f0000000000000000000051edc34cff7f000000000000230200000000000000000000b42ca3c1ee6600002a00000000000000e0bfc6ba230200008fecc34cff7f0000e0ac244bff7f0000e0ac244bff7f0000000000000000000000000000ff7f0000ffffff7fd1ef000000000000000000000000000000000000d8ce184bff7f00002a0000000000000069c3d14aff7f00003100000000000000dc02000000000000e0020000000000001100011000000000f0d0dc2efc00000003a37c4aff7f0000f0d0dc2efc00000000000000000000002b00000000000000000000000000000020b0d74aff7f0000b43fd64aff7f0000e0ce184b (UID: 00000000-00004384) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000dcc8dc2efc000000100000000000040066ddd66773620000503a6f4cff7f0000000000000000000098ed734cff7f0000b0d8dc2efc00000020e57a4cff7f00000000000000000000f8d6dc2efc0000000000000000000000000000000000000020d6dc2efc00000080d0524cff7f0000c00000000000004610cf24c0230231003200300037003300360031003000300098ed734cff7f000060d5dc2efc000000fb1200000000000000000000000000000000000000000000c0d0dc2efc000000020000020000000017d6bf4cff7f0000dc1700cbb177000080d6dc2efc0000003431a3c1ee6600005bca7449ff7f000040dcdc2e (UID: 00000000-00004384) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001408) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001408) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac244bff7f0000000000000000000051edc34cff7f0000000000008102000000000000000000002dd13180b9e800002a000000000000008085560b810200008fecc34cff7f0000e0ac244bff7f0000e0ac244bff7f0000000000000000000000000000ff7f0000ffffff7f986e000000000000000000000000000000000000d8ce184bff7f00002a0000000000000069c3d14aff7f00003100000000000000e403000000000000e803000000000000110001100000000090d6ef74e300000003a37c4aff7f000090d6ef74e300000000000000000000002b00000000000000000000000000000020b0d74aff7f0000b43fd64aff7f0000e0ce184b (UID: 00000000-00001408) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000400000000000000000007a0b810200000b8ec14cff7f000000007a0b8102000002000000810200003800000000000000400000000000000030037a0b8102000078dee475e300000001000000000000000300000000000000010000000000000018000000000000002010420b8102000000000000000000000000420b810200000060be74e300000000000000000000007f030000010000000000000000000000800000000000000004000000000000000000000000000000681fa0258102000004000000000000003800000000000000f0987b4aff7f000038000000000000003800000000000000f0dfe475e3000000c00ca614ff7f000000000000 (UID: 00000000-00001408) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0ff39ff7f000007000000000000000000000000000000010000000000000050707a0b81020000000000000000000050c06a0b810200004c987b4aff7f000040e36a0b81020000b3ce9c14ff7f0000b0c56a0b81020000004fff39ff7f0000d0b0ff39ff7f000000000000000000000000000000000000b0c56a0b8102000050707a0b81020000f0e96a0b8102000048e0e475e30000004c987b4aff7f0000010000000000000048e0e475e3000000f0e96a0b81020000b0c56a0b81020000010000000000000002bc9c14ff7f0000c0c76a0b810200006025690b81020000feffffff040000007df0fe39ff7f000070e96a0b (UID: 00000000-00001408) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000007000000000000000000000000000000010000000000000050707a0b81020000000000000000000050c06a0b810200004c987b4aff7f0000c0e46a0b81020000b3ce9c14ff7f0000d0c36a0b81020000384fff39ff7f0000d0b0ff39ff7f000000000000000000000000000000000000d0c36a0b8102000050707a0b81020000f0e96a0b8102000040e0e475e30000004c987b4aff7f0000010000000000000040e0e475e3000000f0e96a0b81020000d0c36a0b81020000010000000000000002bc9c14ff7f000000000000000000006025690b81020000c0c76a0b04000000feffffffffffffff50707a0b810200007df0fe39ff7f000000000000 (UID: 00000000-00001408) "powershell.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001408) "powershell.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001408)30:T8cb,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000001800000000000000a88d7a584a1f0000a41fa3c1ee66000006000000000000000000e9c8f77f0000a4028e2aff7f00000600000023020000d8f1274cff7f000020fddc2efc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e9c8 (UID: 00000000-00004384) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7b5149ff7f000000000e3aff7f00000000000000000000000000000000000008060f3aff7f00000001000000000000f0987b4aff7f000000010000000000000001000000000000000000000000000000060f3aff7f000001000000000000000f180e3aff7f0000000000000000000000060f3aff7f000000000000 (UID: 00000000-00004384) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c310a3aff7f0000708b0c3aff7f00000200000000000000708b0c3aff7f000000000000000000000300000000000000b1310a3aff7f0000a8150d3aff7f0000b0cfbdba23020000c0cfbdba23020000888b0c3aff7f00000100000000000000239f7d4aff7f00000000000000000000888b0c3aff7f000006000000 (UID: 00000000-00004384) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303d033aff7f0000c0fe043aff7f00000400000000000000c0fe043aff7f000000000000000000000500000000000000453d033aff7f0000286a053aff7f0000be5a5249ff7f0000e8d0bdba2302000008cd7a584a1f0000b08e5249ff7f0000239f7d4aff7f00000100000000000000d132033aff7f000000004b49 (UID: 00000000-00004384) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000be5a5249ff7f00000000073aff7f000000000000000000000000000000000000883f083aff7f00000001000000000000f0987b4aff7f0000000100000000000000010000000000000000000000000000803f083aff7f00000100000000000000bf10073aff7f00000000000000000000803f083aff7f000000000000 (UID: 00000000-00004384) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000008102000040864c0b8102000080864c0b81020000050000053d290000f0dc470b (UID: 00000000-00001408)31:T59b,"WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")32:T4b1,Found string "Set stulty = CreateObject("WScript.Shell")" (Indicator: "set "; File: "1fe351bc4667f19ed55a0dd3b3ccbf974353e1386e503fc1c42335a7d34e111d.bin") Found string "Set unstilted = stulty.Environment("User")" (Indicator: "set "; File: "1fe351bc4667f19ed55a0dd3b3ccbf974353e1386e503fc1c42335a7d34e111d.bin") Found string "Set neuroskeleton = GetObject(omneityS)" (Indicator: "set "; File: "1fe351bc4667f19ed55a0dd3b3ccbf974353e1386e503fc1c42335a7d34e111d.bin") Found string "Set nanocatalysis = neuroskeleton.Get(omneitySt).SpawnInstance_" (Indicator: "set "; File: "1fe351bc4667f19ed55a0dd3b3ccbf974353e1386e503fc1c42335a7d34e111d.bin") Found string "Set unstilted = Nothing" (Indicator: "set "; File: "1fe351bc4667f19ed55a0dd3b3ccbf974353e1386e503fc1c42335a7d34e111d.bin") Found string "Set stulty = Nothing" (Indicator: "set "; File: "1fe351bc4667f19ed55a0dd3b3ccbf974353e1386e503fc1c42335a7d34e111d.bin") Found string "Set neuroskeleton = Nothing" (Indicator: "set "; File: "1fe351bc4667f19ed55a0dd3b3ccbf974353e1386e503fc1c42335a7d34e111d.bin") Found string "Set nanocatalysis = Nothing" (Indicator: "set "; File: "1fe351bc4667f19ed55a0dd3b3ccbf974353e1386e503fc1c42335a7d34e111d.bin")33:T520,Found reference to API "[System.Diagnostics.FileVersionInfo]::GetVersionInfo($this.FullName)" (Indicator: "GetVersion"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp")34:Ta0f,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")35:T6a2,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001408-00000C17-1367988610 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001408-00000C17-1368103951 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001408-00000C17-1369157304 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00001408-00000C17-1369388890 "powershell.exe" queries volume information of "C:\share" at 00000000-00001408-00000C17-1369390841 "powershell.exe" queries volume information of "C:\share" at 00000000-00001408-00000C17-1369467884 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001408-00000C17-1370176907 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001408-00000C17-1370328463 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001408-00000C17-137037813136:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")37:T38b8,"WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004384) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004384) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004384) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004384) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004384) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004384) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004384) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00004384) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004384) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004384) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\fb4ba4db52ca77687f807bb068871ec2\Microsoft.VisualBasic.ni.dll (UID: 00000000-00001408)38:Td1ee,"WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004384) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00004384) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CheckRemoteDebuggerPresent (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcessW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RegDeleteValue (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SendMessageTimeout (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SendMessageTimeoutA (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00001408)39:Ta94e,Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp, 00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.263C0000.00000004.