26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T502,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 2d6f773bb869… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2d6f773bb869…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 7/25 AV engines flagged this file. 8 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d"],"about":{"@type":"SoftwareApplication","name":"2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":7,"total":25},"behavioralIndicators":{"malicious":8,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5b8,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00001380.00000000.293667.14380000.00000004.mdmp, 00000000-00001380.00000001.294642.143A6000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00001380.00000000.293667.14380000.00000004.mdmp, 00000000-00001380.00000001.294642.143A6000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00001380.00000000.293667.14380000.00000004.mdmp, 00000000-00001380.00000001.294642.143A6000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00001460.00000000.292481.19840000.00000004.mdmp, 00000000-00001460.00000001.293289.19840000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00001460.00000000.292481.19840000.00000004.mdmp, 00000000-00001460.00000001.293289.19840000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00001460.00000000.292481.19840000.00000004.mdmp, 00000000-00001460.00000001.293289.19840000.00000004.mdmp")28:T76e,Found reference string "Add-MpPreference -ExclusionPath $env:UserProfile -Force" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string "Add-MpPreference -ExclusionPath $env:ProgramData -Force" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string "Add-MpPreference -ExclusionPath $env:TEMP -Force" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string "Add-MpPreference -ExclusionExtension '.exe' -Force" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string "Add-MpPreference -ExclusionExtension '.sys' -Force" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string "Add-MpPreference -ExclusionProcess 'nslookup.exe' -Force" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string ""C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension '.sys' -Force" (Indicator: "add-mppreference"; Source: "00000000-00001380.00000000.293667.14380000.00000004.mdmp, 00000000-00001380.00000001.294642.14380000.00000004.mdmp") Found reference string "HostApplication=C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionExtension '.sys' -Force" (Indicator: "add-mppreference"; Source: "00000000-00001380.00000001.294642.2D930000.00000004.mdmp") Found reference string ""C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension '.exe' -Force" (Indicator: "add-mppreference"; Source: "00000000-00001460.00000000.292481.19840000.00000004.mdmp, 00000000-00001460.00000001.293289.19840000.00000004.mdmp") Found reference string "HostApplication=C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionExtension '.exe' -Force" (Indicator: "add-mppreference"; Source: "00000000-00001460.00000000.292481.19840000.00000004.mdmp")29:T5fa,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp")2a:T7f5,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS\27748148BBE67A43CDBFEC6C3784862CE134E6EA") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS\27748148BBE67A43CDBFEC6C3784862CE134E6EA") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CRLS")2b:Tc78,Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00001380.00000000.293667.2D930000.00000004.mdmp, 00000000-00001380.00000001.294642.2D930000.00000004.mdmp") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "BCryptDestroyHash"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "BCryptCreateHash"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found api reference "BCryptFinishHash" (Indicator: "BCryptFinishHash"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHash"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHashData"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp")2c:T936,"powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2d:T49c,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains CRYPTO related strings Matched sigs: Contains reference to cryptographic keys Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match – Encryption algorithm2e:Ta53e,Found XOR loop in file "SoftUpdateb320.exe" at offset 45033; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 262586; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 324833; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 393037; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 410535; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 424005; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 486765; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 491809; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 636768; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 674216; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 706978; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 733018; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 840933; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 858081; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 911628; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 1005927; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 1016351; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 1019563; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 1031892; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 1066227; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 1111971; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 1209754; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 1366688; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 1417960; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 1568843; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 1595356; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 1622792; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 1895246; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 1930947; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 1981233; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 2106812; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 2117682; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 2157529; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 2160389; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 2189435; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 2389243; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 2455805; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 2472347; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 2532011; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 2645104; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 2714815; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 2975710; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 3029051; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 3044550; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 3190660; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 3243322; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 3292767; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 3312599; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 3329652; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 3355430; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 3517193; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 3537700; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 3540610; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 3547035; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 3555567; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 3615765; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 3637299; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 3833338; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 4015435; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 4038617; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 4144439; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 4181677; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 4182601; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 4263883; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 4309553; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 4327797; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 4693055; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 4746189; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 4754353; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 4759638; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 4802369; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 4948548; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 5098841; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 5132452; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 5241947; code bytes = 30d0 Found XOR loop in file "SoftUpdateb320.exe" at offset 16537; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 37445; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 41886; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 87352; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 151232; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 153755; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 166321; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 210759; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 219275; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 228672; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 278771; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 287351; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 391060; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 421502; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 441547; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 516607; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 602472; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 637437; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 669107; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 691789; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 693699; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 715931; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 910327; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 965929; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 999875; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1030618; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1046201; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1098320; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1107445; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1230290; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1239469; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1261079; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1392518; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1507508; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1598342; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1608835; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1610908; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1625739; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1642576; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1663381; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1724792; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1765936; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1876496; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1922233; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1986457; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 1990101; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 2022969; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 2034652; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 2100336; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 2193468; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 2368773; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 2469073; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 2510591; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 2567011; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 2579301; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 2673791; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 2686916; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 2689252; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 2696623; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 2789681; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 2988503; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 3154033; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 3288603; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 3326521; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 3327005; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 3380920; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 3429218; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 3470929; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 3501947; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 3512625; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 3630742; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 3660621; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 3753592; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 3919942; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 3939920; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 3978734; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 3980648; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 3988892; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4021319; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4027559; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4156754; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4192420; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4232850; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4297655; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4339851; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4443445; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4514090; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4525300; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4549106; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4549112; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4564361; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4690463; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4710830; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4712778; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4810391; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4820851; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4915830; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4918338; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4922742; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4924392; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4924903; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4929582; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4931818; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4942926; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4955938; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4956106; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4970516; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4985934; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 4994642; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 5005262; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 5013219; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 