24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 64:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dump:Generic.Dacic.18086 Sample a793e4ad27f6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a793e4ad27f6…. Malware family: Dump:Generic.Dacic.18086. Threat score 100/100. 14/25 AV engines flagged this file. 10 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a793e4ad27f62cb4ab79a798a7883eb146c6fa12b2de5b3ee04e38eff75a6d61","keywords":["Malicious","Dump:Generic.Dacic.18086","malware analysis","sandbox report","threat intelligence","a793e4ad27f62cb4ab79a798a7883eb146c6fa12b2de5b3ee04e38eff75a6d61"],"about":{"@type":"SoftwareApplication","name":"GameBarPresenceWriters.exe","applicationCategory":["peexe","executable"],"identifier":"a793e4ad27f62cb4ab79a798a7883eb146c6fa12b2de5b3ee04e38eff75a6d61","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dump:Generic.Dacic.18086","antivirusDetections":{"malicious":14,"total":25},"behavioralIndicators":{"malicious":10,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1243,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp, 00000000-00004432.00000001.122995.00550000.00000004.mdmp, 00000000-00004432.00000002.123099.00550000.00000004.mdmp, 00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp, 00000000-00004432.00000001.122995.00550000.00000004.mdmp, 00000000-00004432.00000002.123099.00550000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp, 00000000-00004432.00000000.121075.04620000.00000004.mdmp, 00000000-00004432.00000001.122995.00550000.00000004.mdmp, 00000000-00004432.00000002.123099.00550000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp, 00000000-00004432.00000000.121075.06F32000.00000004.mdmp, 00000000-00004432.00000001.122995.06F32000.00000004.mdmp, 00000000-00004432.00000001.122995.09685000.00000004.mdmp, 00000000-00004432.00000002.123099.06F32000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp, 00000000-00004432.00000000.121075.06F32000.00000004.mdmp") Found string "file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "System.Management.Automation.resources, Version=3.0.0.0, Culture=en-US, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput($inputScript, $cursorColumn," (Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "[System.Management.Automation.Language.Ast] $ast," (Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "[System.Management.Automation.Language.Token[]] $tokens," (Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "[System.Management.Automation.Language.IScriptPosition] $positionOfCursor," (Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput(" (Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "# .ExternalHelp System.Management.Automation.dll-help.xml" (Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "[System.Management.Automation.PSCredential]" (Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('New-Item', [System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Out-String',[System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\System.Management.Automation.dll" (Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "System.Management.Automation.dll-Help.xml" (Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::new($_.Exception,"NewTemporaryFileWriteError", "WriteError", $env:TEMP)" (Source: "00000000-00004432.00000000.121075.06F32000.00000004.mdmp")26:T935,Found reference string ">> Add-MpPreference -ExclusionPath $updpath" (Indicator: "add-mppreference"; Source: "00000000-00001408.00000001.122751.08E80000.00000004.mdmp, 00000000-00001408.00000002.124672.08E80000.00000004.mdmp") Found reference string ">> Add-MpPreference -ExclusionPath $ProgramFilesX86" (Indicator: "add-mppreference"; Source: "00000000-00001408.00000001.122751.08E80000.00000004.mdmp, 00000000-00001408.00000002.124672.08E80000.00000004.mdmp") Found reference string ">> Add-MpPreference -ExclusionPath $AppData" (Indicator: "add-mppreference"; Source: "00000000-00001408.00000001.122751.08E80000.00000004.mdmp, 00000000-00001408.00000002.124672.08E80000.00000004.mdmp") Found reference string ">> Add-MpPreference -ExclusionPath $LocalAppData" (Indicator: "add-mppreference"; Source: "00000000-00001408.00000001.122751.08E80000.00000004.mdmp, 00000000-00001408.00000002.124672.08E80000.00000004.mdmp") Found reference string "+ Add-MpPreference -ExclusionPath $updpath" (Indicator: "add-mppreference"; Source: "00000000-00001408.00000001.122751.08E80000.00000004.mdmp, 00000000-00001408.00000002.124672.08E80000.00000004.mdmp") Found reference string "+ Add-MpPreference -ExclusionPath $ProgramFilesX86" (Indicator: "add-mppreference"; Source: "00000000-00001408.00000001.122751.08E80000.00000004.mdmp, 