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.263C0000.00000004.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.263C0000.00000004.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.263C0000.00000004.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.263C0000.00000004.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp, 00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall3"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "ConvertStringSidToSid"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "LookupAccountSid"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "SeTakeOwnershipPrivilege"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "LoadString"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "PrivilegeCheck"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "NetServerEnum"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "SetThreadToken"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "ZwUnmapViewOfSection"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "NetServerGetInfo"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00001408.00000001.154382.39FF2000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00001408.00000001.154382.39FF2000.00000002.mdmp")3a:T5b2,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp, 00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp")3b:T600,Found string "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')" (Indicator: "Invoke-Expression"; File: "AMSI") Found string "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')" (Indicator: "Invoke-Expression"; Source: "00000000-00001408.00000000.153313.0B470000.00000004.mdmp, 00000000-00001408.00000000.153313.0B670000.00000004.mdmp, 00000000-00001408.00000000.153313.0B790000.00000004.mdmp, 00000000-00001408.00000000.153313.0D560000.00000004.mdmp, 00000000-00001408.00000000.153313.259C0000.00000004.mdmp, 00000000-00001408.00000001.154382.0B470000.00000004.mdmp, 00000000-00001408.00000001.154382.0B535000.00000004.mdmp, 00000000-00001408.00000001.154382.0B670000.00000004.mdmp, 00000000-00001408.00000001.154382.0B790000.00000004.mdmp, 00000000-00001408.00000001.154382.259E4000.00000004.mdmp, 00000000-00001408.00000001.154382.26094000.00000004.mdmp") Found string "Invoke-Expression" (Indicator: "Invoke-Expression"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "IEX $env:INTERNA" (Indicator: "Invoke-Expression"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "HostApplication=powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')" (Indicator: "Invoke-Expression"; Source: "00000000-00001408.00000001.154382.26031000.00000004.mdmp")3c:T189f,"o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001408.00000000.153313.0B470000.00000004.mdmp 00000000-00001408.00000001.154382.0B535000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00001408.00000000.153313.259C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001408.00000000.153313.259C0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001408.00000000.153313.259C0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001408.00000000.153313.259C0000.00000004.mdmp 00000000-00001408.00000001.154382.259E4000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00001408.00000000.153313.259C0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00001408.00000001.154382.14A18000.00000002.mdmp "HKLM\" in Source: 00000000-00001408.00000001.154382.14A18000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00001408.00000001.154382.14A18000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001408.00000001.154382.14A18000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00001408.00000001.154382.14A18000.00000002.mdmp3d:T4a3,Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4384:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4384:304:WilStaging_02" Process WScript.exe created mutex with name "Local\SM0:4384:304:WilStaging_02" Process WScript.exe created mutex with name "SM0:4384:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1408:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:1408:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:1408:120:WilError_01" Process powershell.exe created mutex with name "SM0:1408:304:WilStaging_02" Process powershell.exe created mutex with name "Global\RasPbFile" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1408:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1408:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\RasPbFile"3e:Teee,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135]3f:T1990,"o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001408.00000000.153313.0B470000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00001408.00000000.153313.0D560000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00001408.00000000.153313.259C0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00001408.00000000.153313.259C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001408.00000000.153313.259C0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001408.00000000.153313.259C0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001408.00000000.153313.259C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001408.00000001.154382.0B535000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001408.00000001.154382.0CDAA000.00000002.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00001408.00000001.154382.14A18000.00000002.mdmp "HKLM\" in Source: 00000000-00001408.00000001.154382.14A18000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00001408.00000001.154382.14A18000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001408.00000001.154382.14A18000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00001408.00000001.154382.14A18000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001408.00000001.154382.259E4000.00000004.mdmp40:T2a38,"WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff494b0000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff494b0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff494b0000 "WScript.exe" loaded module "KERNEL32" at base 7fff4c270000 "WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff3a240000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff47580000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7fff4c800000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7fff4c270000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7fff3a1a0000 "WScript.exe" loaded module "AMSI.DLL" at base 7fff3a180000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7fff40530000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7fff3a160000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\P25WNEQU.DLL" at base 7fff3a110000 "WScript.exe" loaded module "WLDP.DLL" at base 7fff48030000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7fff4abb0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7fff49910000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fff483e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7fff3a100000 "WScript.exe" loaded module "OLE32.DLL" at base 7fff4c110000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7fff49240000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7fff3a0e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7fff3a0a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7fff3a070000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7fff494b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 7fff39fe0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7fff3fa60000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7fff3de00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7fff3d870000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7fff494b0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7fff494b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7fff3d2c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff494b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff494b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff494b0000 "powershell.exe" loaded module "KERNEL32" at base 7fff4c270000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff3a240000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7fff4abb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7fff30d90000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7fff4c0a0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7fff48f60000 "powershell.exe" loaded module "VERSION.DLL" at base 7fff40530000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7fff1b640000 "powershell.exe" loaded module "USER32.DLL" at base 7fff4c920000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7fff494b0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7fff3b800000 "powershell.exe" loaded module "NTDLL" at base 7fff4cbf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7fff4c4f0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7fff4c270000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7fff18a00000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7fff4c800000 "powershell.exe" loaded module "OLE32.DLL" at base 7fff4c110000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7fff4c4f0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7fff4aae0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7fff1a9d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7fff17f80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7fff3a190000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fff483e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7fff49840000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7fff15f10000 "powershell.exe" loaded module "COMBASE.DLL" at base 7fff4c4f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7fff4c4f0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7fff4cbf0000 "powershell.exe" loaded module "PSAPI.DLL" at base 2810d3a0000 "powershell.exe" loaded module "SHELL32.DLL" at base 7fff4ac60000 "powershell.exe" loaded module "AMSI.DLL" at base 7fff3a170000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7fff49910000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7fff3a000000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7fff40530000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7fff39fe0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7fff1a860000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7fff49910000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7fff49240000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\P25WNEQU.DLL" at base 7fff2e080000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7fff1a720000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7fff2a630000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7fff15660000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7fff1a6c0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7fff49240000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7fff14cf0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7fff1a350000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7fff494b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7fff14ba0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7fff1a2e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7fff14ac0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7fff14a70000 "powershell.exe" loaded module "SECUR32.DLL" at base 7fff41060000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7fff48e40000 "powershell.exe" loaded module "WLDP.DLL" at base 7fff48030000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff47580000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7fff14990000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7fff4c270000 "powershell.exe" loaded module "USERENV.DLL" at base 7fff48e70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7fff4abb0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7fff4c4f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7fff13c80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7fff2a600000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7fff48aa0000 "powershell.exe" loaded module "RASAPI32.DLL" at base 7fff3dad0000 "powershell.exe" loaded module "RASMAN.DLL" at base 7fff3e650000 "powershell.exe" loaded module "WS2_32.DLL" at base 7fff4a5c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7fff487d0000 "powershell.exe" loaded module "WINHTTP.DLL" at base 7fff457a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7fff2b560000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7fff48560000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7fff41970000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7fff41eb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7fff48320000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 7fff3a5c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7fff3a620000 "powershell.exe" loaded module "ADVAPI32" at base 7fff4abb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\FB4BA4DB52CA77687F807BB068871EC2\MICROSOFT.VISUALBASIC.NI.DLL" at base 7fff1377000041:T11a9,file/memory contains long string with (Indicator: "New-Object"; File: "AMSI") file/memory contains long string with (Indicator: "New-Object"; Source: "00000000-00001408.00000000.153313.0B470000.00000004.mdmp, 00000000-00001408.00000000.153313.0B670000.00000004.mdmp, 00000000-00001408.00000000.153313.0CF50000.00000004.mdmp, 00000000-00001408.00000000.153313.259C0000.00000004.mdmp, 00000000-00001408.00000000.153313.25FE0000.00000004.mdmp, 00000000-00001408.00000001.154382.0B470000.00000004.mdmp, 00000000-00001408.00000001.154382.0B670000.00000004.mdmp, 00000000-00001408.00000001.154382.0CF50000.00000004.mdmp, 00000000-00001408.00000001.154382.259E4000.00000004.mdmp, 00000000-00001408.00000001.154382.26031000.00000004.mdmp") Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "New-Object System.Version -ArgumentList @(" (Indicator: "New-Object"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "new-object datetime @([int]$matches[1], [int]$matches[2], [int]$matches[3])" (Indicator: "New-Object"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "$argumentsBuilder = new-object System.Text.StringBuilder" (Indicator: "New-Object"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "$private:sd = new-object System.Security.AccessControl.CommonSecurityDescriptor $false,$false,$this.SecurityDescriptorSddl" (Indicator: "New-Object"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "split-path $_.Path" (Indicator: "Split-Path"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string ",(new-object Microsoft.Powershell.Commands.EnhancedKeyUsageProperty -argumentlist $this).EnhancedKeyUsageList;" (Indicator: "New-Object"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp")42:T593,"WScript.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}") "WScript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "WScript.exe" touched "Wbem Scripting Object Path" (Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS") "WScript.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WScript.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "WScript.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WScript.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "WScript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WScript.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS")43:T1406,Process "powershell.exe" (UID: 00000000-00001408) was launched with modified environment variables: "PSModulePath, PATHEXT, NUMBER_OF_PROCESSORS" Process "powershell.exe" (UID: 00000000-00001408) was launched with missing environment variables: "EDGE_METRICS_SESSION_ID, COMPONENT_INSTALLER_DIR, EDGE_USER_DATA_DIR, USERDNSDOMAIN, PROCESSOR_ARCHITEW6432, EDGE_BROWSER_PID, PROMPT, EDGE_CRASHPAD_PIPE_NAME, PSExecutionPolicyPreference, EDGE_METRICS_CLIENT_ID_HASH" Process "aspnet_compiler.exe" (UID: 00000000-00006000) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PSExecutionPolicyPreference="Bypass"" Process "aspnet_compiler.exe" (UID: 00000000-00006000) was launched with modified environment variables: "PSModulePath, PATHEXT, NUMBER_OF_PROCESSORS" Process "chrome.exe" (UID: 00000000-00003700) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "chrome.exe" (UID: 00000000-00003700) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles" Process "chrome.exe" (UID: 00000000-00007764) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles" Process "chrome.exe" (UID: 00000000-00007764) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "chrome.exe" (UID: 00000000-00003808) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_3700_SGHQAGDXQQCUEWFE"" Process "msedge.exe" (UID: 00000000-00000100) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00000100) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles" Process "msedge.exe" (UID: 00000000-00000100) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME" Process "msedge.exe" (UID: 00000000-00004500) was launched with new environment variables: "EDGE_USER_DATA_DIR="%TEMP%\sfymq0id.o5j", EDGE_BROWSER_PID="100", EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_100_WRSAMKKQXHFZFUEH"" Process "msedge.exe" (UID: 00000000-00004500) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles" Process "msedge.exe" (UID: 