5016552; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 5031325; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 5036754; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 5042679; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 5060983; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 5074923; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 5078675; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 5081824; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 5083439; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 5107631; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 5124545; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 5159413; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 5162394; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 5168407; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 5173571; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 5181710; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 5197180; code bytes = 33c1 Found XOR loop in file "SoftUpdateb320.exe" at offset 42215; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 79338; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 199941; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 262641; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 343990; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 392719; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 410576; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 434257; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 596927; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 654656; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 673310; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 724598; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 740239; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 755313; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 944814; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 995662; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 996386; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 1008277; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 1121024; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 1121534; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 1184934; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 1399025; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 1434973; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 1457573; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 1623821; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 1655697; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 1805634; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 1902786; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 1964027; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 2062716; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 2066264; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 2074885; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 2245549; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 2313431; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 2449319; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 2658713; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 2714992; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 2818656; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 3014406; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 3216103; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 3256021; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 3492613; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 3664290; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 3711302; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 3750961; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 3762926; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 3766359; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 3793715; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 3812851; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 3869735; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 3869914; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 3938364; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 3939191; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 3941003; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 3949560; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 4033328; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 4131208; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 4188749; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 4224304; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 4275731; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 4401323; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 4429955; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 4643012; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 4661088; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 4704320; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 4731517; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 4982820; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 5071253; code bytes = 8030 Found XOR loop in file "SoftUpdateb320.exe" at offset 5083422; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 45033; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 262586; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 324833; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 393037; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 410535; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 424005; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 486765; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 491809; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 636768; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 674216; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 706978; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 733018; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 840933; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 858081; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 911628; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1005927; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1016351; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1019563; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1031892; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1066227; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1111971; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1209754; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1366688; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1417960; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1568843; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1595356; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1622792; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1895246; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1930947; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1981233; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2106812; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2117682; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2157529; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160389; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2189435; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2389243; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2455805; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2472347; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2532011; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2645104; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2714815; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2975710; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3029051; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3044550; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3190660; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3243322; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3292767; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3312599; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3329652; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3355430; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3517193; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3537700; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3540610; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3547035; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3555567; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3615765; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3637299; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3833338; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4015435; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4038617; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4144439; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4181677; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4182601; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4263883; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4309553; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4327797; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4693055; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4746189; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4754353; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4759638; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4802369; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4948548; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5098841; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5132452; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5241947; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 16537; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 37445; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 41886; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 87352; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 151232; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 153755; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 166321; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 210759; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 219275; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 228672; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 278771; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 287351; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 391060; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 421502; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 441547; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 516607; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 602472; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 637437; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 669107; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 691789; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 693699; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 715931; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 910327; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 965929; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 999875; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1030618; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1046201; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1098320; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1107445; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1230290; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1239469; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1261079; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1392518; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1507508; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1598342; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1608835; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1610908; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1625739; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1642576; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1663381; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1724792; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1765936; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1876496; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1922233; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1986457; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1990101; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2022969; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2034652; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2100336; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2193468; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2368773; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2469073; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2510591; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2567011; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2579301; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2673791; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2686916; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2689252; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2696623; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2789681; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2988503; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3154033; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3288603; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3326521; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3327005; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3380920; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3429218; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3470929; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3501947; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3512625; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3630742; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3660621; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3753592; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3919942; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3939920; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3978734; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3980648; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3988892; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4021319; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4027559; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4156754; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4192420; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4232850; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4297655; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4339851; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4443445; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4514090; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4525300; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4549106; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4549112; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4564361; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4690463; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4710830; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4712778; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4810391; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4820851; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4915830; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4918338; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4922742; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4924392; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4924903; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4929582; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4931818; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4942926; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4955938; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4956106; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4970516; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4985934; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4994642; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5005262; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5013219; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5016552; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5031325; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5036754; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5042679; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5060983; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5074923; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5078675; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5081824; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5083439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5107631; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5124545; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5159413; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5162394; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5168407; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5173571; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5181710; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5197180; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 