00000000-00001408.00000002.124672.08E80000.00000004.mdmp") Found reference string "+ Add-MpPreference -ExclusionPath $AppData" (Indicator: "add-mppreference"; Source: "00000000-00001408.00000001.122751.08E80000.00000004.mdmp, 00000000-00001408.00000002.124672.08E80000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $updpath" (Indicator: "add-mppreference"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $ProgramFilesX86" (Indicator: "add-mppreference"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $AppData" (Indicator: "add-mppreference"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $LocalAppData" (Indicator: "add-mppreference"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp")27:T649,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data." (Indicator: "Format-Hex"; Source: "00000000-00004432.00000000.121075.06F32000.00000004.mdmp, 00000000-00004432.00000001.122995.06F32000.00000004.mdmp, 00000000-00004432.00000002.123099.06F32000.00000004.mdmp")28:T798,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp")29:Ta49,"GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{00000344-0000-0000-C000-000000000046}") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\LOCALSERVER32") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\LOCALSERVER32") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\LOCALSERVER") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\LOCALSERVER") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\ELEVATION") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\ELEVATION") "GameBarPresenceWriters.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\CIMOM") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\CIMOM") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\SCRIPTING") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\SCRIPTING") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER32") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER32") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER")2a:Taa9,"GameBarPresenceWriters.exe" queried SystemProcessInformation at 00000000-00007680-00000C15-873191754 [PID: 7680] "GameBarPresenceWriters.exe" queried SystemProcessInformation at 00000000-00007680-00000C15-873199653 [PID: 7680] "GameBarPresenceWriters.exe" queried SystemProcessInformation at 00000000-00007680-00000C15-873641790 [PID: 7680] "GameBarPresenceWriters.exe" queried SystemProcessInformation at 00000000-00007680-00000C15-873650670 [PID: 7680] "GameBarPresenceWriters.exe" queried SystemProcessInformation at 00000000-00007680-00000C15-873816481 [PID: 7680] "GameBarPresenceWriters.exe" queried SystemProcessInformation at 00000000-00007680-00000C15-873825577 [PID: 7680] "GameBarPresenceWriters.exe" queried SystemProcessInformation at 00000000-00007680-00000C15-874301267 [PID: 7680] "GameBarPresenceWriters.exe" queried SystemProcessInformation at 00000000-00007680-00000C15-874309791 [PID: 7680] "GameBarPresenceWriters.exe" queried SystemProcessInformation at 00000000-00007680-00000C15-874445765 [PID: 7680] "GameBarPresenceWriters.exe" queried SystemProcessInformation at 00000000-00007680-00000C15-874455432 [PID: 7680] "GameBarPresenceWriters.exe" queried SystemProcessInformation at 00000000-00007680-00000C15-874640173 [PID: 7680] "GameBarPresenceWriters.exe" queried SystemProcessInformation at 00000000-00007680-00000C15-874648966 [PID: 7680] "GameBarPresenceWriters.exe" queried SystemProcessInformation at 00000000-00007680-00000C15-875411177 [PID: 7680] "GameBarPresenceWriters.exe" queried SystemProcessInformation at 00000000-00007680-00000C15-875419620 [PID: 7680] "GameBarPresenceWriters.exe" queried SystemProcessInformation at 00000000-00007680-00000C15-876937807 [PID: 7680] "GameBarPresenceWriters.exe" queried SystemProcessInformation at 00000000-00007680-00000C15-876946082 [PID: 7680] "ctfmon.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-877607215 [PID: 1408] "ctfmon.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-877615797 [PID: 1408] "ctfmon.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-878097188 [PID: 1408] "ctfmon.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-878104609 [PID: 1408] "ctfmon.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-878267936 [PID: 1408] "ctfmon.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-878276352 [PID: 1408] "ctfmon.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-878623970 [PID: 1408] "ctfmon.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-878633113 [PID: 1408] "ctfmon.exe" queried SystemProcessInformation at 00000000-00001408-00000C15-878741469 [PID: 1408]2b:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2c:T11b02,Contains base64 string in header "POST" in header "POST /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveContent-Length: 483Content-Type: application/reports+jsonOrigin: https://img-s-msn-com.akamaized.