Found URL "https://hot13oct.blogspot.com/dudu.docx.pdf);" - Source: "00000000-00007384.00000000.117244.58DF0000.00000004.mdmp") Found URL "https://hot13oct.blogspot.com/dudu.docx.pdf);icrosoft.net\fra:\windows\system32\windowspowershell\v1.0\powershell.exevcru:\windows\microsoft.net\framework64\v4.0.30319\clr.dllhttps://hot13oct.blogspot.com/dudu.docx.pdf);tem\*wershel" - Source: "00000000-00007384.00000000.117244.58DF0000.00000004.mdmp") Found URL "https://hot13oct.blogspot.com/dudu.docx.pdf);start-sleep-secondsp8rcu&$l" - Source: "00000000-00007384.00000000.117244.58DF0000.00000004.mdmp") Found URL "https://hot13oct.blogspot.com/dudu.docx.pdf);start-sleep-secondsnumber_of_processors=8appdata=c:\users\hapubws\appdata\roaminghomedrive=c:allusersprofile=c:\programdata" - Source: "00000000-00007384.00000000.117244.58DF0000.00000004.mdmp") Found URL "https://hot13oct.blogspot.com/dudu.docx.pdf);start-sleep-seconds%.snmiea%;snw.snp!8snd-snn;sn$trec%av8v'" - Source: "00000000-00007384.00000000.117244.58DF0000.00000004.mdmp") Found URL "https://hot13oct.blogspot.com/dudu.docx.pdf);start-sleep-seconds" - Source: "00000000-00007384.00000000.117244.58DF0000.00000004.mdmp") Found URL "https://hot13oct.blogspot.com/dudu.docx.pdf);start-sleep-secondsicrosoft.powershell.consolehost," - Source: "00000000-00007384.00000000.117244.590B0000.00000004.mdmp") Found URL "https://hot13oct.blogspot.com/dudu.docx.pdf);start-sleep-secondsallusersprofile=c:\programdataappdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00007384.00000000.117244.5AA20000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc>/sn9/sn9/sn9/snl:/sns:/sn>/snr;/sn;/sn;/sn;/sn;/snmnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007384.00000000.117244.732D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00007384.00000000.117244.732D0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00007384.00000000.117244.732D0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00007384.00000000.117244.732D0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00007384.00000000.117244.732D0000.00000004.mdmp") Found URL "http://www.microsoft.com/windowspq.sncrost3o.l3l.n" - Source: "00000000-00007384.00000000.117244.732D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007384.00000000.117244.732D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mibut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007384.00000000.117244.73FB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007384.00000000.117244.73FB0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007384.00000001.119110.38782000.00000002.mdmp") Found URL "https://hot13oct.blogspot.com/dudu.docx.pdf);" - Source: "00000000-00007384.00000001.119110.58DF0000.00000004.mdmp") Found URL "https://hot13oct.blogspot.com/dudu.docx.pdf);icrosoft.net\fra:\windows\system32\windowspowershell\v1.0\powershell.exevcru:\windows\microsoft.net\framework64\v4.0.30319\clr.dllhttps://hot13oct.blogspot.com/dudu.docx.pdf);tem\*wershel" - Source: "00000000-00007384.00000001.119110.58DF0000.00000004.mdmp") Found URL "https://hot13oct.blogspot.com/dudu.docx.pdf);start-sleep-secondsp8rcu&$l" - Source: "00000000-00007384.00000001.119110.58DF0000.00000004.mdmp") Found URL "https://hot13oct.blogspot.com/dudu.docx.pdf);start-sleep-secondsnumber_of_processors=8appdata=c:\users\hapubws\appdata\roaminghomedrive=c:p^(tnallusersprofile=c:\programdatait10" - Source: "00000000-00007384.00000001.119110.58DF0000.00000004.mdmp") Found URL "https://hot13oct.blogspot.com/dudu.docx.pdf);start-sleep-seconds%.snmiea%;snw.snp!8snd-snn;sn$trec%av8v'" - Source: "00000000-00007384.00000001.119110.58DF0000.00000004.mdmp") Found URL "https://hot13oct.blogspot.com/dudu.docx.pdf);start-sleep-secondsr!tnata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\roaming\nvm;c:\program" - Source: "00000000-00007384.00000001.119110.58DF0000.00000004.mdmp") Found URL "https://hot13oct.blogspot.com/dudu.docx.pdf);start-sleep-secondsicrosoft.powershell.consolehost," - Source: "00000000-00007384.00000001.119110.590B0000.00000004.mdmp") Found URL "https://hot13oct.blogspot.com/dudu.docx.pdf);start-sleep-secondsallusersprofile=c:\programdataappdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00007384.00000001.119110.5AA20000.00000004.mdmp") Found URL "http://msdn.microsoft.com/en-us/library/yfsftwz6.aspx" - Source: "00000000-00007384.00000001.119110.6B1D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema" - Source: "00000000-00007384.00000001.119110.6B1D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc>/sn9/sn9/sn9/snl:/sns:/sn>/snr;/sn;/sn;/sn;/sn;/snmnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007384.00000001.119110.732D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00007384.00000001.119110.732D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/micwinpropca2011_2v!tnhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007384.00000001.119110.73386000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miwashington1redmond1microsoft" - Source: "00000000-00007384.00000001.119110.73FD5000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007384.00000001.119110.74188000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007384.00000001.119110.74188000.00000004.mdmp") Found URL "https://hot13oct.blogspot.com/dudu.docx.pdf);" - Source: "00000000-00007384.00000001.119110.741D8000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-jyqf;?0xdb7j[agysf0d1aoc1402+229879+719555cb-6de2-446c-acba-d90894acd8720m0k0ichttp://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-washington1redmond1microsoft" - Source: "00000000-00007384.00000001.119110.741D8000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-meowuseruserwdtphwdtpf0d1aoc1402meowuseruserwdtphwdtpwashington1redmond1microsoft" - Source: "00000000-00007384.00000001.119110.741D8000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-taskactionstringmsft_taskactionmsft_taskexecactionargumentsstringexecutestringstringworkingdirectorystringringvvf82aroot\microsoft\windows\taskschedulermsft_taskrepetitionpatterndurationstringintervalstringstopatdurationendbooleanmsft_taskrepetitionpatternpt59mp3650dpt30m4j\^c" - Source: "00000000-00007384.00000001.119110.741D8000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6w^id*+9&\jkwashington1redmond1microsoft" - Source: "00000000-00007384.00000001.119110.741D8000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/c$vkt7" - Source: "00000000-00007384.00000001.119110.741D8000.00000004.mdmp") Found URL "http://www.microsoft.com/pkays*e" - Source: "00000000-00007384.00000001.119110.7421F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007384.00000001.119110.7421F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?dyab" - Source: "00000000-00007384.00000001.119110.74270000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00007384.00000001.119110.74270000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsatiom" - Source: "00000000-00007384.00000001.119110.748B0000.00000004.mdmp") Found URL "https://hot13oct.blogspot.com/dudu.docx.pdf);start-sleep-secondsicrosoft.management.infrastructure.cimcmdlets,publickey=0024000004800000940000000602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9icrosoft.cloudinfrastructure.test.common,publickey=0024000004800000940000000602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9vxcocreateinstancehandler$%'%vxcocreateinstance/" - Source: "00000000-00007384.00000001.119110.748E3000.00000004.mdmp")