42215; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 79338; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 199941; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 262641; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 343990; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 392719; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 410576; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 434257; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 596927; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 654656; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 673310; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 724598; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 740239; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 755313; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 944814; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 995662; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 996386; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1008277; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1121024; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1121534; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1184934; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1399025; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1434973; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1457573; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1623821; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1655697; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1805634; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1902786; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1964027; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2062716; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2066264; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2074885; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2245549; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2313431; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2449319; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2658713; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2714992; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2818656; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3014406; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3216103; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3256021; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3492613; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3664290; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3711302; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3750961; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3762926; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3766359; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3793715; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3812851; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3869735; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3869914; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3938364; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3939191; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3941003; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3949560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4033328; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4131208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4188749; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4224304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4275731; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4401323; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4429955; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4643012; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4661088; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4704320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4731517; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4982820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5071253; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5083422; code bytes = 80302f:T1e40,"2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000051a7ab77f87f00000000000000000000000000000000000000eb6f055f000000000000000000000050ea6f055f0000001033b977f87f000000000000000000009032b977f87f0000040000000000000000005c0b960100000000000000000000c0855d0b9601000018eb6f055f00000076c5ad77f87f00000000000000000000000000000000000000ef6f055f0000000000000000000000f0ea6f055f000000650073007300740000007200000000000300000000000000080000000f00000001000000f87f0000c0855d0b96010000006c5d0b0f00000018eb6f055f000000c3f0a877f87f0000502b5d0b96010000e884a977f87f000040d55d0b (UID: 00000000-00004856) "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004856) "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004856) "sc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007892) "sc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008096) "sc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005908) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004604) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004604) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac5476f87f0000000000000000000051edac77f87f000000000000e70100000000000000000000fe5a4162604d00002a0000000000000070d436f3e70100008fecac77f87f0000e0ac5476f87f0000e0ac5476f87f0000000000000000000000000000f87f0000ffffff7fdadf000000000000000000000000000000000000d8ce4876f87f00002a0000000000000069c30176f87f00003100000000000000d003000000000000d403000000000000110001100000000080d21f810b00000003a3a675f87f000080d21f810b00000000000000000000002b00000000000000000000000000000020b00776f87f0000b43f0676f87f0000e0ce4876 (UID: 00000000-00004604) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000004000000000000000000062f3e70100000b8eaa77f87f0000000062f3e701000002000000f87f000038000000000000004000000000000000300362f3e701000008e0ec810b00000001e0ec810b000000030000000000000001000000000000002200000000000000401147f3e70100000000000000000000000047f3e7010000b8b932f4e7010000000000000000000068000000010000000000000000000000800000000000000004000000000000000000000000000000e8d332f4e701000004000000000000003800000000000000f098a575f87f00003800000000000000380000000000000080e1ec810b000000c00cf041f87f000000000000 (UID: 00000000-00004604) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0bf58f87f000007000000000000000000000000000000010000000000000080ce62f3e70100000000000000000000f0788bf4e70100004c98a575f87f000000b48bf4e7010000b3cee641f87f0000607d8bf4e7010000004fbf58f87f0000d0b0bf58f87f000000000000000000000000000000000000607d8bf4e701000080ce62f3e7010000e0928bf4e7010000d8e1ec810b0000004c98a575f87f00000100000000000000d8e1ec810b000000e0928bf4e7010000607d8bf4e7010000010000000000000002bce641f87f000090808bf4e7010000e0ba89f4e7010000feffffff040000007df0be58f87f000040948bf4 (UID: 00000000-00004604) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000007000000000000000000000000000000010000000000000080ce62f3e70100000000000000000000f0788bf4e70100004c98a575f87f000080a68bf4e7010000b3cee641f87f0000a0798bf4e7010000384fbf58f87f0000d0b0bf58f87f000000000000000000000000000000000000a0798bf4e701000080ce62f3e7010000e0928bf4e7010000d0e1ec810b0000004c98a575f87f00000100000000000000d0e1ec810b000000e0928bf4e7010000a0798bf4e7010000010000000000000002bce641f87f00000000000000000000e0ba89f4e701000090808bf404000000feffffffffffffff80ce62f3e70100007df0be58f87f000000000000 (UID: 00000000-00004604)30:Ta54,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004604) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000f8c0e474f87f000000009358f87f00000000000000000000000000000000000008069458f87f00000001000000000000f098a575f87f000000010000000000000001000000000000000000000000000000069458f87f000001000000000000000f189358f87f0000000000000000000000069458f87f000009000000 (UID: 00000000-00004604) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003404) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008064) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001460) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001380) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000064006f007700730050006f007700650072005300680065006c006c005c00760031002e0030005c003b0043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c006e0076006d003b0043003a005c0050007200 (UID: 00000000-00004192)31:T461,"2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "sc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")32:T14744,"powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00004604) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00008064) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00001460) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00001380) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00004192) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004192)33:T1203,"\REGISTRY\MACHINE\SOFTWARE\Classes" in Source: 00000000-00004856.00000001.288222.4023A000.00000020.mdmp "\Registry\Machine\Software\Classes\" in Source: 00000000-00004856.00000001.288222.4023A000.00000020.mdmp "RY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00001380.00000000.293667.14380000.00000004.mdmp 00000000-00001380.00000001.294642.143A6000.00000004.mdmp "ACHINE\SOFTWARE\Classes\AppID\powershell.exe" in Source: 00000000-00001380.00000000.293667.2D2E0000.00000004.mdmp 00000000-00001380.00000001.294642.2D2E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001380.00000000.293667.2D2E0000.00000004.mdmp 00000000-00001380.00000001.294642.2D2E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001380.00000000.293667.2D2E0000.00000004.mdmp 00000000-00001380.00000001.294642.2D2E0000.00000004.mdmp "DPv\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E" in Source: 00000000-00001380.00000000.293667.2D2E0000.00000004.mdmp 00000000-00001380.00000001.294642.2D2E0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}P\DESKTOP-FV" in Source: 00000000-00001380.00000000.293667.2D2E0000.00000004.mdmp 00000000-00001380.00000001.294642.2D2E0000.00000004.mdmp "win\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001380.00000000.293667.2D2E0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6{" in Source: 00000000-00001380.00000000.293667.2D2E0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\C_" in Source: 00000000-00001380.00000001.294642.2D9DC000.00000004.mdmp "RY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00001460.00000000.292481.19840000.00000004.mdmp 00000000-00001460.00000001.293289.19840000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B0-000000000046}" in Source: 00000000-00001460.00000000.292481.19840000.00000004.mdmp 00000000-00001460.00000001.293289.19840000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001460.00000000.292481.19840000.00000004.mdmp 00000000-00001460.00000001.293289.19840000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\AppID\powershell.exe" in Source: 00000000-00001460.00000000.292481.19840000.00000004.mdmp 00000000-00001460.00000001.293289.19840000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001460.00000000.292481.19840000.00000004.mdmp 00000000-00001460.00000001.293289.19840000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001460.00000000.292481.32B50000.00000004.mdmp 00000000-00001460.00000001.293289.32B50000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001460.00000000.292481.33200000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00001460.00000000.292481.33200000.00000004.mdmp "REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00001460.00000000.292481.33200000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001460.00000000.292481.33200000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001460.00000000.292481.33200000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00001460.00000000.292481.41EB8000.00000002.mdmp "HKLM\" in Source: 00000000-00001460.00000000.292481.41EB8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00001460.00000000.292481.41EB8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001460.00000000.292481.41EB8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00001460.00000000.292481.41EB8000.00000002.mdmp34:T8eb,Process nslookup.exe created mutex with name "\BaseNamedObjects\DC8084751BD68306" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1476:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1476:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\ChromeProcessSingletonStartup!" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SessionImmersiveColorMutex" Process msedge.exe created mutex with name "Local\SM0:1476:304:WilStaging_02" Process msedge.exe created mutex with name "SM0:1476:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SessionImmersiveColorMutex" Process msedge.exe created mutex with name "ChromeProcessSingletonStartup!" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4352:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4352:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:4352:304:WilStaging_02" Process msedge.exe created mutex with name "SM0:4352:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4344:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\mfx_d3d_mutex" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4344:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:4344:304:WilStaging_02" Process msedge.exe created mutex with name "mfx_d3d_mutex" Process msedge.exe created mutex with name "SM0:4344:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3584:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3584:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:3584:304:WilStaging_02" Process msedge.exe created mutex with name "SM0:3584:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7300:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7300:304:WilStaging_02"35:T120a,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]36:T4672,"RY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00001380.00000000.293667.14380000.00000004.mdmp "ACHINE\SOFTWARE\Classes\AppID\powershell.exe" in Source: 00000000-00001380.00000000.293667.2D2E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001380.00000000.293667.2D2E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001380.00000000.293667.2D2E0000.00000004.mdmp "DPv\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E" in Source: 00000000-00001380.00000000.293667.2D2E0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}P\DESKTOP-FV" in Source: 00000000-00001380.00000000.293667.2D2E0000.00000004.mdmp "win\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001380.00000000.293667.2D2E0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6{" in Source: 00000000-00001380.00000000.293667.2D2E0000.00000004.mdmp "RY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00001380.00000001.294642.143A6000.00000004.mdmp "ACHINE\SOFTWARE\Classes\AppID\powershell.exe" in Source: 00000000-00001380.00000001.294642.2D2E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001380.00000001.294642.2D2E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001380.00000001.294642.2D2E0000.00000004.mdmp "DPv\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E" in Source: 00000000-00001380.00000001.294642.2D2E0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}P\DESKTOP-FV" in Source: 00000000-00001380.00000001.294642.2D2E0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\C_" in Source: 00000000-00001380.00000001.294642.2D9DC000.00000004.mdmp "RY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00001460.00000000.292481.19840000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B0-000000000046}" in Source: 00000000-00001460.00000000.292481.19840000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001460.00000000.292481.19840000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\AppID\powershell.exe" in Source: 00000000-00001460.00000000.292481.19840000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001460.00000000.292481.19840000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001460.00000000.292481.32B50000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001460.00000000.292481.33200000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00001460.00000000.292481.33200000.00000004.mdmp "REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00001460.00000000.292481.33200000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001460.00000000.292481.33200000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001460.00000000.292481.33200000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00001460.00000000.292481.41EB8000.00000002.mdmp "HKLM\" in Source: 00000000-00001460.00000000.292481.41EB8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00001460.00000000.292481.41EB8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001460.00000000.292481.41EB8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00001460.00000000.292481.41EB8000.00000002.mdmp "RY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00001460.00000001.293289.19840000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B0-000000000046}" in Source: 00000000-00001460.00000001.293289.19840000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001460.00000001.293289.19840000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\AppID\powershell.exe" in Source: 00000000-00001460.00000001.293289.19840000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001460.00000001.293289.19840000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001460.00000001.293289.32B50000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\9" in Source: 00000000-00001460.00000001.293289.32C46000.00000004.mdmp "RY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00003404.00000000.290068.6C610000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003404.00000000.290068.6C610000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003404.00000000.290068.6D360000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00003404.00000000.290068.6D360000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00003404.00000000.290068.6D360000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003404.00000000.290068.6D360000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003404.00000000.290068.6D360000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0000032A-0000-0000-C000-000000000046}" in Source: 00000000-00003404.00000000.290068.6D360000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0000032A-0000-0000-C000-000000000046}" in Source: 00000000-00003404.00000000.290068.6D360000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0000034E-0000-0000-C000-000000000046}" in Source: 00000000-00003404.00000000.290068.6D360000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShel\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0000034E-0000-0000-C000-000000000046}" in Source: 00000000-00003404.00000000.290068.6D360000.00000004.mdmp "USERPROFILE=C:\WINDOWS\system32\con\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0000034E-0000-0000-C000-000000000046}DOWS" in Source: 00000000-00003404.00000000.290068.6D360000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00003404.00000000.290068.6D360000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00003404.00000000.290068.6D360000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003404.00000000.290068.6DD80000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00003404.00000001.290908.23CEA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00003404.00000001.290908.23CEA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00003404.00000001.290908.23CEA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00003404.00000001.290908.23CEA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00003404.00000001.290908.23CEA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003404.00000001.290908.23CEA000.00000002.mdmp "RY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00003404.00000001.290908.6C6BE000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003404.00000001.290908.6C6BE000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003404.00000001.290908.6D362000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00003404.00000001.290908.6D362000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00003404.00000001.290908.6D362000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003404.00000001.290908.6D362000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003404.00000001.290908.6D362000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0000034E-0000-0000-C000-000000000046}" in Source: 00000000-00003404.00000001.290908.6D362000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShel\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0000034E-0000-0000-C000-000000000046}" in Source: 00000000-00003404.00000001.290908.6D362000.00000004.mdmp "USERPROFILE=C:\WINDOWS\system32\con\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0000034E-0000-0000-C000-000000000046}DOWS" in Source: 00000000-00003404.00000001.290908.6D362000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00003404.00000001.290908.6D362000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00003404.00000001.290908.6D362000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004192.00000000.295023.F0750000.00000004.mdmp "ripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2F03A33-21F5-47FA-B4B" in Source: 00000000-00004192.00000000.295023.F0750000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\AppID\powershell.exe" in Source: 00000000-00004192.00000000.295023.F0750000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004192.00000000.295023.F0750000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00004192.00000000.295023.F16A0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00004192.00000000.295023.F16A0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004192.00000000.295023.F16A0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004604.00000000.288608.23CEA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004604.00000000.288608.23CEA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004604.00000000.288608.23CEA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004604.00000000.288608.23CEA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004604.00000000.288608.23CEA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004604.00000000.288608.23CEA000.00000002.mdmp "Y\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004604.00000000.288608.F32A0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004604.00000000.288608.F32A0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004604.00000000.288608.F4260000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004604.00000000.288608.F4990000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00004604.00000000.288608.F4990000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004604.00000000.288608.F4990000.00000004.mdmp "INE\Software\WOW6432Node@" in Source: 00000000-00004604.00000000.288608.F4990000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004604.00000001.289690.F32A0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004604.00000001.289690.F32A0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004604.00000001.289690.F4260000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004604.00000001.289690.F4990000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004604.00000001.289690.F4990000.00000004.mdmp "INE\Software\WOW6432Node@" in Source: 00000000-00004604.00000001.289690.F4990000.00000004.mdmp "#\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004604.00000001.289690.F4AA5000.00000004.mdmp "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004856.00000000.287825.0B5C0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes" in Source: 00000000-00004856.00000001.288222.4023A000.00000020.mdmp "\Registry\Machine\Software\Classes\" in Source: 00000000-00004856.00000001.288222.4023A000.00000020.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{C2F03A33-21F5-47FA-B4B0-000000000046}" in Source: 00000000-00008064.00000000.291286.35860000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008064.00000000.291286.35860000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008064.00000000.291286.4E7C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008064.00000000.291286.4E7C0000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00008064.00000000.291286.4EE70000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0000034E-0000-0000-C000-000000000" in Source: 00000000-00008064.00000000.291286.4EE70000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00008064.00000000.291286.4EE70000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6" in Source: 00000000-00008064.00000000.291286.4EE70000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00008064.00000000.291286.4EE70000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00008064.00000000.291286.4EE70000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{C2F03A33-21F5-47FA-B4B0-000000000046}" in Source: 00000000-00008064.00000001.292103.35860000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008064.00000001.292103.35860000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008064.00000001.292103.4E7C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008064.00000001.292103.4E7C0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6" in Source: 00000000-00008064.00000001.292103.4EE70000.00000004.mdmp "\SOFTWARE\C>" in Source: 00000000-00008064.00000001.292103.4EE70000.00000004.mdmp37:T29cf,"GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Date: Sat 29 Aug 2026 14:29:01 GMT Server: nginx X-Service-Version: v1 X-Served-By: cache-lax-kwhp1940121-LAX P3p: policyref="http://trc.taboola.com/p3p.xml" CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Pragma: no-cache X-Cache-Hits: 0 Via: 1.1 varnish Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Fastly-To-Nlb-Rtt: 43520 X-Timer: S1788013741.284590 VS0 VE45 X-Cache: MISS X-Vcl-Time-Ms: 45 Cache-Control: no-cache no-store Accept-Ranges: bytes with no response body "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2 Host: px.ads.linkedin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67" Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Sat 29 Aug 2026 14:29:01 GMT Server: cloudflare X-Li-Fabric: prod-lva1 Cf-Ray: a32c3edb097f4c71-SJC Vary: Accept-Encoding X-Li-Proto: http/2 Content-Encoding: gzip Cf-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=31536000 Set-Cookie: __cf_bm=qjRADQ5Cz_3Rhi6fTUoYmfUDNvzaWc_Cg6GeMGmVM.0-1788013741.2835152-1.0.1.1-Q2XE3uQKz.kYbzPhBxengn.KVMoI1lBdKrRcbpcjP3NT1VBcqNqQzDL2WHYPJ7Z_E9FT17BpF1TxZOp8Q0GJFgJujRLzuackQF32RD_3LsJc2RCUbvonpq2SyjGM9cWT; HttpOnly; SameSite=None; Secure; Path=/; Domain=linkedin.com; Expires=Sat 29 Aug 2026 14:59:01 GMT X-Li-Uuid: AAZaMGPnrBTA/p5IgDZcew== Nel: {"report_to":"network-errors" "max_age":1296000 "success_fraction":0.00066 "failure_fraction":1 "include_subdomains":true} X-Content-Type-Options: nosniff X-Li-Pop: cf-prod-lva1-x Report-To: {"group":"network-errors" "max_age":2592000 "endpoints":[{"url":"https://www.linkedin.com/li/rep"}] "include_subdomains":true} Alt-Svc: h3=":443"; ma=86400 Linkedin-Action: 1 with response body ==>BINARY_CONTENT....... "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 307 Temporary Redirect Content-Type: text/html; charset=utf-8 Date: Sat 29 Aug 2026 14:29:11 GMT Server: nginx/1.25.5 Set-Cookie: uuid2=2343736397587995795; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri 27-Nov-2026 14:29:11 GMT; Domain=.adnxs.com; Secure; HttpOnly Expires: Sat 15 Nov 2008 16:00:00 GMT X-Xss-Protection: 0 An-X-Request-Uuid: b1ceb82f-f741-4a78-bde3-d46c1786f4fa X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 900.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; *.adnxs.com Location: https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D Cache-Control: no-store no-cache private P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness with no response body "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: uuid2=2343736397587995795 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 302 Found Content-Type: text/html; charset=utf-8 Date: Sat 29 Aug 2026 14:29:11 GMT Server: nginx/1.25.5 Expires: Sat 15 Nov 2008 16:00:00 GMT An-X-Request-Uuid: 2bbe0a67-a335-42fe-aa76-ca2795498a07 P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness Access-Control-Allow-Origin: * Set-Cookie: uuid2=2343736397587995795; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri 27-Nov-2026 14:29:11 GMT; Domain=.adnxs.com; Secure; HttpOnly Access-Control-Allow-Credentials: true X-Xss-Protection: 0 X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 900.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; *.adnxs.com Location: https://m.adnxs.com/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D Cache-Control: no-store no-cache private with no response body "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: anj=dTM7k!M4/8CxrEQF']wIg2Ilkj.Eu@!]tbP6j2F-XstGt!@DW#$e HTTP/2 302 Found Content-Type: text/html; charset=utf-8 Date: Sat 29 Aug 2026 14:29:11 GMT Server: nginx/1.25.5 Expires: Sat 15 Nov 2008 16:00:00 GMT An-X-Request-Uuid: 6687ee64-449f-4580-afe8-86262ff63e09 P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness Access-Control-Allow-Origin: * Set-Cookie: uuid2=2343736397587995795; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri 27-Nov-2026 14:29:11 GMT; Domain=.adnxs.com; Secure; HttpOnly Access-Control-Allow-Credentials: true X-Xss-Protection: 0 X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 900.