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "deff" in header "POST /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveContent-Length: 483Content-Type: application/reports+jsonOrigin: https://img-s-msn-com.akamaized.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "keep" in header "POST /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveContent-Length: 483Content-Type: application/reports+jsonOrigin: https://img-s-msn-com.akamaized.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "aliveContent" in header "POST /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveContent-Length: 483Content-Type: application/reports+jsonOrigin: https://img-s-msn-com.akamaized.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Type" in header "POST /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveContent-Length: 483Content-Type: application/reports+jsonOrigin: https://img-s-msn-com.akamaized.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "like" in header "POST /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveContent-Length: 483Content-Type: application/reports+jsonOrigin: https://img-s-msn-com.akamaized.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Encoding" in header "POST /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveContent-Length: 483Content-Type: application/reports+jsonOrigin: https://img-s-msn-com.akamaized.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "gzip" in header "POST /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveContent-Length: 483Content-Type: application/reports+jsonOrigin: https://img-s-msn-com.akamaized.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Language" in header "POST /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveContent-Length: 483Content-Type: application/reports+jsonOrigin: https://img-s-msn-com.akamaized.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "microsoftSsp" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "true" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gdpr" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "linkedin" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "1391f723" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "91e0" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "4064" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8cb8" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "08df8de6ce67" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Priority" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "/sg/msn/1/cm" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "32DFF8A43A9F6A9B15B5EE573B1A6B37" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gdpr" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "222166F75FD3671F181970045E3D66DC" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gdpr" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "253A" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "252F" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "2526code" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "253D222166F75FD3671F181970045E3D66DC" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "2526gdpr" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "253D" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Shopping" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Flag" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "json" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "edge" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "consumer" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "0Sec" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "nonePriority" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "zZnN" in header "GET /crx/blobs/AUU14H9liFl_XdfOVyc6ev9d9iA6qcY2fPGgD1ueVUk_yoQWcsmD13FEXvuVU2CN93z41_hoU8Y7vuIVVHJKVqKxhviwY8EqaSZI6UVSH8cwZZ02ZvEGbus0D2HNwvROEQEAxlKa5cc_zZnN-sn4gCVn46um6OJs-pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI" in header "GET /crx/blobs/AUU14H9liFl_XdfOVyc6ev9d9iA6qcY2fPGgD1ueVUk_yoQWcsmD13FEXvuVU2CN93z41_hoU8Y7vuIVVHJKVqKxhviwY8EqaSZI6UVSH8cwZZ02ZvEGbus0D2HNwvROEQEAxlKa5cc_zZnN-sn4gCVn46um6OJs-pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "clients2" in header "GET /crx/blobs/AUU14H9liFl_XdfOVyc6ev9d9iA6qcY2fPGgD1ueVUk_yoQWcsmD13FEXvuVU2CN93z41_hoU8Y7vuIVVHJKVqKxhviwY8EqaSZI6UVSH8cwZZ02ZvEGbus0D2HNwvROEQEAxlKa5cc_zZnN-sn4gCVn46um6OJs-pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /crx/blobs/AUU14H9liFl_XdfOVyc6ev9d9iA6qcY2fPGgD1ueVUk_yoQWcsmD13FEXvuVU2CN93z41_hoU8Y7vuIVVHJKVqKxhviwY8EqaSZI6UVSH8cwZZ02ZvEGbus0D2HNwvROEQEAxlKa5cc_zZnN-sn4gCVn46um6OJs-pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "0Sec" in