00000000-00004500) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00007840) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="0", COMPONENT_INSTALLER_DIR="%TEMP%\sfymq0id.o5j", EDGE_METRICS_CLIENT_ID_HASH="-1081329738485923599"" Process "msedge.exe" (UID: 00000000-00003680) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00003680) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles" Process "msedge.exe" (UID: 00000000-00003680) was launched with missing environment variables: "EDGE_METRICS_SESSION_ID, COMPONENT_INSTALLER_DIR, EDGE_USER_DATA_DIR, EDGE_BROWSER_PID, EDGE_CRASHPAD_PIPE_NAME, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00000208) was launched with new environment variables: "EDGE_USER_DATA_DIR="%TEMP%\qda5az5g.bxa", EDGE_BROWSER_PID="3680", EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_3680_WWWNPPHVBBHQKWMO"" Process "msedge.exe" (UID: 00000000-00000208) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles" Process "msedge.exe" (UID: 00000000-00000208) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00004736) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="0", COMPONENT_INSTALLER_DIR="%TEMP%\qda5az5g.bxa", EDGE_METRICS_CLIENT_ID_HASH="7976679344088549137"" Process "msedge.exe" (UID: 00000000-00004292) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_5204_IWUTQEIUXRYFWHBI"" Process "msedge.exe" (UID: 00000000-00002148) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME" Process "chrome.exe" (UID: 00000000-00005204) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "chrome.exe" (UID: 00000000-00005204) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles" Process "chrome.exe" (UID: 00000000-00005204) was launched with missing environment variables: "EDGE_METRICS_SESSION_ID, COMPONENT_INSTALLER_DIR, EDGE_USER_DATA_DIR, EDGE_BROWSER_PID, EDGE_CRASHPAD_PIPE_NAME, EDGE_METRICS_CLIENT_ID_HASH" Process "chrome.exe" (UID: 00000000-00002272) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles" Process "chrome.exe" (UID: 00000000-00002272) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "chrome.exe" (UID: 00000000-00007644) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_5204_IWUTQEIUXRYFWHBI""44:Tff3,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00004384-00000C2B-1358735645] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00004384-00000C2B-1359064539] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00001408-00000C2E-1073844066] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00001408-00000C2B-1364917359] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00001408-00000C2B-1365065241] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001408-00000C2B-1365143768] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00001408-00000C2B-1365274760] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00001408-00000C2B-1365353603] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001408-00000C2B-1365418119] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00001408-00000C2B-1365483613] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00001408-00000C2B-1365592302] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00001408-00000C2B-1365640961] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00001408-00000C2B-1365731404] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00001408-00000C2B-1365963096] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00001408-00000C2B-1366076886] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00001408-00000C2B-1366375335] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001408-00000C2B-1366607619] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001408-00000C2B-1366719916] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00001408-00000C2B-1366726929] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001408-00000C2B-1366781287] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00001408-00000C2B-1367054312] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00001408-00000C2B-1367099268] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00001408-00000C2B-1367141359] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00001408-00000C2B-1367429661] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll" [Source: 00000000-00001408-00000C2B-1367809371]45:Td0c,Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command ..." (UID: 00000000-00001408) Spawned process "aspnet_compiler.exe" (UID: 00000000-00006000) Spawned process "aspnet_compiler.exe" (UID: 00000000-00005704) Spawned process "aspnet_compiler.exe" (UID: 00000000-00005676) Spawned process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00003700) Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\o5zndj2k.chu /pr ..." (UID: 00000000-00007764) Spawned process "chrome.exe" with commandline "--type=gpu-process --no-sandbox --user-data-dir="%TEMP%\\o5zndj2 ..." (UID: 00000000-00003808), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003016), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00004240), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\o5zndj2k.chu" --no-pre- ..." (UID: 00000000-00006252), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\o5zndj2k.chu" --no-pre- ..." (UID: 00000000-00002296), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\o5zndj2k.chu" --no-pre- ..." (UID: 00000000-00005068), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\o5zndj2k.chu" --extensi ..." (UID: 00000000-00007100), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\o5zndj2k.chu" --extensi ..." (UID: 00000000-00001356), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00004956), Spawned process "msedge.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00000100), Spawned process "msedge.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\sfymq0id.o5j /pr ..." (UID: 00000000-00004500), Spawned process "msedge.exe" with commandline "--type=gpu-process --no-sandbox --user-data-dir="%TEMP%\\sfymq0i ..." (UID: 00000000-00007840) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00005284) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007404) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\sfymq0id.o5j" --pdf-ups ..." (UID: 00000000-00004340) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\sfymq0id.o5j" --instant ..." (UID: 00000000-00001204) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00007216) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\sfymq0id.o5j" --pdf-ups ..." (UID: 00000000-00000696) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\sfymq0id.o5j" --extensi ..." (UID: 00000000-00000332)46:Td0c,Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command ..." (UID: 00000000-00001408) Spawned process "aspnet_compiler.exe" (UID: 00000000-00006000) Spawned process "aspnet_compiler.exe" (UID: 00000000-00005704) Spawned process "aspnet_compiler.exe" (UID: 00000000-00005676) Spawned process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00003700) Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\o5zndj2k.chu /pr ..." (UID: 00000000-00007764) Spawned process "chrome.exe" with commandline "--type=gpu-process --no-sandbox --user-data-dir="%TEMP%\\o5zndj2 ..." (UID: 00000000-00003808), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003016), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00004240), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\o5zndj2k.chu" --no-pre- ..." (UID: 00000000-00006252), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\o5zndj2k.chu" --no-pre- ..." (UID: 00000000-00002296), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\o5zndj2k.chu" --no-pre- ..." (UID: 00000000-00005068), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\o5zndj2k.chu" --extensi ..." (UID: 00000000-00007100), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\o5zndj2k.chu" --extensi ..." (UID: 00000000-00001356), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00004956), Spawned process "msedge.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00000100), Spawned process "msedge.