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; *.adnxs.com Location: https://ib.adnxs.com/setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= Cache-Control: no-store no-cache private with no response body "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2 Host: ib.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: anj=dTM7k!M4/8D>6NRF']wIg2Ilkj.Eu@!fss0=Ir4A3KL9D3I?-nEMImg Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/gif Date: Sat 29 Aug 2026 14:29:11 GMT Server: nginx/1.25.5 Set-Cookie: uuid2=2343736397587995795; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri 27-Nov-2026 14:29:11 GMT; Domain=.adnxs.com; Secure; HttpOnly Expires: Sat 15 Nov 2008 16:00:00 GMT X-Xss-Protection: 0 An-X-Request-Uuid: d20105ec-2d64-4c49-a347-82a15d712d41 X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 900.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; *.adnxs.com Cache-Control: no-store no-cache private P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness with no response body38:T3dec,"2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff85f100000 "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" loaded module "NTDLL.DLL" at base 7ff877a80000 "sc.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff85f100000 "sc.exe" loaded module "RPCRT4.DLL" at base 7ff8754c0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff85f100000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff874fd0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8740e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8740e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8740e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff852f30000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff875800000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff873e60000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff86c0b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff848910000 "powershell.exe" loaded module "USER32.DLL" at base 7ff877860000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff8740e0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff8595f0000 "powershell.exe" loaded module "NTDLL" at base 7ff877a80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff8751b0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff8750a0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff8754c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff847250000 "powershell.exe" loaded module "OLE32.DLL" at base 7ff8758e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff8751b0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff875e90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff8465e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff845b60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff850c80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff873210000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff874b50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff843af0000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff8751b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff8751b0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff877a80000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff875a30000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff875f60000 "powershell.exe" loaded module "WINTRUST.DLL" at base 1e7f4360000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 1e7f4360000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff874d20000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff859580000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff86c0b0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff858be0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff874d20000 "powershell.exe" loaded module "KERNEL32" at base 7ff8750a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\E75RE4BF.DLL" at base 7ff858b90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff850a10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff843980000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff843810000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ff842ea0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff8425f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff842280000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ff8587a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff8740e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff842130000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff855360000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff842050000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff854cf0000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff86b330000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff841f10000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff873cd0000 "powershell.exe" loaded module "WLDP.DLL" at base 7ff872e30000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff841e30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff8750a0000 "powershell.exe" loaded module "USERENV.DLL" at base 7ff873d00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff874fd0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff8751b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff860a00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff858930000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ff854390000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 7ff8605e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 7ff85f680000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 7ff85f680000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\5F64880C86C98E7DDECDF28E61917307\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ff841b30000 "powershell.exe" loaded module "URLMON.DLL" at base 7ff8691e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff8740e0000 "powershell.exe" loaded module "MSISO.DLL" at base 7ff866d80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 7ff841a70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff840d60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff854360000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff873930000 "powershell.exe" loaded module "OLEAUT32" at base 7ff875e90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff840b20000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ff8740e0000 "powershell.exe" loaded module "MSVCRT.DLL" at base 7ff875a40000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ff860370000 "powershell.exe" loaded module "MI.DLL" at base 7ff86c3f0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ff8740e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ff86c360000 "powershell.exe" loaded module "GDI32.DLL" at base 7ff8779f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff8740e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff86abf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff869a10000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff8740e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff8740e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff867060000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7ff8750a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7ff8740e0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff859600000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff85f0f0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 22b6d0e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 22b6d0e0000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff8595e0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff859580000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\E75RE4BF.DLL" at base 7ff858bb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff842f60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ff8425f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff841ff0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff841f10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff841bf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\5F64880C86C98E7DDECDF28E61917307\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ff841b40000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ff860a00000 "powershell.exe" loaded module "WINTRUST.DLL" at base 23c4e8c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 23c4e8c0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 1fa1a4f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 1fa1a4f0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 22b2d220000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 22b2d220000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff855390000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff847310000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff8466a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff845c20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff852f30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff843bb0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 18df1180000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 18df1180000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff850c90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff843a40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff8438d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff843020000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ff8426b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff842340000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff8421f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff854360000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff8420b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff841fd0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff841ef0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff841cb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\5F64880C86C98E7DDECDF28E61917307\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ff84a090000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ff8665f000039:T574,"powershell.exe" touched "WBEM Locator" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32")3a:T11cc,Process "sc.exe" (UID: 00000000-00007892) was launched with new environment variables: "USERDNSDOMAIN="kI3aQiIfQUVHFMb"" Process "sc.exe" (UID: 00000000-00007892) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "nslookup.exe" (UID: 00000000-00002688) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP, NUMBER_OF_PROCESSORS" Process "nslookup.exe" (UID: 00000000-00002688) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, USERDNSDOMAIN, HOMEPATH, HOMEDRIVE" Process "msedge.exe" (UID: 00000000-00001476) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", OneDrive="%USERPROFILE%\OneDrive", USERDNSDOMAIN="DESKTOP-FVVF82A", HOMEPATH="\Users\oDPvG4e", HOMEDRIVE="C:"" Process "msedge.exe" (UID: 00000000-00001476) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "msedge.exe" (UID: 00000000-00002356) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_1476_NXGZYRIZXAHBUYGX", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="1476"" Process "msedge.exe" (UID: 00000000-00004352) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="7", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00003344) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "powershell.exe" (UID: 00000000-00004192) was launched with new environment variables: "NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="WORKGROUP", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", APPDATA="%WINDIR%\system32\config\systemprofile\AppData\Roaming", USERNAME="DESKTOP-FVVF82A$", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="kI3aQiIfQUVHFMb", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="%WINDIR%\system32\config\systemprofile", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS"" Process "powershell.exe" (UID: 00000000-00004192) was launched with modified environment variables: "LOCALAPPDATA, Path, TEMP, TMP" Process "powershell.exe" (UID: 00000000-00004192) was launched with missing environment variables: "EDGE_CRASHPAD_PIPE_NAME, COMPONENT_INSTALLER_DIR, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007300) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_1476_NXGZYRIZXAHBUYGX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERDNSDOMAIN="DESKTOP-FVVF82A", HOMEPATH="\Users\oDPvG4e", HOMEDRIVE="C:", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753", EDGE_BROWSER_PID="1476"" Process "msedge.exe" (UID: 00000000-00007300) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP"3b:Tf96,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00004604-00000C2E-133295460] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00004604-00000C2B-3502635400] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00004604-00000C2B-3502688113] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004604-00000C2B-3502723968] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00004604-00000C2B-3502828920] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00004604-00000C2B-3502849882] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004604-00000C2B-3502871846] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00004604-00000C2B-3502895576] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00004604-00000C2B-3502935902] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00004604-00000C2B-3502962293] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00004604-00000C2B-3503009914] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00004604-00000C2B-3503092996] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00004604-00000C2B-3503135667] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004604-00000C2B-3503229053] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00004604-00000C2B-3503229242] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00004604-00000C2B-3503301288] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00004604-00000C2B-3503456496] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004604-00000C2B-3503627479] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00004604-00000C2B-3503645327] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00004604-00000C2B-3503672796] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00004604-00000C2B-3503727066] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00004604-00000C2B-3503768616] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00004604-00000C2B-3503881567] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00004604-00000C2B-3503908830] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00004604-00000C2B-3503988943]3c:T8f0,Spawned process "sc.exe" with commandline "delete "CheckManagerAgent_f549"" (UID: 00000000-00007892) Spawned process "sc.exe" with commandline "create "CheckManagerAgent_f549" binpath= "%ALLUSERSPROFILE%\\Mic ..." (UID: 00000000-00008096), Spawned process "sc.exe" with commandline "start "CheckManagerAgent_f549"" (UID: 00000000-00005908), Spawned process "nslookup.exe" (UID: 00000000-00002688), Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath $env:UserProfile -Force" (UID: 00000000-00004604), Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath $env:ProgramData -Force" (UID: 00000000-00003404), Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath $env:TEMP -Force" (UID: 00000000-00008064), Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionExtension '.exe' -Force" (UID: 00000000-00001460), Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionExtension '.sys' -Force" (UID: 00000000-00001380), Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00001476), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00002356) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00004352) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00004344) Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00003344) Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00003424) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003584) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionProcess 'nslookup.exe' -Force" (UID: 00000000-00004192) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00007300)3d:T8f0,Spawned process "sc.exe" with commandline "delete "CheckManagerAgent_f549"" (UID: 00000000-00007892) Spawned process "sc.exe" with commandline "create "CheckManagerAgent_f549" binpath= "%ALLUSERSPROFILE%\\Mic ..." (UID: 00000000-00008096), Spawned process "sc.exe" with commandline "start "CheckManagerAgent_f549"" (UID: 00000000-00005908), Spawned process "nslookup.exe" (UID: 00000000-00002688), Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath $env:UserProfile -Force" (UID: 00000000-00004604), Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath $env:ProgramData -Force" (UID: 00000000-00003404), Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath $env:TEMP -Force" (UID: 00000000-00008064), Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionExtension '.exe' -Force" (UID: 00000000-00001460), Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionExtension '.sys' -Force" (UID: 00000000-00001380), Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00001476), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00002356) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00004352) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00004344) Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00003344) Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00003424) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003584) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionProcess 'nslookup.exe' -Force" (UID: 00000000-00004192) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00007300)3e:T11c0,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 7C:E3:9C:5F:CE:6A:EE:88:A8:A0:72:EA:C4:AC:A3:DE:22:EA:5E:CF; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 ECC CA OCSP 02, O=Microsoft Corporation, C=US" (SHA1: 22:F0:A7:3D:5B:63:A2:0B:38:9D:62:F1:0E:B0:98:33:BA:F2:E8:4A; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS ECC Root G2, O=Microsoft Corporation, C=US" (SHA1: 33:6D:3E:54:51:31:52:94:F6:E1:E7:CF:DA:84:E5:1C:8B:1E:40:54; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7F:A0:5A:CF:9B:4A:AB:B0:DE:0C:FA:FA:29:7D:DF:92:FD:C5:F3:F5; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7E:04:DE:89:6A:3E:66:6D:00:E6:87:D3:3F:FA:D9:3B:E8:3D:34:9E; see report for more information) The input sample is signed with a certificate issued by "CN=GeoTrust TLS ECC CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: C6:A7:9F:4F:A3:32:C1:3F:51:DB:C6:1F:5D:2B:37:2F:71:ED:6B:69; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: BF:E7:BA:21:A2:FA:56:71:9B:61:F6:4E:E1:B2:69:D0:B8:0B:44:E5; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 9B:11:B0:70:AE:60:F2:0E:B2:4D:34:65:C9:F8:5D:33:2F:37:89:2F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1D:73:22:B4:1E:D9:9F:DD:68:51:1B:AB:78:6C:8E:26:E0:83:1B:3B; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 8B:F7:F1:78:A7:45:A1:1B:AC:6A:E5:B5:86:FC:18:38:EA:DC:B2:CF; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: E7:EE:B5:EE:F1:6C:63:04:8D:25:D4:EF:A2:EF:20:DF:18:61:AD:CC; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: 27:E6:66:32:99:D3:40:DF:E5:45:71:CE:CC:EC:01:BE:74:49:5D:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB" (SHA1: 48:62:BA:29:DB:48:52:50:EC:DE:95:62:15:70:58:A6:E2:13:BC:AE; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB" (SHA1: DD:55:B4:52:02:91:E2:76:58:8F:0D:D0:2F:AF:D8:3A:73:68:E0:FA; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:18:94:7A:6A:9F:C7:76:4F:D8:B5:FB:18:A8:63:B0:C6:DA:C2:4F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 7B:40:95:9C:A6:F3:08:E5:89:4E:40:4C:00:30:B1:DF:B8:63:30:45; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information)3f:T87a,"powershell.exe" writes to a file "C:\Windows\Temp\__PSScriptPolicyTest_eep2kpkd.t35.ps1" "powershell.exe" writes to a file "C:\Windows\Temp\__PSScriptPolicyTest_wvjvwlpt.b32.psm1" "powershell.exe" writes to a file "%WINDIR%\Temp\__PSScriptPolicyTest_eep2kpkd.t35.ps1" "powershell.exe" writes to a file "%WINDIR%\Temp\__PSScriptPolicyTest_wvjvwlpt.b32.psm1" "powershell.exe" writes to a file "C:\Windows\Temp\__PSScriptPolicyTest_rp1ycrh1.kks.ps1" "powershell.exe" writes to a file "C:\Windows\Temp\__PSScriptPolicyTest_0hgeexpc.et0.psm1" "powershell.exe" writes to a file "%WINDIR%\Temp\__PSScriptPolicyTest_rp1ycrh1.kks.ps1" "powershell.exe" writes to a file "%WINDIR%\Temp\__PSScriptPolicyTest_0hgeexpc.et0.psm1" "powershell.exe" writes to a file "C:\Windows\Temp\__PSScriptPolicyTest_qyzlsnex.jdk.ps1" "powershell.exe" writes to a file "C:\Windows\Temp\__PSScriptPolicyTest_jyrr03h4.2ro.psm1" "powershell.exe" writes to a file "%WINDIR%\Temp\__PSScriptPolicyTest_qyzlsnex.jdk.ps1" "powershell.exe" writes to a file "%WINDIR%\Temp\__PSScriptPolicyTest_jyrr03h4.2ro.psm1" "powershell.exe" writes to a file "C:\Windows\Temp\__PSScriptPolicyTest_yqfz4e0j.csm.ps1" "powershell.exe" writes to a file "C:\Windows\Temp\__PSScriptPolicyTest_r1npv3wa.urk.psm1" "powershell.exe" writes to a file "%WINDIR%\Temp\__PSScriptPolicyTest_yqfz4e0j.csm.ps1" "powershell.exe" writes to a file "%WINDIR%\Temp\__PSScriptPolicyTest_r1npv3wa.urk.psm1" "powershell.exe" writes to a file "C:\Windows\Temp\__PSScriptPolicyTest_must3eiz.2nl.ps1" "powershell.exe" writes to a file "C:\Windows\Temp\__PSScriptPolicyTest_w2ggdey3.nq0.psm1" "powershell.exe" writes to a file "%WINDIR%\Temp\__PSScriptPolicyTest_must3eiz.2nl.ps1" "powershell.exe" writes to a file "%WINDIR%\Temp\__PSScriptPolicyTest_w2ggdey3.nq0.psm1" "powershell.exe" writes to a file "C:\Windows\Temp\__PSScriptPolicyTest_5quk2wkg.z2f.ps1" "powershell.exe" writes to a file "C:\Windows\Temp\__PSScriptPolicyTest_iyd0unap.lxk.psm1" "powershell.exe" writes to a file "%WINDIR%\Temp\__PSScriptPolicyTest_5quk2wkg.z2f.ps1" "powershell.exe" writes to a file "%WINDIR%\Temp\__PSScriptPolicyTest_iyd0unap.lxk.psm1"40:T91e,"2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")41:T577,"2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" queries basic process information of the "C:\2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (UID: 4856) "sc.exe" queries basic process information of the "C:\Windows\System32\sc.exe" (UID: 7892) "sc.exe" queries basic process information of the "C:\Windows\System32\sc.exe" (UID: 8096) "sc.exe" queries basic process information of the "C:\Windows\System32\sc.exe" (UID: 5908) "nslookup.exe" queries basic process information of the "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (UID: 2688) "powershell.exe" queries basic process information of the "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (UID: 4604) "powershell.exe" queries basic process information of the "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (UID: 3404) "powershell.exe" queries basic process information of the "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (UID: 8064) "powershell.exe" queries basic process information of the "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (UID: 1460) "powershell.exe" queries basic process information of the "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (UID: 1380) "powershell.exe" queries basic process information of the "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (UID: 4192)42:Tf43,"2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "2D6F773BB869A4F18DC09B8E005F5B0A997EA8A3FCF396F3F8A83A52141A321D"; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "")43:T796,"2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to touch file "C:\WINDOWS\SYSTEM32\apphelp.dll" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to touch file "C:\2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to touch file "C:\Windows\System32\win32u.dll" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to touch file "C:\Windows\System32\ucrtbase.dll" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to touch file "C:\Windows\System32\msvcp_win.dll" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to touch file "C:\Windows\System32\gdi32full.dll" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to touch file "C:\Windows\System32\gdi32.dll" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to touch file "C:\Windows\System32\user32.dll" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to touch file "C:\Windows\System32\imm32.dll" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL"44:Tb30,"2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to access non-existent file "C:\FLTLIB.DLL" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to access non-existent file "C:\MSVCP140.DLL" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\VCRUNTIME140.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140_1.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\VCRUNTIME140_1.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\WINNLSRES.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\SHELL32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.exe" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\WINTRUST.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll"45:Td65,"powershell.exe" trying to access non-existent file "C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\WINDOWSAPPS" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\MODULES" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\Modules" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\MODULEANALYSISCACHE" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PACKAGEMANAGEMENT.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PackageManagement.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PACKAGEMANAGEMENT.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PackageManagement.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PACKAGEMANAGEMENT.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PackageManagement.cdxml"46:T4ae,"2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" writes file "c:\programdata\microsoftlogsbebd9ac8\softupdateb320.exe" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" writes file "c:\programdata\microsoftlogsbebd9ac8\softupdateb320.exe:zone.identifier" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" writes file "%allusersprofile%\microsoftlogsbebd9ac8\softupdateb320.exe:zone.identifier" "2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe" writes file "%allusersprofile%\microsoftlogsbebd9ac8\softupdateb320.exe" "powershell.exe" writes file "c:\windows\temp\__psscriptpolicytest_eep2kpkd.t35.ps1" "powershell.exe" writes file "c:\windows\temp\__psscriptpolicytest_wvjvwlpt.b32.psm1" "powershell.exe" writes file "c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\powershell\moduleanalysiscache" "powershell.exe" writes file "c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "c:\windows\system32\config\systemprofile\appdata\local\microsoft\clr_v4.0\usagelogs\powershell.exe.log"47:T4db,Found http requests in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent=" Found http requests in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent=" Found http requests in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D" Found http requests in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D" Found http requests in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D" Found http requests in header "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent="48:T558,Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00001380.00000000.293667.2D2E0000.00000004.mdmp, 00000000-00001380.00000001.294642.2D2E0000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00001380.00000000.293667.2D2E0000.00000004.mdmp, 00000000-00001380.00000001.294642.2D2E0000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00001460.00000000.292481.19840000.00000004.mdmp, 00000000-00001460.00000001.293289.19840000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00001460.00000000.292481.19840000.00000004.mdmp, 00000000-00001460.00000001.293289.19840000.00000004.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00001460.00000000.292481.41EB8000.00000002.mdmp")49:T12b9,Pattern match: "msn.com/en-us/news/other/.../ar-aa2auvbs" Pattern match: "https://ntp.msn.com/edge/ntp?locale=en-us&title=|" Heuristic match: "w{.gy" Heuristic match: "tp.gi" Heuristic match: "pds^.np" Heuristic match: "trc.taboola.com" Heuristic match: "px.ads.linkedin.com" Heuristic match: "m.adnxs.com" Heuristic match: "ib.adnxs.com" Heuristic match: "clients2.googleusercontent.com" Heuristic match: "edge-consumer-static.azureedge.net" Heuristic match: "r.msftstatic.com" Heuristic match: "sb.scorecardresearch.com" Heuristic match: "se;.ws" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "oft.as" Heuristic match: "ntrust.net" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "http://www.microsoft.com/pki" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "9.15.cat" Heuristic match: "ckage~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "microsoft.net/assembly/gac_64/microsoft.management.infrastructure.native/v4.0_1.0.0.0__31bf3856ad364e35/microsoft.management.infrastructure.native.dll" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://cybertrust.omniroot.com/repository.cfm0" Pattern match: "http://ocsp.omniroot.com/baltimoreroot0" Pattern match: "cdp1.public-trust.com/crl/omniroot2025.crl0" Pattern match: "www.digicert.com1+0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "t.com/fmv" Pattern match: "www.digicert.com1" Pattern match: "http://repository.swisssign.com/0" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "http://www.microsoft.com/windows" Heuristic match: "ystem.windows.fo" Heuristic match: "bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "_64\microsoft.management.in" Pattern match: "http://schemas.microsoft.com/cmdleyg" Pattern match: "ww.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "5.cat" Heuristic match: "tomation.re" Heuristic match: "1.2.840.tg" Pattern match: "http://www.microsoft.com/pki/certs/microo" Heuristic match: "t.automation.re" Pattern match: "www.microsoft.co@" Heuristic match: "010-06-23.cr" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&"4a:T14a02,Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0p://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001380.00000000.293667.14560000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiond11.3.6.1.k3-+" - Source: "00000000-00001380.00000000.293667.14560000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001380.00000000.293667.2D2E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lmwi^11.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001380.00000000.293667.2D2E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001380.00000000.293667.2D2E0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportoftware\policies\microsoft\windows" - Source: "00000000-00001380.00000000.293667.2D830000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.120170929063406.466z0washington1redmond1microsoft" - Source: "00000000-00001380.00000000.293667.2D830000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001380.00000000.293667.2D830000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0p://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001380.00000001.294642.14560000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiond11.3.6.1.k3-+" - Source: "00000000-00001380.00000001.294642.14560000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001380.00000001.294642.2D2E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lmwi^11.