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\sfymq0id.o5j /pr ..." (UID: 00000000-00004500), Spawned process "msedge.exe" with commandline "--type=gpu-process --no-sandbox --user-data-dir="%TEMP%\\sfymq0i ..." (UID: 00000000-00007840) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00005284) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007404) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\sfymq0id.o5j" --pdf-ups ..." (UID: 00000000-00004340) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\sfymq0id.o5j" --instant ..." (UID: 00000000-00001204) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00007216) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\sfymq0id.o5j" --pdf-ups ..." (UID: 00000000-00000696) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\sfymq0id.o5j" --extensi ..." (UID: 00000000-00000332)47:Tfab,The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB" (SHA1: 5A:F8:27:2D:48:44:58:40:6E:F5:F0:2B:8C:EC:D7:83:03:F3:35:A0; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB" (SHA1: DD:55:B4:52:02:91:E2:76:58:8F:0D:D0:2F:AF:D8:3A:73:68:E0:FA; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:18:94:7A:6A:9F:C7:76:4F:D8:B5:FB:18:A8:63:B0:C6:DA:C2:4F; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:8F:1B:57:33:0D:BB:A2:D0:7A:6C:51:F7:0E:E9:0D:DA:B9:AD:8E; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 3C:A0:0E:DF:F7:7D:A8:F7:0A:8D:D1:D6:B0:3D:65:40:6B:80:34:7F; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 4D:9A:CB:31:3D:73:DA:2E:9E:B4:51:A7:CF:63:09:AF:45:C9:93:C1; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 6C:45:27:25:48:F3:E6:FF:F6:DA:DC:6A:B6:9F:8F:09:A7:D3:E8:B8; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: D5:1E:40:C7:73:E2:D3:1A:78:33:59:C1:DF:4C:FE:D6:55:49:15:E2; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: C3:E4:BE:7B:38:DD:F1:59:DC:DF:FA:8A:48:52:C7:1D:D2:BF:F7:5E; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft Azure RSA TLS Issuing CA 07, O=Microsoft Corporation, C=US" (SHA1: A7:3E:74:D5:82:5E:41:04:B7:20:F2:8B:C2:64:F4:E2:7D:4F:6A:65; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 33:82:51:70:58:A0:C2:02:28:D5:98:EE:75:01:B6:12:56:A7:64:42; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 04, O=Microsoft Corporation, C=US" (SHA1: 08:63:6F:87:96:38:B7:D5:CF:DA:6B:80:0A:72:98:FB:63:01:E7:77; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: DA:6D:04:00:64:1B:45:AE:CC:59:5D:24:E5:03:7A:A6:BC:09:C3:58; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information)48:T712,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp")49:T65c,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")4a:Tedb,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEFILTER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACINGFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CFGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "GLOBALFLAG"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SEARCHPATHMODE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "")4b:Ta88,"WScript.exe" trying to access non-existent file "C:\Windows\System32\wbem\WBEMCOMN.DLL" "WScript.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\CRYPTBASE.dll"4c:T870,"WScript.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\%NVM_HOME%" "powershell.exe" trying to access non-existent file "C:\Windows\System32\%NVM_SYMLINK%" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml"4d:Tce9,Found http requests in header "GET /MSI_102232.png" Found http requests in header "GET /img_153537.png" Found http requests in header "GET /time/1/current?cup2key=9:THsvE6F9Xj_5ChngFkeGMneg7ZmrHgW3qqrJ9-tTJ88&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" Found http requests in header "GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1776879110&P2=404&P3=2&P4=Jz3A%2bWSX5gDqXZVEx%2bW65b3ps%2bCLFPlNcaFpKTszT7N218UieZO3YZJ3DIiIWXknsQ%2bsSj1s8kIZKcnYLihAFQ%3d%3d" Found http requests in header "GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1776879124&P2=404&P3=2&P4=nErvlkWGCz0EI0rGw7n%2bCP7lGOdc8Fa7FYR5w1NiTBc3kuupkMpsAXR7c8j6cGzu5vHByhDByT%2byOAGVai5rPw%3d%3d" Found http requests in header "GET /time/1/current?cup2key=9:dFNrr870NJUEJh8aS2RrxDbV2W2xFDDgRyUCaAtbkiY&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" Found http requests in header "GET /" Found http requests in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1" Found http requests in header "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144" Found http requests in header "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE" Found http requests in header "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin" Found http requests in header "GET /crx/blobs/AQx-wa5CdJIJjS706_knugjy7Cklz3uJDf87x4mZfLZdq9myhunualUk1-rVhRTqBVeo4o-Rknd414J61ZjE36shzOrH0ymHdk6zgTltGzaISPUyoLS4rgwg2LcVn2YxdMcAxlKa5aR8BkPq7PdW2vf7kMbT4GEtiDcG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx" Found http requests in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc" Found http requests in header "GET /b?rn=1776311097358&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3093A5F6CAD163753E69B2CACBD0625A&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null" Found http requests in header "GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline" Found http requests in header "GET /b?rn=1776311109106&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=096047A077D166FB208D509C762367AD&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null" Found http requests in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService"4e:T43e,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00001408-00000C2C-1371471736") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp, 00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp, 00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found reference to API "'The name of the computer to connect to." (Indicator: " connect "; Source: "00000000-00001408.00000001.154382.263C0000.00000004.mdmp")4f:T55e,"2.5.29.37" "2.5.29.35" "192.168.0.2" "1.1.0.1" "3.0.0.0" Potential IP "4.0.0.0" found in string "Maximum number of drives allowed in a sessionnonon=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "1.0.0.0" found in string "icrosoft.Management.Infrastructure,1.0.0.0,,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "ystem.Transactions,4.0.0.0,,b77a5c561934e089" Potential IP "4.0.0.0" found in string "=4.0.0.0, Culture=neutral, Publi" "2.5.29.19" "2.5.29.14" "2.5.29.15" Potential IP "2.5.29.35" found in string "#2.5.29.35" Potential IP "0.0.0.0" found in string "0.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" "2.5.29.17" "2.5.29.31" "2.5.29.32" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.1" "2.5.4.3" "2.5.4.8" "2.5.29.10" "2.5.29.16" "2.5.4.6" "2.5.4.11" "2.5.4.5" "2.5.4.10" "2.5.4.7" Potential IP "1.0.0.1" found in string ":\program files\windowspowershell\modules\packagemanagement\1.0.0.1\packagemanagement.psd1" Potential IP "4.0.0.0" found in string "sion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />", "2.12.2.0", "17.0.0.0"50:T2139,Pattern match: "https://clients2.google.com/cr/report" Heuristic match: "vault88x.secure-efficient2.su" Heuristic match: "clients2.google.com" Heuristic match: "icanhazip.com" Heuristic match: "clientservices.googleapis.com" Heuristic match: "safebrowsingohttpgateway.googleapis.com" Heuristic match: "accounts.google.com" Heuristic match: "clients2.googleusercontent.com" Heuristic match: "sb.scorecardresearch.com" Heuristic match: "edgeassetservice.azureedge.net" Heuristic match: "mail.privateemail.com" Heuristic match: "r.msftstatic.com" Pattern match: "www.google.com" Pattern match: "https://vault88x.secure-efficient2.su/msi_102232.png';$w0gysyedygzqcieiomxffdepsjc72vg37y8ajmgieb5ibh9wamse3hpxqor2xbi6hgepmijkdznpvwdtauhyahkgduknwpe1f6sqsjgz0yejyfdtcenvg6s6jxmdetnnonwktatbm0odygqret2d58ck8bskchlgqne7b1twlgmbtrc4uqzdurjkffgvcju3wacjrjggu" Pattern match: "https://vault88x.secure-efficient2.su/img_153537.png','','c:\users\public\','ekmyakrcrj','aspnet_compiler','','aspnet_compiler','','url','c:\users\public\','ekmyakrcrj','vbs','5','','pp4c42tjwa','0" Pattern match: "microsoft.net/framework64/v4.0.30319/" Pattern match: "https://vault88x.secure-efficient2.su/msi_102232.png" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.security/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.security.dll" Heuristic match: "$this.resolvedcommand.name" Heuristic match: "$this.name + -> + $this.resolvedcommand.name" Heuristic match: "$this.name" Heuristic match: "$commandname = $this.name" Heuristic match: "$this.userinfo.identity.name" Heuristic match: "$this.userinfo.windowsidentity.name" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "icrosoft.powershell.se" Heuristic match: "6299.15.cat" Heuristic match: "ntrust.net" Pattern match: "ient2.su/img_153537.png','','c:\users\public\','ekmd" Heuristic match: "ystem.management.automation.re" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://crl.globalsign.net/root.cr" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://www.microsoft.com0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Heuristic match: "icrosoft.com" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Heuristic match: ",z.ao" Heuristic match: "*.secure-efficient2.su" Pattern match: "wdcp.svc/submitreport" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Heuristic match: "ay.am" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "https://github.com/dahall/taskscheduler" Pattern match: "http://www.validationtest.contoso.com/test%d.html"51:T8787,Found URL "https://vault88x.secure-efficient2.su/img_153537.png','','c:\users\public\','ekmyakrcrj','aspnet_compiler','','aspnet_compiler','','url','c:\users\public\','ekmyakrcrj','vbs','5','','pp4c42tjwa','0','','','');try" - Source: "00000000-00001408.00000000.153313.0B470000.00000004.mdmp") Found URL "https://vault88x.secure-efficient2.su/msi_102232.png';$w0gysyedygzqcieiomxffdepsjc72vg37y8ajmgieb5ibh9wamse3hpxqor2xbi6hgepmijkdznpvwdtauhyahkgduknwpe1f6sqsjgz0yejyfdtcenvg6s6jxmdetnnonwktatbm0odygqret2d58ck8bskchlgqne7b1twlgmbtrc4uqzdurjkffgvcju3wacjrjgguzinovxiq8zbkjwqdc2is4mtt9huhz0jr8ffngpjlxcuacrphvyjnb6fudk0fxccxdgfn7bmpnt5vdgsuyxpzaxvcqyesg0s8oxvkfitjiv6sy0tjbxbpo1s0glhoqqx8fvtvvsbjbabuv2pgtqknxbhlsjt1ozddu1nyxct22irfi5bocgctz5ipwj52zysv7pnjerkzmebqefyby6aikxar7bl18mkbw2tmf3r5dwwropopvfxskonjcpe9b74pwikevb629wlhqbjxiwtcgwgkuiqnzr0wh9llzbjsxcajvhsnebt0icg2vpoqhlr39hryl43x0yjwp4atcl2wxzoiepglk4r4g7mrh7yirsd8dacfyuojls7frwt03dht9qdqo7fsyezddecbib8qcfooh4amthjdto9gvonvgf2kodniyhyw2rqf9kwdnpvgylfzpucr7tpcqph5odyag32f4nfzgzyt6wedfvobrgkme4fomq3xxtgtnkteue8jjyoyhw3fmxim9d2asea7rcywebgonvqozhmu8mpnkynbgqal5bdpsmpdvevyoddglh0yflgbfcps3s4tfoq0iotbrydj0mzvdpcacd0jq5xjxz42mh1ohmqyeg6bmr1ckebp=new-object" - Source: "00000000-00001408.00000000.153313.0B470000.00000004.mdmp") Found URL "https://vault88x.secure-efficient2.su/img_153537.png','','c:\users\public\','ekmyakrcrj','aspnet_compiler','','aspnet_compiler','','url','c:\users\public\','ekmyakrcrj','vbs','5','','pp4c42tjwa','0','','','');try" - Source: "00000000-00001408.00000000.153313.0B670000.00000004.mdmp") Found URL "https://vault88x.secure-efficient2.su/msi_102232.png';$w0gysyedygzqcieiomxffdepsjc72vg37y8ajmgieb5ibh9wamse3hpxqor2xbi6hgepmijkdznpvwdtauhyahkgduknwpe1f6sqsjgz0yejyfdtcenvg6s6jxmdetnnonwktatbm0odygqret2d58ck8bskchlgqne7b1twlgmbtrc4uqzdurjkffgvcju3wacjrjgguzinovxiq8zbkjwqdc2is4mtt9huhz0jr8ffngpjlxcuacrphvyjnb6fudk0fxccxdgfn7bmpnt5vdgsuyxpzaxvcqyesg0s8oxvkfitjiv6sy0tjbxbpo1s0glhoqqx8fvtvvsbjbabuv2pgtqknxbhlsjt1ozddu1nyxct22irfi5bocgctz5ipwj52zysv7pnjerkzmebqefyby6aikxar7bl18mkbw2tmf3r5dwwropopvfxskonjcpe9b74pwikevb629wlhqbjxiwtcgwgkuiqnzr0wh9llzbjsxcajvhsnebt0icg2vpoqhlr39hryl43x0yjwp4atcl2wxzoiepglk4r4g7mrh7yirsd8dacfyuojls7frwt03dht9qdqo7fsyezddecbib8qcfooh4amthjdto9gvonvgf2kodniyhyw2rqf9kwdnpvgylfzpucr7tpcqph5odyag32f4nfzgzyt6wedfvobrgkme4fomq3xxtgtnkteue8jjyoyhw3fmxim9d2asea7rcywebgonvqozhmu8mpnkynbgqal5bdpsmpdvevyoddglh0yflgbfcps3s4tfoq0iotbrydj0mzvdpcacd0jq5xjxz42mh1ohmqyeg6bmr1ckebp=new-object" - Source: "00000000-00001408.00000000.153313.0B670000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00001408.00000000.153313.0B670000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001408.00000000.153313.0B670000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001408.00000000.153313.0B670000.00000004.mdmp") Found URL "https://vault88x.secure-efficient2.su/img_153537.png','','c:\users\public\','ekmyakrcrj','aspnet_compiler','','aspnet_compiler','','url','c:\users\public\','ekmyakrcrj','vbs','5','','pp4c42tjwa','0','','','');try" - Source: "00000000-00001408.00000000.153313.0B790000.00000004.mdmp") Found URL "https://vault88x.secure-efficient2.su/msi_102232.png';$w0gysyedygzqcieiomxffdepsjc72vg37y8ajmgieb5ibh9wamse3hpxqor2xbi6hgepmijkdznpvwdtauhyahkgduknwpe1f6sqsjgz0yejyfdtcenvg6s6jxmdetnnonwktatbm0odygqret2d58ck8bskchlgqne7b1twlgmbtrc4uqzdurjkffgvcju3wacjrjgguzinovxiq8zbkjwqdc2is4mtt9huhz0jr8ffngpjlxcuacrphvyjnb6fudk0fxccxdgfn7bmpnt5vdgsuyxpzaxvcqyesg0s8oxvkfitjiv6sy0tjbxbpo1s0glhoqqx8fvtvvsbjbabuv2pgtqknxbhlsjt1ozddu1nyxct22irfi5bocgctz5ipwj52zysv7pnjerkzmebqefyby6aikxar7bl18mkbw2tmf3r5dwwropopvfxskonjcpe9b74pwikevb629wlhqbjxiwtcgwgkuiqnzr0wh9llzbjsxcajvhsnebt0icg2vpoqhlr39hryl43x0yjwp4atcl2wxzoiepglk4r4g7mrh7yirsd8dacfyuojls7frwt03dht9qdqo7fsyezddecbib8qcfooh4amthjdto9gvonvgf2kodniyhyw2rqf9kwdnpvgylfzpucr7tpcqph5odyag32f4nfzgzyt6wedfvobrgkme4fomq3xxtgtnkteue8jjyoyhw3fmxim9d2asea7rcywebgonvqozhmu8mpnkynbgqal5bdpsmpdvevyoddglh0yflgbfcps3s4tfoq0iotbrydj0mzvdpcacd0jq5xjxz42mh1ohmqyeg6bmr1ckebp=new-object" - Source: "00000000-00001408.00000000.153313.0CF50000.00000004.mdmp") Found URL "https://vault88x.secure-efficient2.su/img_153537.png','','c:\users\public\','ekmyakrcrj','aspnet_compiler','','aspnet_compiler','','url','c:\users\public\','ekmyakrcrj','vbs','5','','pp4c42tjwa','0','','','');try" - Source: "00000000-00001408.00000000.153313.0CF50000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,ciil" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.cruz_][(;1jfwr/greater" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcwashington1redmond1microsoft" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lthawte," - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e%ory08>=i@iqoz" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;verisign," - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l4tgdntne=1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://wwwt.c%washington1redmond1microsoft" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001408.00000000.153313.259C0000.00000004.mdmp") Found URL "https://vault88x.secure-efficient2.su/msi_102232.png';$w0gysyedygzqcieiomxffdepsjc72vg37y8ajmgieb5ibh9wamse3hpxqor2xbi6hgepmijkdznpvwdtauhyahkgduknwpe1f6sqsjgz0yejyfdtcenvg6s6jxmdetnnonwktatbm0odygqret2d58ck8bskchlgqne7b1twlgmbtrc4uqzdurjkffgvcju3wacjrjgguzinovxiq8zbkjwqdc2is4mtt9huhz0jr8ffngpjlxcuacrphvyjnb6fudk0fxccxdgfn7bmpnt5vdgsuyxpzaxvcqyesg0s8oxvkfitjiv6sy0tjbxbpo1s0glhoqqx8fvtvvsbjbabuv2pgtqknxbhlsjt1ozddu1nyxct22irfi5bocgctz5ipwj52zysv7pnjerkzmebqefyby6aikxar7bl18mkbw2tmf3r5dwwropopvfxskonjcpe9b74pwikevb629wlhqbjxiwtcgwgkuiqnzr0wh9llzbjsxcajvhsnebt0icg2vpoqhlr39hryl43x0yjwp4atcl2wxzoiepglk4r4g7mrh7yirsd8dacfyuojls7frwt03dht9qdqo7fsyezddecbib8qcfooh4amthjdto9gvonvgf2kodniyhyw2rqf9kwdnpvgylfzpucr7tpcqph5odyag32f4nfzgzyt6wedfvobrgkme4fomq3xxtgtnkteue8jjyoyhw3fmxim9d2asea7rcywebgonvqozhmu8mpnkynbgqal5bdpsmpdvevyoddglh0yflgbfcps3s4tfoq0iotbrydj0mzvdpcacd0jq5xjxz42mh1ohmqyeg6bmr1ckebp=new-object" - Source: "00000000-00001408.00000000.153313.25FE0000.00000004.mdmp") Found URL "https://vault88x.secure-efficient2.su/img_153537.png','','c:\users\public\','ekmyakrcrj','aspnet_compiler','','aspnet_compiler','','url','c:\users\public\','ekmyakrcrj','vbs','5','','pp4c42tjwa','0','','','');try" - Source: "00000000-00001408.00000000.153313.25FE0000.00000004.mdmp") Found URL "https://vault88x.secure-efficient2.su/msi_102232.png';$w0gysyedygzqcieiomxffdepsjc72vg37y8ajmgieb5ibh9wamse3hpxqor2xbi6hgepmijkdznpvwdtauhyahkgduknwpe1f6sqsjgz0yejyfdtcenvg6s6jxmdetnnonwktatbm0odygqret2d58ck8bskchlgqne7b1twlgmbtrc4uqzdurjkffgvcju3wacjrjgguzinovxiq8zbkjwqdc2is4mtt9huhz0jr8ffngpjlxcuacrphvyjnb6fudk0fxccxdgfn7bmpnt5vdgsuyxpzaxvcqyesg0s8oxvkfitjiv6sy0tjbxbpo1s0glhoqqx8fvtvvsbjbabuv2pgtqknxbhlsjt1ozddu1nyxct22irfi5bocgctz5ipwj52zysv7pnjerkzmebqefyby6aikxar7bl18mkbw2tmf3r5dwwropopvfxskonjcpe9b74pwikevb629wlhqbjxiwtcgwgkuiqnzr0wh9llzbjsxcajvhsnebt0icg2vpoqhlr39hryl43x0yjwp4atcl2wxzoiepglk4r4g7mrh7yirsd8dacfyuojls7frwt03dht9qdqo7fsyezddecbib8qcfooh4amthjdto9gvonvgf2kodniyhyw2rqf9kwdnpvgylfzpucr7tpcqph5odyag32f4nfzgzyt6wedfvobrgkme4fomq3xxtgtnkteue8jjyoyhw3fmxim9d2asea7rcywebgonvqozhmu8mpnkynbgqal5bdpsmpdvevyoddglh0yflgbfcps3s4tfoq0iotbrydj0mzvdpcacd0jq5xjxz42mh1ohmqyeg6bmr1ckebp=new-object" - Source: "00000000-00001408.00000001.154382.0B470000.00000004.mdmp") Found URL "https://vault88x.secure-efficient2.su/img_153537.png','','c:\users\public\','ekmyakrcrj','aspnet_compiler','','aspnet_compiler','','url','c:\users\public\','ekmyakrcrj','vbs','5','','pp4c42tjwa','0','','','');try" - Source: "00000000-00001408.00000001.154382.0B470000.00000004.mdmp") Found URL "https://vault88x.secure-efficient2.su/msi_102232.png';$w0gysyedygzqcieiomxffdepsjc72vg37y8ajmgieb5ibh9wamse3hpxqor2xbi6hgepmijkdznpvwdtauhyahkgd" - Source: "00000000-00001408.00000001.154382.0B470000.00000004.mdmp") Found URL "https://vault88x.secure-efficient2.su/msi_102232.png';$w0gysyedygzqcieiomxffdepsjc72vg37y8ajmgieb5ibh9wamse3hpxqor2xbi6hgepmijkdznpvwdtauhyahkgduknwpe1f6sqsjgz0yejyfdtcenvg6s6jxmdetnnonwktatbm0odygqret2d58ck8bskchlgqne7b1twlgmbtrc4uqzdurjkffgvcju3wacjrjgguzinovxiq8zbkjwqdc2is4mtt9huhz0jr8ffngpjlxcuacrphvyjnb6fudk0fxccxdgfn7bmpnt5vdgsuyxpzaxvcqyesg0s8oxvkfitjiv6sy0tjbxbpo1s0glhoqqx8fvtvvsbjbabuv2pgtqknxbhlsjt1ozddu1nyxct22irfi5bocgctz5ipwj52zysv7pnjerkzmebqefyby6aikxar7bl18mkbw2tmf3r5dwwropopvfxskonjcpe9b74pwikevb629wlhqbjxiwtcgwgkuiqnzr0wh9llzbjsxcajvhsnebt0icg2vpoqhlr39hryl43x0yjwp4atcl2wxzoiepglk4r4g7mrh7yirsd8dacfyuojls7frwt03dht9qdqo7fsyezddecbib8qcfooh4amthjdto9gvonvgf2kodniyhyw2rqf9kwdnpvgylfzpucr7tpcqph5odyag32f4nfzgzyt6wedfvobrgkme4fomq3xxtgtnkteue8jjyoyhw3fmxim9d2asea7rcywebgonvqozhmu8mpnkynbgqal5bdpsmpdvevyoddglh0yflgbfcps3s4tfoq0iotbrydj0mzvdpcacd0jq5xjxz42mh1ohmqyeg6bmr1ckebp=new-object" - Source: "00000000-00001408.00000001.154382.0B670000.00000004.mdmp") Found URL "https://vault88x.secure-efficient2.su/img_153537.png','','c:\users\public\','ekmyakrcrj','aspnet_compiler','','aspnet_compiler','','url','c:\users\public\','ekmyakrcrj','vbs','5','','pp4c42tjwa','0','','','');try" - Source: "00000000-00001408.00000001.154382.0B670000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport:\users\hapubws\appdata\local\microsoft\windows" - Source: "00000000-00001408.00000001.154382.0B670000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00001408.00000001.154382.0B670000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001408.00000001.154382.0B670000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001408.00000001.154382.0B670000.00000004.mdmp") Found URL "https://vault88x.secure-efficient2.su/msi_102232.png';$w0gysyedygzqcieiomxffdepsjc72vg37y8ajmgieb5ibh9wamse3hpxqor2xbi6hgepmijkdznpvwdtauhyahkgduknwpe1f6sqsjgz0yejyfdtcenvg6s6jxmdetnnonwktatbm0odygqret2d58ck8bskchlgqne7b1twlgmbtrc4uqzdurjkffgvcju3wacjrjgguzinovxiq8zbkjwqdc2is4mtt9huhz0jr8ffngpjlxcuacrphvyjnb6fudk0fxccxdgfn7bmpnt5vdgsuyxpzaxvcqyesg0s8oxvkfitjiv6sy0tjbxbpo1s0glhoqqx8fvtvvsbjbabuv2pgtqknxbhlsjt1ozddu1nyxct22irfi5bocgctz5ipwj52zysv7pnjerkzmebqefyby6aikxar7bl18mkbw2tmf3r5dwwropopvfxskonjcpe9b74pwikevb629wlhqbjxiwtcgwgkuiqnzr0wh9llzbjsxcajvhsnebt0icg2vpoqhlr39hryl43x0yjwp4atcl2wxzoiepglk4r4g7mrh7yirsd8dacfyuojls7frwt03dht9qdqo7fsyezddecbib8qcfooh4amthjdto9gvonvgf2kodniyhyw2rqf9kwdnpvgylfzpucr7tpcqph5odyag32f4nfzgzyt6wedfvobrgkme4fomq3xxtgtnkteue8jjyoyhw3fmxim9d2asea7rcywebgonvqozhmu8mpnkynbgqal5bdpsmpdvevyoddglh0yflgbfcps3s4tfoq0iotbrydj0mzvdpcacd0jq5xjxz42mh1ohmqyeg6bmr1ckebp=new-object" - Source: "00000000-00001408.00000001.154382.0CF50000.00000004.mdmp") Found URL "https://vault88x.secure-efficient2.su/img_153537.png','','c:\users\public\','ekmyakrcrj','aspnet_compiler','','aspnet_compiler','','url','c:\users\public\','ekmyakrcrj','vbs','5','','pp4c42tjwa','0','','','');try" - Source: "00000000-00001408.00000001.154382.0CF50000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00001408.00000001.154382.14A18000.00000002.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,ciil" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.cruz_][(;1jfwr/greater" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcwashington1redmond1microsoft" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lthawte," - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e140220101310310022052023@2310302313121123h)ctjmscorlib@mscorlib" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;verisign," - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l4tgdntne=1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001408.00000001.154382.259E4000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://wwwt.c%1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00001408.00000001.154382.25AAB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001408.00000001.154382.25AAB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0om/pd$" - Source: "00000000-00001408.00000001.154382.26031000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0washington1redmond1microsoft" - Source: "00000000-00001408.00000001.154382.26031000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001408.00000001.154382.26094000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00001408.00000001.154382.26094000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00001408.00000001.154382.39FF2000.00000002.mdmp")52:T24a5,GET /MSI_102232.png HTTP/1.1 Host: vault88x.secure-efficient2.su Connection: Keep-Alive GET /img_153537.png HTTP/1.1 GET /time/1/current?cup2key=9:THsvE6F9Xj_5ChngFkeGMneg7ZmrHgW3qqrJ9-tTJ88&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1 Host: clients2.google.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Accept-Encoding: gzip deflate GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1776879110&P2=404&P3=2&P4=Jz3A%2bWSX5gDqXZVEx%2bW65b3ps%2bCLFPlNcaFpKTszT7N218UieZO3YZJ3DIiIWXknsQ%2bsSj1s8kIZKcnYLihAFQ%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: fNUPYMXfi0Z/sc0wKbiKp9 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1776879124&P2=404&P3=2&P4=nErvlkWGCz0EI0rGw7n%2bCP7lGOdc8Fa7FYR5w1NiTBc3kuupkMpsAXR7c8j6cGzu5vHByhDByT%2byOAGVai5rPw%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: CD6aAcrQyWx+U4BciSttDX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 GET /time/1/current?cup2key=9:dFNrr870NJUEJh8aS2RrxDbV2W2xFDDgRyUCaAtbkiY&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1 Host: clients2.google.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Accept-Encoding: gzip deflate GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3 puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-144.0.7559.133 Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2 Host: clientservices.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors If-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY= Sec-Fetch-Site: none A-Im: x-bm gzip Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: safebrowsingohttpgateway.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Ohttppublickey-Fst: true Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /crx/blobs/AQx-wa5CdJIJjS706_knugjy7Cklz3uJDf87x4mZfLZdq9myhunualUk1-rVhRTqBVeo4o-Rknd414J61ZjE36shzOrH0ymHdk6zgTltGzaISPUyoLS4rgwg2LcVn2YxdMcAxlKa5aR8BkPq7PdW2vf7kMbT4GEtiDcG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Priority: u=1 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3 puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi X-Goog-Update-Updater: chromiumcrx-145.0.3800.58 Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1 i Ms-Cv: iDlpzfdB5Bwfoh6jS5vyOh Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /crx/blobs/AQx-wa5CdJIJjS706_knugjy7Cklz3uJDf87x4mZfLZdq9myhunualUk1-rVhRTqBVeo4o-Rknd414J61ZjE36shzOrH0ymHdk6zgTltGzaISPUyoLS4rgwg2LcVn2YxdMcAxlKa5aR8BkPq7PdW2vf7kMbT4GEtiDcG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Priority: u=1 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /b?rn=1776311097358&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3093A5F6CAD163753E69B2CACBD0625A&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/2 Host: sb.scorecardresearch.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2 Host: edgeassetservice.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3 puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi X-Goog-Update-Updater: chromiumcrx-145.0.3800.58 Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1 i Ms-Cv: 2HLuctK6lwfck3UOOWlqWp Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /b?rn=1776311109106&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=096047A077D166FB208D509C762367AD&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/2 Host: sb.scorecardresearch.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2 Host: edgeassetservice.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty 53:T3eff,Contains base62 string in header "e3b0c44298fc1c149afbf4c8996fb9242" in header "GET /time/1/current?cup2key=9:THsvE6F9Xj_5ChngFkeGMneg7ZmrHgW3qqrJ9-tTJ88&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1Host: clients2.google.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate" Contains base62 string in header "2bCLFPlNcaFpKTszT7N218UieZO3YZJ3D" in header "GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1776879110&P2=404&P3=2&P4=Jz3A%2bWSX5gDqXZVEx%2bW65b3ps%2bCLFPlNcaFpKTszT7N218UieZO3YZJ3DIiIWXknsQ%2bsSj1s8kIZKcnYLihAFQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: fNUPYMXfi0Z/sc0wKbiKp9Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "2bCP7lGOdc8Fa7FYR5w1NiTBc3kuupkMp" in header "GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1776879124&P2=404&P3=2&P4=nErvlkWGCz0EI0rGw7n%2bCP7lGOdc8Fa7FYR5w1NiTBc3kuupkMpsAXR7c8j6cGzu5vHByhDByT%2byOAGVai5rPw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: CD6aAcrQyWx+U4BciSttDXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base62 string in header "dFNrr870NJUEJh8aS2RrxDbV2W2xFDDgR" in header "GET /time/1/current?cup2key=9:dFNrr870NJUEJh8aS2RrxDbV2W2xFDDgRyUCaAtbkiY&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1Host: clients2.google.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate" Contains base62 string in header "e3b0c44298fc1c149afbf4c8996fb9242" in header "GET /time/1/current?cup2key=9:dFNrr870NJUEJh8aS2RrxDbV2W2xFDDgRyUCaAtbkiY&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1Host: clients2.google.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate" Contains base62 string in header "3Dghbmnnjooekpmoecnnnilnnbdlolhkh" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "3Dnmmhkkegccagdldgiimedpiccmgmied" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "nmmhkkegccagdldgiimedpiccmgmiedaX" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDA" in header "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2Host: clientservices.