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001380.00000001.294642.2D2E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001380.00000001.294642.2D355000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0]\mw(e4-+1+0)asycr<-+k;0-+s<-+c5n6c5n6c5n62.5.4.112.5.4.5229879+719555cb-6de2-446c-acba-d90894acd872c5n6c5n6c5n6c5n6c5n6mwa!2m" - Source: "00000000-00001380.00000001.294642.2D930000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4am*p?7-+j4-+0q<-+pb5-+6<-$p\4-+p" - Source: "00000000-00001380.00000001.294642.2D930000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0p://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001460.00000000.292481.19D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiredmonf-c5de1+0)" - Source: "00000000-00001460.00000000.292481.19D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001460.00000000.292481.32B50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00001460.00000000.292481.32B50000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e" - Source: "00000000-00001460.00000000.292481.32B50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00001460.00000000.292481.32B50000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001460.00000000.292481.32B50000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0c9nctiontion120531151137z0/^g(o-cejy" - Source: "00000000-00001460.00000000.292481.32B50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00001460.00000000.292481.32B50000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001460.00000000.292481.32B50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001460.00000000.292481.32B50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001460.00000000.292481.32B50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001460.00000000.292481.32B50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001460.00000000.292481.32B50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001460.00000000.292481.32B50000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00001460.00000000.292481.33100000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.12017*j06.466z0washington1redmond1microsoft" - Source: "00000000-00001460.00000000.292481.33100000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microo7" - Source: "00000000-00001460.00000000.292481.33100000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0washington1redmond1microsoft" - Source: "00000000-00001460.00000000.292481.33100000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.120170929063406.466z0washington1redmond1microsoft" - Source: "00000000-00001460.00000000.292481.33100000.00000004.mdmp") Found URL "http://crl.m.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001460.00000000.292481.33100000.00000004.mdmp") Found URL "http://crl.micrm/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrmicrosoft.powershell.cmdletization.generatedtypesrefemit_inmemorymanifestmodulemscorlibsystemenummapsreportingtypemicrosoft.powershell.cmdletization.generatedtypes.mppreferencevalue__disabledbasicadvancedsubmitsamplesconsenttypenonealwaysnevereverydaysundaymondaytuesdaywednesdaythursdayfridaysaturdayscantypequickscanfullscanscandirectionbothincomingoutcomingthreatseverityunknownmoderatehighseverethreatactioncleanquarantineremoveallowuserdefinednoactionblockpuaprotectiontypeenabledauditmodecloudblockleveltypedefaulthighpluszerotoleranceasrruleactiontypemicrosoft.powershell.cmdletization.generatedtypes.mpscancustomscanupdatesourcemicrosoft.powershell.cmdletization.generatedtypes.mpsignatureinternaldefinitionupdateservermicrosoftupdateservermmpcfileshares1l0j" - Source: "00000000-00001460.00000000.292481.33200000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1l0j" - Source: "00000000-00001460.00000000.292481.33200000.00000004.mdmp") Found URL "http://www.microsoft.com/windows\l" - Source: "00000000-00001460.00000000.292481.33200000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0p://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001460.00000001.293289.19D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiredmonf-c5de1+0)" - Source: "00000000-00001460.00000001.293289.19D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001460.00000001.293289.32B50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00001460.00000001.293289.32B50000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e" - Source: "00000000-00001460.00000001.293289.32B50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00001460.00000001.293289.32B50000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001460.00000001.293289.32B50000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0c9nctiontion120531151137z0/^g(o-cejy" - Source: "00000000-00001460.00000001.293289.32B50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00001460.00000001.293289.32B50000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001460.00000001.293289.32B50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001460.00000001.293289.32B50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001460.00000001.293289.32B50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001460.00000001.293289.32BB6000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001460.00000001.293289.32BB6000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001460.00000001.293289.32BB6000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.12017*j06.466z0washington1redmond1microsoft" - Source: "00000000-00001460.00000001.293289.3312B000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microo" - Source: "00000000-00001460.00000001.293289.3312B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0washington1redmond1microsoft" - Source: "00000000-00001460.00000001.293289.3312B000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.120170929063406.466z0washington1redmond1microsoft" - Source: "00000000-00001460.00000001.293289.3312B000.00000004.mdmp") Found URL "http://crl.m.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001460.00000001.293289.3312B000.00000004.mdmp") Found URL "http://crl.micrm/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.8ps/default.htm0@$vkt7" - Source: "00000000-00003404.00000000.290068.6C970000.00000004.mdmp") Found URL "http://@2010-07-01.crl0z.com/pki/certs/mictimstapca_2010-07-01.c407z" - Source: "00000000-00003404.00000000.290068.6C970000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00003404.00000000.290068.6D360000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003404.00000000.290068.6D360000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lm=m+m=m+3m=m+gm=m+[m=m+om=m+m=m+m=m+m=m+m=m+m=m+m=m+m=m+n=m+" - Source: "00000000-00003404.00000000.290068.6D360000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003404.00000000.290068.6D360000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00003404.00000000.290068.6DC80000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.120170929063406.466z0washington1redmond1microsoft" - Source: "00000000-00003404.00000000.290068.6DC80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003404.00000000.290068.6DC80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrmicrosoft.management.infrastructure.userfilteredexceptionhandlingrefemit_inmemorymanifestmodulemscorlibsystem.diagnosticsdebuggableattributedebuggingmodes.ctorsystem.runtime.compilerservicesruntimecompatibilityattributesystemobjectuserfilteredexceptionhandlingexceptionactioninvokefunc" - Source: "00000000-00003404.00000000.290068.6DD80000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1l0j" - Source: "00000000-00003404.00000000.290068.6DD80000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsme-stampy" - Source: "00000000-00003404.00000000.290068.6DD80000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0at-kt20170929063406.466z0washington1redmond1microsoft" - Source: "00000000-00003404.00000000.290068.6DD80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003404.00000000.290068.6DD80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003404.00000000.290068.6DD80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/m" - Source: "00000000-00003404.00000000.290068.6DD80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr" - Source: "00000000-00003404.00000001.290908.59592000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www." - Source: "00000000-00003404.00000001.290908.6C970000.00000004.mdmp") Found URL "http://@2010-07-01.crl0z.com/pki/certs/mictimstapca_2010-07-01.c407z" - Source: "00000000-00003404.00000001.290908.6C970000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00003404.00000001.290908.6D362000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003404.00000001.290908.6D3BF000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lm=m+m=m+3m=m+gm=m+[m=m+om=m+m=m+m=m+m=m+m=m+m=m+m=m+m=m+n=m+" - Source: "00000000-00003404.00000001.290908.6D3BF000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003404.00000001.290908.6D3DE000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrmicrosoft.management.infrastructure.userfilteredexceptionhandlingrefemit_inmemorymanifestmodulemscorlibsystem.diagnosticsdebuggableattributedebuggingmodes.ctorsystem.runtime.compilerservicesruntimecompatibilityattributesystemobjectuserfilteredexceptionhandlingexceptionactioninvokefunc" - Source: "00000000-00003404.00000001.290908.6DD80000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsme-stampy" - Source: "00000000-00003404.00000001.290908.6DD80000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0at-kt20170929063406.466z0washington1redmond1microsoft" - Source: "00000000-00003404.00000001.290908.6DD80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003404.00000001.290908.6DD80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/m" - Source: "00000000-00003404.00000001.290908.6DD80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004192.00000000.295023.F0A00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004192.00000000.295023.F0A00000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e" - Source: "00000000-00004192.00000000.295023.F16A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00004192.00000000.295023.F16A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004192.00000000.295023.F16A0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004192.00000000.295023.F16A0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00004192.00000000.295023.F16A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004192.00000000.295023.F16A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00004192.00000000.295023.F16A0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00004192.00000000.295023.F16A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00004192.00000000.295023.F16A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00004192.00000000.295023.F16A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004192.00000000.295023.F16A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004192.00000000.295023.F16A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fanonymously" - Source: "00000000-00004192.00000000.295023.F16A0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1l0j" - Source: "00000000-00004192.00000000.295023.F16A0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows.ngenameprop-ne" - Source: "00000000-00004192.00000000.295023.F16A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004192.00000000.295023.F16A0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004604.00000000.288608.58BF2000.00000002.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.2.1.15encoderecipientidwvtasn1spclinkencodewvtasn1spclinkencode1.3.6.1.4.1.311.2.1.261.3.6.1.4.1.311.16.1.11.3.6.1.4.1.311.12.2.31.3.6.1.4.1.311.2.1.201.3.6.1.4.1.311.2.1.251.3.6.1.4.1.311.2.1.10encodeattrsequence1.3.6.1.4.1.311.2.1.121.3.6.1.4.1.311.2.1.111.3.6.1.4.1.311.16.40" - Source: "00000000-00004604.00000000.288608.F32A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki7.3." - Source: "00000000-00004604.00000000.288608.F3620000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport:\programdata\microsoft\windows" - Source: "00000000-00004604.00000000.288608.F4890000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004604.00000000.288608.F4890000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004604.00000000.288608.F4890000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004604.00000000.288608.F4890000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.120170929063406.466z0washington1redmond1microsoft" - Source: "00000000-00004604.00000000.288608.F4890000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0^" - Source: "00000000-00004604.00000000.288608.F4990000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004604.00000000.288608.F4A46000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00004604.00000000.288608.F4A46000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!washington1redmond1microsoft" - Source: "00000000-00004604.00000000.288608.F4A46000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00004604.00000000.288608.F4A46000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004604.00000000.288608.F4AA5000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0wrapnonexceptionthrowsrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mb" - Source: "00000000-00004604.00000000.288608.F4AA5000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00004604.00000000.288608.F4AA5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004604.00000000.288608.F4AA5000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0at-kt20170929063406.466z0washington1redmond1microsoft" - Source: "00000000-00004604.00000000.288608.F4AA5000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1l0j" - Source: "00000000-00004604.00000000.288608.F4AA5000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsh^cgh^cg(4rdwt8" - Source: "00000000-00004604.00000000.288608.F4AA5000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.2.1.15encoderecipientidwvtasn1spclinkencodewvtasn1spclinkencode1.3.6.1.4.1.311.2.1.261.3.6.1.4.1.311.16.1.11.3.6.1.4.1.311.12.2.31.3.6.1.4.1.311.2.1.201.3.6.1.4.1.311.2.1.251.3.6.1.4.1.311.2.1.10encodeattrsequence1.3.6.1.4.1.311.2.1.121.3.6.1.4.1.311.2.1.111.3.6.1.4.1.311.16.40" - Source: "00000000-00004604.00000001.289690.F32A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki7.3." - Source: "00000000-00004604.00000001.289690.F3620000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004604.00000001.289690.F4260000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004604.00000001.289690.F4260000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004604.00000001.289690.F4260000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004604.00000001.289690.F4260000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0^" - Source: "00000000-00004604.00000001.289690.F4990000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00004604.00000001.289690.F4A46000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!washington1redmond1microsoft" - Source: "00000000-00004604.00000001.289690.F4A46000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00004604.00000001.289690.F4A46000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004604.00000001.289690.F4AA5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/pr_fictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004604.00000001.289690.F4AA5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/m2010-07-01.crl0zn0l0j>http://www.micro/certs/mictimstapca_2010-07-01.crt0tz?py,mbrb%dh^cgh^cgh^cgh^cgh" - Source: "00000000-00004604.00000001.289690.F4AA5000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004856.00000000.287825.0B5C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008064.00000000.291286.35820000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fmnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008064.00000000.291286.4E7C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00008064.00000000.291286.4E7C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008064.00000000.291286.4E7C0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport:\programdata\microsoft\windows" - Source: "00000000-00008064.00000000.291286.4ED70000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.120170929063406.466z0washington1redmond1microsoft" - Source: "00000000-00008064.00000000.291286.4ED70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008064.00000000.291286.4ED70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/clt.htm0@$vkt7" - Source: "00000000-00008064.00000000.291286.4EE70000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstah" - Source: "00000000-00008064.00000000.291286.4EE70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_bg01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrmnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008064.00000001.292103.4E82B000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00008064.00000001.292103.4E82B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008064.00000001.292103.4E82B000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00008064.00000001.292103.4EE70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_bg01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr6NRF']wIg2Ilkj.Eu@!fss0=Ir4A3KL9D3I?-nEMImg Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image 4c:T1375,Contains base62 string in header "222166F75FD3671F181970045E3D66DC;" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "253D222166F75FD3671F181970045E3D6" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "3D222166F75FD3671F181970045E3D66D" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=2343736397587995795Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "25253D222166F75FD3671F181970045E3" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=2343736397587995795Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "3D222166F75FD3671F181970045E3D66D" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2Ilkj.Eu@!]tbP6j2F-XstGt!@DW#$e6NRF']wIg2Ilkj.Eu@!fss0=Ir4A3KL9D3I?-nEMImg\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nX-Edge-Shopping-Flag: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}],"processes":[{"pid":4856,"ppid":0,"name":"2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe","command_line":"","sha256":"2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d","normalized_path":"C:\\2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d.exe","uid":"00000000-00004856","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7892,"ppid":4856,"name":"sc.exe","command_line":"delete \"CheckManagerAgent_f549\"","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00004856","uid":"00000000-00007892"},{"pid":8096,"ppid":4856,"name":"sc.exe","command_line":"create \"CheckManagerAgent_f549\" binpath= \"%ALLUSERSPROFILE%\\MicrosoftLogsBEBD9AC8\\SoftUpdateb320.exe\" start= \"auto\"","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00004856","uid":"00000000-00008096"},{"pid":5908,"ppid":4856,"name":"sc.exe","command_line":"start \"CheckManagerAgent_f549\"","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00004856","uid":"00000000-00005908"},{"pid":2688,"ppid":0,"name":"nslookup.exe","command_line":"","sha256":"5b3e823a803bc6c3def556789d72b1aa48cc5668473a9e28addb00c728cee78f","normalized_path":"%WINDIR%\\System32\\nslookup.exe","uid":"00000000-00002688","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":4604,"ppid":2688,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath $env:UserProfile -Force","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002688","uid":"00000000-00004604"},{"pid":3404,"ppid":2688,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath $env:ProgramData -Force","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002688","uid":"00000000-00003404"},{"pid":8064,"ppid":2688,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath $env:TEMP -Force","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002688","uid":"00000000-00008064"},{"pid":1460,"ppid":2688,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionExtension '.exe' -Force","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002688","uid":"00000000-00001460"},{"pid":1380,"ppid":2688,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionExtension '.sys' -Force","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002688","uid":"00000000-00001380"},{"pid":4192,"ppid":2688,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionProcess 'nslookup.exe' -Force","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002688","uid":"00000000-00004192"},{"pid":1476,"ppid":0,"name":"msedge.exe","command_line":"--profile-directory=Default","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00001476","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":2356,"ppid":1476,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x320,0x7ff841b00f18,0x7ff841b00f24,0x7ff841b00f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001476","uid":"00000000-00002356"},{"pid":4352,"ppid":1476,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1848,i,10315149539913579864,15533506346332347610,524288 --field-trial-handle=2436,i,12932150639043476148,2628655873796871013,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2464 /prefetch:3","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001476","uid":"00000000-00004352"},{"pid":4344,"ppid":1476,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1684,i,17820441511091941021,385442790186416142,262144 --field-trial-handle=2436,i,12932150639043476148,2628655873796871013,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2432 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001476","uid":"00000000-00004344"},{"pid":3344,"ppid":1476,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1788010064514607 --launch-time-ticks=4611416700 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=2840,i,944612262923396550,15542455751483464535,2097152 --field-trial-handle=2436,i,12932150639043476148,2628655873796871013,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2940 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001476","uid":"00000000-00003344"},{"pid":3424,"ppid":1476,"name":"msedge.exe","command_line":"--type=renderer --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1788010064514607 --launch-time-ticks=4611418006 --skip-read-main-dll --metrics-shmem-handle=2852,i,12759297976200809490,7123830267587885599,2097152 --field-trial-handle=2436,i,12932150639043476148,2628655873796871013,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2960 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001476","uid":"00000000-00003424"},{"pid":3584,"ppid":1476,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=1928,i,5154973659923079901,14321813517134585601,524288 --field-trial-handle=2436,i,12932150639043476148,2628655873796871013,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2908 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001476","uid":"00000000-00003584"},{"pid":7300,"ppid":1476,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=4872,i,5301282394517156056,11698452799731605064,524288 --field-trial-handle=2436,i,12932150639043476148,2628655873796871013,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4900 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001476","uid":"00000000-00007300"}],"all_imported_dlls":["sspicli.dll","urlmon.dll","dhcpcsvc6.dll","oleacc.dll","cryptsp.dll","kernel.appcore.dll","Microsoft.PowerShell.Security.ni.dll","dpapi.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","wkscli.dll","winhttp.dll","rometadata.dll","kernel32.dll","rpcrt4.dll","version.dll","MpOAV.dll","iertutil.dll","netapi32.dll","ResourcePolicyClient.dll","d3d10warp.dll","imm32.dll","VxSSL64.dll","System.Management.Automation.ni.dll","secur32.dll","System.Configuration.ni.dll","Microsoft.Management.Infrastructure.Native.ni.dll","atl.dll","powrprof.dll","nlaapi.dll","CoreUIComponents.dll","shlwapi.dll","winsta.dll","domain_actions.dll","vk_swiftshader.dll","System.Core.ni.dll","System.Transactions.ni.dll","wldp.dll","imagehlp.dll","ncrypt.dll","dxgi.dll","user32.dll","win32u.dll","SHCore.dll","gpapi.dll","amsi.dll","setupapi.dll","d3d11.dll","dcomp.dll","ntmarta.dll","msasn1.dll","netutils.dll","rmclient.dll","msvcp140.dll","slc.dll","comctl32.dll","wbemcomn.dll","apphelp.dll","psapi.dll","msisip.dll","coml2.dll","cryptnet.dll","wtsapi32.dll","RTWorkQ.dll","KernelBase.dll","ucrtbase.dll","combase.dll","advapi32.dll","mi.dll","winmm.dll","dmcmnutils.dll","vcruntime140_1.dll","Microsoft.AppV.AppVClientPowerShell.dll","mscoree.dll","cryptbase.dll","userenv.dll","CoreMessaging.dll","Windows.UI.Immersive.dll","mscms.dll","ole32.dll","rsaenh.dll","System.Management.ni.dll","wshext.dll","nsi.dll","winmmbase.dll","devobj.dll","mf.dll","bcrypt.dll","shell32.dll","msctf.dll","webauthn.dll","Windows.Security.Authentication.Web.Core.dll","actxprxy.dll","sxs.dll","dbghelp.dll","windows.storage.dll","clrjit.dll","wininet.dll","ffmpeg.dll","mscorlib.ni.dll","MpClient.dll","winnsi.dll","TextInputFramework.dll","normaliz.dll","ntasn1.dll","Windows.System.Profile.RetailInfo.dll","OneCoreUAPCommonProxyStub.dll","msvcp_win.dll","msvcrt.dll","System.ni.dll","AppxSip.dll","wmidcom.dll","wbemprox.dll","mdmregistration.dll","twinapi.dll","gdi32full.dll","clr.dll","vcruntime140_clr0400.dll","uxtheme.dll","WinTypes.dll","dnsapi.dll","oneauth.dll","directmanipulation.dll","bcryptprimitives.dll","E75RE4bf.dll","dwmapi.dll","mswsock.dll","System.Xml.ni.dll","msIso.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","DWrite.dll","dhcpcsvc.dll","twinapi.appcore.dll","Windows.UI.dll","libGLESv2.dll","ws2_32.dll","wintrust.dll","crypt32.dll","System.Data.dll","sppc.dll","OpcServices.dll","Microsoft.PowerShell.Commands.Management.ni.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","cfgmgr32.dll","pwrshsip.dll","miutils.dll","fastprox.dll","IPHLPAPI.DLL","propsys.dll","vcruntime140.dll","sechost.dll","System.Numerics.ni.dll","msedge.dll","fltLib.dll","System.Data.ni.dll","Microsoft.AppV.AppvClientComConsumer.dll","System.Configuration.Install.ni.dll","wbemsvc.dll","dsreg.dll","atlthunk.dll","mfplat.dll","profapi.dll","System.DirectoryServices.ni.dll","System.Transactions.dll","KBDUS.DLL","well_known_domains.dll","Microsoft.Management.Infrastructure.ni.dll","xmllite.dll","msedge_elf.dll","rasadhlp.dll","gdi32.dll","ucrtbase_clr0400.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","msvcp110_win.dll","DataExchange.dll","d3dcompiler_47.dll","libEGL.dll","ntdll.dll","oleaut32.dll","mscoreei.dll","clbcatq.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"SoftUpdateb320.exe","sha256":"a143acb85c75e75f943bb839581e4ace2d8751cc6df7b267416eb364151bf6ea","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"powershell.exe.log","sha256":"6fbdc05f0c360b104edcbb0a2ab0d6464d90861b400d6e2a1d65904f99977936","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"ModuleAnalysisCache","sha256":"44b782158dca05e0447c47374ab45dc05dd9750cd05cc01d345925d2154d5439","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"SoftUpdateb320.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]}],"files_written":[{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"%ALLUSERSPROFILE%\\MicrosoftLogsBEBD9AC8\\SoftUpdateb320.exe","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"%ALLUSERSPROFILE%\\MicrosoftLogsBEBD9AC8\\SoftUpdateb320.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"%WINDIR%\\Temp\\__PSScriptPolicyTest_eep2kpkd.t35.ps1","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"%WINDIR%\\Temp\\__PSScriptPolicyTest_wvjvwlpt.b32.psm1","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"%WINDIR%\\Temp\\__PSScriptPolicyTest_rp1ycrh1.kks.ps1","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"%WINDIR%\\Temp\\__PSScriptPolicyTest_0hgeexpc.et0.psm1","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"%WINDIR%\\Temp\\__PSScriptPolicyTest_qyzlsnex.jdk.ps1","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"%WINDIR%\\Temp\\__PSScriptPolicyTest_jyrr03h4.2ro.psm1","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"%WINDIR%\\Temp\\__PSScriptPolicyTest_yqfz4e0j.csm.ps1","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"%WINDIR%\\Temp\\__PSScriptPolicyTest_r1npv3wa.urk.psm1","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"%WINDIR%\\Temp\\__PSScriptPolicyTest_must3eiz.2nl.ps1","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"%WINDIR%\\Temp\\__PSScriptPolicyTest_w2ggdey3.nq0.psm1","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"%WINDIR%\\Temp\\__PSScriptPolicyTest_5quk2wkg.z2f.ps1","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"%WINDIR%\\Temp\\__PSScriptPolicyTest_iyd0unap.lxk.psm1","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"pipe\\crashpad_1476_NXGZYRIZXAHBUYGX","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"pipe\\LOCAL\\mojo.1476.3240.15492437469303848009","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"pipe\\LOCAL\\mojo.1476.3240.2518974926974929638","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"pipe\\LOCAL\\mojo.1476.2188.1550863193238661244","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"pipe\\LOCAL\\mojo.1476.2188.6102284549975971467","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"pipe\\LOCAL\\mojo.1476.2188.8624291922711295947","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"pipe\\LOCAL\\mojo.1476.2188.8953000515910258290","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"pipe\\LOCAL\\mojo.1476.2188.2107941734276548211","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"pipe\\LOCAL\\mojo.1476.2188.15270754209300042735","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"pipe\\LOCAL\\mojo.1476.3240.2593789339859078194","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"pipe\\LOCAL\\mojo.3344.2072.17932510445148787230","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"path":"pipe\\LOCAL\\mojo.3424.3412.9979901872869314913","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\DC8084751BD68306","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"Local\\SM0:1476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"SM0:1476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4352:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4352:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"Local\\SM0:4352:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"SM0:4352:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4344:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4344:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"Local\\SM0:4344:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"SM0:4344:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"Local\\SM0:3584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"SM0:3584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"SM0:7300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]},{"name":"Local\\SM0:7300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a92ebfc59c3fd526a0cbdda"}]}]}},"report_ids":{"sandbox_job_ids":["6a92ebfc59c3fd526a0cbdda"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 2d6f773bb869… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2d6f773bb869…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 7/25 AV engines flagged this file. 8 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 2d6f773bb869… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2d6f773bb869…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 7/25 AV engines flagged this file. 8 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2d6f773bb869a4f18dc09b8e005f5b0a997ea8a3fcf396f3f8a83a52141a321d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 2d6f773bb869… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2d6f773bb869…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 7/25 AV engines flagged this file. 8 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5c","11",{}]]