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsIf-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY=Sec-Fetch-Site: noneA-Im: x-bm,gzipPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLo" in header "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: safebrowsingohttpgateway.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneX-Ohttppublickey-Fst: truePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "knugjy7Cklz3uJDf87x4mZfLZdq9myhun" in header "GET /crx/blobs/AQx-wa5CdJIJjS706_knugjy7Cklz3uJDf87x4mZfLZdq9myhunualUk1-rVhRTqBVeo4o-Rknd414J61ZjE36shzOrH0ymHdk6zgTltGzaISPUyoLS4rgwg2LcVn2YxdMcAxlKa5aR8BkPq7PdW2vf7kMbT4GEtiDcG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "Rknd414J61ZjE36shzOrH0ymHdk6zgTlt" in header "GET /crx/blobs/AQx-wa5CdJIJjS706_knugjy7Cklz3uJDf87x4mZfLZdq9myhunualUk1-rVhRTqBVeo4o-Rknd414J61ZjE36shzOrH0ymHdk6zgTltGzaISPUyoLS4rgwg2LcVn2YxdMcAxlKa5aR8BkPq7PdW2vf7kMbT4GEtiDcG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "GzaISPUyoLS4rgwg2LcVn2YxdMcAxlKa5" in header "GET /crx/blobs/AQx-wa5CdJIJjS706_knugjy7Cklz3uJDf87x4mZfLZdq9myhunualUk1-rVhRTqBVeo4o-Rknd414J61ZjE36shzOrH0ymHdk6zgTltGzaISPUyoLS4rgwg2LcVn2YxdMcAxlKa5aR8BkPq7PdW2vf7kMbT4GEtiDcG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "aR8BkPq7PdW2vf7kMbT4GEtiDcG/GHBMN" in header "GET /crx/blobs/AQx-wa5CdJIJjS706_knugjy7Cklz3uJDf87x4mZfLZdq9myhunualUk1-rVhRTqBVeo4o-Rknd414J61ZjE36shzOrH0ymHdk6zgTltGzaISPUyoLS4rgwg2LcVn2YxdMcAxlKa5aR8BkPq7PdW2vf7kMbT4GEtiDcG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "NJOOEKPMOECNNNILNNBDLOLHKHI_1_104" in header "GET /crx/blobs/AQx-wa5CdJIJjS706_knugjy7Cklz3uJDf87x4mZfLZdq9myhunualUk1-rVhRTqBVeo4o-Rknd414J61ZjE36shzOrH0ymHdk6zgTltGzaISPUyoLS4rgwg2LcVn2YxdMcAxlKa5aR8BkPq7PdW2vf7kMbT4GEtiDcG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "3Dghbmnnjooekpmoecnnnilnnbdlolhkh" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: iDlpzfdB5Bwfoh6jS5vyOhAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "ghbmnnjooekpmoecnnnilnnbdlolhkhiX" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: iDlpzfdB5Bwfoh6jS5vyOhAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "knugjy7Cklz3uJDf87x4mZfLZdq9myhun" in header "GET /crx/blobs/AQx-wa5CdJIJjS706_knugjy7Cklz3uJDf87x4mZfLZdq9myhunualUk1-rVhRTqBVeo4o-Rknd414J61ZjE36shzOrH0ymHdk6zgTltGzaISPUyoLS4rgwg2LcVn2YxdMcAxlKa5aR8BkPq7PdW2vf7kMbT4GEtiDcG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "Rknd414J61ZjE36shzOrH0ymHdk6zgTlt" in header "GET /crx/blobs/AQx-wa5CdJIJjS706_knugjy7Cklz3uJDf87x4mZfLZdq9myhunualUk1-rVhRTqBVeo4o-Rknd414J61ZjE36shzOrH0ymHdk6zgTltGzaISPUyoLS4rgwg2LcVn2YxdMcAxlKa5aR8BkPq7PdW2vf7kMbT4GEtiDcG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "GzaISPUyoLS4rgwg2LcVn2YxdMcAxlKa5" in header "GET /crx/blobs/AQx-wa5CdJIJjS706_knugjy7Cklz3uJDf87x4mZfLZdq9myhunualUk1-rVhRTqBVeo4o-Rknd414J61ZjE36shzOrH0ymHdk6zgTltGzaISPUyoLS4rgwg2LcVn2YxdMcAxlKa5aR8BkPq7PdW2vf7kMbT4GEtiDcG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "aR8BkPq7PdW2vf7kMbT4GEtiDcG/GHBMN" in header "GET /crx/blobs/AQx-wa5CdJIJjS706_knugjy7Cklz3uJDf87x4mZfLZdq9myhunualUk1-rVhRTqBVeo4o-Rknd414J61ZjE36shzOrH0ymHdk6zgTltGzaISPUyoLS4rgwg2LcVn2YxdMcAxlKa5aR8BkPq7PdW2vf7kMbT4GEtiDcG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "NJOOEKPMOECNNNILNNBDLOLHKHI_1_104" in header "GET /crx/blobs/AQx-wa5CdJIJjS706_knugjy7Cklz3uJDf87x4mZfLZdq9myhunualUk1-rVhRTqBVeo4o-Rknd414J61ZjE36shzOrH0ymHdk6zgTltGzaISPUyoLS4rgwg2LcVn2YxdMcAxlKa5aR8BkPq7PdW2vf7kMbT4GEtiDcG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "3Dghbmnnjooekpmoecnnnilnnbdlolhkh" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: 2HLuctK6lwfck3UOOWlqWpAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "ghbmnnjooekpmoecnnnilnnbdlolhkhiX" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: 2HLuctK6lwfck3UOOWlqWpAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty"54:Tcf3,Found HTTPS GET request to https://vault88x.secure-efficient2.su/MSI_102232.png Found HTTPS GET request to https://vault88x.secure-efficient2.su/img_153537.png Found HTTPS GET request to https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1776879110&P2=404&P3=2&P4=Jz3A%2bWSX5gDqXZVEx%2bW65b3ps%2bCLFPlNcaFpKTszT7N218UieZO3YZJ3DIiIWXknsQ%2bsSj1s8kIZKcnYLihAFQ%3d%3d Found HTTPS GET request to https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1776879124&P2=404&P3=2&P4=nErvlkWGCz0EI0rGw7n%2bCP7lGOdc8Fa7FYR5w1NiTBc3kuupkMpsAXR7c8j6cGzu5vHByhDByT%2byOAGVai5rPw%3d%3d Found HTTPS GET request to https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3 puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 Found HTTPS GET request to https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=144 Found HTTPS GET request to https://safebrowsingohttpgateway.googleapis.com/v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE Found HTTPS POST request to https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin Found HTTPS GET request to https://clients2.googleusercontent.com/crx/blobs/AQx-wa5CdJIJjS706_knugjy7Cklz3uJDf87x4mZfLZdq9myhunualUk1-rVhRTqBVeo4o-Rknd414J61ZjE36shzOrH0ymHdk6zgTltGzaISPUyoLS4rgwg2LcVn2YxdMcAxlKa5aR8BkPq7PdW2vf7kMbT4GEtiDcG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx Found HTTPS GET request to https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3 puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc Found HTTPS GET request to https://sb.scorecardresearch.com/b?rn=1776311097358&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3093A5F6CAD163753E69B2CACBD0625A&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null Found HTTPS GET request to https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline Found HTTPS GET request to https://sb.scorecardresearch.com/b?rn=1776311109106&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=096047A077D166FB208D509C762367AD&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null Found HTTPS GET request to https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService55:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp")56:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001408) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00001408) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001408) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001408) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001408) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001408) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001408) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001408) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00001408) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00001408) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00001408) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00001408) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00001408) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00001408) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00001408) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00001408) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00001408) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00001408) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00001408) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00001408)57:T19fd,file/memory contains long string with (Indicator: "base64"; File: "AMSI") file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00001408.00000000.153313.0B470000.00000004.mdmp, 00000000-00001408.00000000.153313.0B670000.00000004.mdmp, 00000000-00001408.00000000.153313.0B790000.00000004.mdmp, 00000000-00001408.00000000.153313.0CF50000.00000004.mdmp, 00000000-00001408.00000000.153313.259C0000.00000004.mdmp, 00000000-00001408.00000000.153313.25FE0000.00000004.mdmp, 00000000-00001408.00000001.154382.0B470000.00000004.mdmp, 00000000-00001408.00000001.154382.0B670000.00000004.mdmp, 00000000-00001408.00000001.154382.0CF50000.00000004.mdmp, 00000000-00001408.00000001.154382.259E4000.00000004.mdmp, 00000000-00001408.00000001.154382.26031000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00001408.00000000.153313.0B470000.00000004.mdmp, 00000000-00001408.00000000.153313.0B670000.00000004.mdmp, 00000000-00001408.00000000.153313.0B790000.00000004.mdmp, 00000000-00001408.00000000.153313.0CF50000.00000004.mdmp, 00000000-00001408.00000000.153313.259C0000.00000004.mdmp, 00000000-00001408.00000000.153313.25FE0000.00000004.mdmp, 00000000-00001408.00000001.154382.0B470000.00000004.mdmp, 00000000-00001408.00000001.154382.0B670000.00000004.mdmp, 00000000-00001408.00000001.154382.0CF50000.00000004.mdmp, 00000000-00001408.00000001.154382.259E4000.00000004.mdmp, 00000000-00001408.00000001.154382.26031000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00001408.00000000.153313.0D560000.00000004.mdmp") Found string "[-WindowStyle