header "GET /crx/blobs/AUU14H9liFl_XdfOVyc6ev9d9iA6qcY2fPGgD1ueVUk_yoQWcsmD13FEXvuVU2CN93z41_hoU8Y7vuIVVHJKVqKxhviwY8EqaSZI6UVSH8cwZZ02ZvEGbus0D2HNwvROEQEAxlKa5cc_zZnN-sn4gCVn46um6OJs-pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /crx/blobs/AUU14H9liFl_XdfOVyc6ev9d9iA6qcY2fPGgD1ueVUk_yoQWcsmD13FEXvuVU2CN93z41_hoU8Y7vuIVVHJKVqKxhviwY8EqaSZI6UVSH8cwZZ02ZvEGbus0D2HNwvROEQEAxlKa5cc_zZnN-sn4gCVn46um6OJs-pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /crx/blobs/AUU14H9liFl_XdfOVyc6ev9d9iA6qcY2fPGgD1ueVUk_yoQWcsmD13FEXvuVU2CN93z41_hoU8Y7vuIVVHJKVqKxhviwY8EqaSZI6UVSH8cwZZ02ZvEGbus0D2HNwvROEQEAxlKa5cc_zZnN-sn4gCVn46um6OJs-pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Language" in header "GET /crx/blobs/AUU14H9liFl_XdfOVyc6ev9d9iA6qcY2fPGgD1ueVUk_yoQWcsmD13FEXvuVU2CN93z41_hoU8Y7vuIVVHJKVqKxhviwY8EqaSZI6UVSH8cwZZ02ZvEGbus0D2HNwvROEQEAxlKa5cc_zZnN-sn4gCVn46um6OJs-pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "9Sec" in header "GET /crx/blobs/AUU14H9liFl_XdfOVyc6ev9d9iA6qcY2fPGgD1ueVUk_yoQWcsmD13FEXvuVU2CN93z41_hoU8Y7vuIVVHJKVqKxhviwY8EqaSZI6UVSH8cwZZ02ZvEGbus0D2HNwvROEQEAxlKa5cc_zZnN-sn4gCVn46um6OJs-pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Mesh" in header "GET /crx/blobs/AUU14H9liFl_XdfOVyc6ev9d9iA6qcY2fPGgD1ueVUk_yoQWcsmD13FEXvuVU2CN93z41_hoU8Y7vuIVVHJKVqKxhviwY8EqaSZI6UVSH8cwZZ02ZvEGbus0D2HNwvROEQEAxlKa5cc_zZnN-sn4gCVn46um6OJs-pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Arch" in header "GET /crx/blobs/AUU14H9liFl_XdfOVyc6ev9d9iA6qcY2fPGgD1ueVUk_yoQWcsmD13FEXvuVU2CN93z41_hoU8Y7vuIVVHJKVqKxhviwY8EqaSZI6UVSH8cwZZ02ZvEGbus0D2HNwvROEQEAxlKa5cc_zZnN-sn4gCVn46um6OJs-pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "iSec" in header "GET /crx/blobs/AUU14H9liFl_XdfOVyc6ev9d9iA6qcY2fPGgD1ueVUk_yoQWcsmD13FEXvuVU2CN93z41_hoU8Y7vuIVVHJKVqKxhviwY8EqaSZI6UVSH8cwZZ02ZvEGbus0D2HNwvROEQEAxlKa5cc_zZnN-sn4gCVn46um6OJs-pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Edge" in header "GET /crx/blobs/AUU14H9liFl_XdfOVyc6ev9d9iA6qcY2fPGgD1ueVUk_yoQWcsmD13FEXvuVU2CN93z41_hoU8Y7vuIVVHJKVqKxhviwY8EqaSZI6UVSH8cwZZ02ZvEGbus0D2HNwvROEQEAxlKa5cc_zZnN-sn4gCVn46um6OJs-pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "3800" in header "GET /crx/blobs/AUU14H9liFl_XdfOVyc6ev9d9iA6qcY2fPGgD1ueVUk_yoQWcsmD13FEXvuVU2CN93z41_hoU8Y7vuIVVHJKVqKxhviwY8EqaSZI6UVSH8cwZZ02ZvEGbus0D2HNwvROEQEAxlKa5cc_zZnN-sn4gCVn46um6OJs-pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "stableAccept" in header "GET /crx/blobs/AUU14H9liFl_XdfOVyc6ev9d9iA6qcY2fPGgD1ueVUk_yoQWcsmD13FEXvuVU2CN93z41_hoU8Y7vuIVVHJKVqKxhviwY8EqaSZI6UVSH8cwZZ02ZvEGbus0D2HNwvROEQEAxlKa5cc_zZnN-sn4gCVn46um6OJs-pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /crx/blobs/AUU14H9liFl_XdfOVyc6ev9d9iA6qcY2fPGgD1ueVUk_yoQWcsmD13FEXvuVU2CN93z41_hoU8Y7vuIVVHJKVqKxhviwY8EqaSZI6UVSH8cwZZ02ZvEGbus0D2HNwvROEQEAxlKa5cc_zZnN-sn4gCVn46um6OJs-pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /crx/blobs/AUU14H9liFl_XdfOVyc6ev9d9iA6qcY2fPGgD1ueVUk_yoQWcsmD13FEXvuVU2CN93z41_hoU8Y7vuIVVHJKVqKxhviwY8EqaSZI6UVSH8cwZZ02ZvEGbus0D2HNwvROEQEAxlKa5cc_zZnN-sn4gCVn46um6OJs-pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "16299Sec" in header "GET /crx/blobs/AUU14H9liFl_XdfOVyc6ev9d9iA6qcY2fPGgD1ueVUk_yoQWcsmD13FEXvuVU2CN93z41_hoU8Y7vuIVVHJKVqKxhviwY8EqaSZI6UVSH8cwZZ02ZvEGbus0D2HNwvROEQEAxlKa5cc_zZnN-sn4gCVn46um6OJs-pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /crx/blobs/AUU14H9liFl_XdfOVyc6ev9d9iA6qcY2fPGgD1ueVUk_yoQWcsmD13FEXvuVU2CN93z41_hoU8Y7vuIVVHJKVqKxhviwY8EqaSZI6UVSH8cwZZ02ZvEGbus0D2HNwvROEQEAxlKa5cc_zZnN-sn4gCVn46um6OJs-pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty"2d:T5c8,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains reference to crypto DLLs Matched sigs: Found Crypto currency wallets related strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Calls an API typically used to decrypt data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: HTTP request contains Base64 encoded artifacts Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match – Encryption algorithm2e:T82f3,Found XOR loop in file "ctfmon.exe" at offset 23522; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 132146; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 141686; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 144392; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 331757; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 334720; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 373507; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 503593; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 554046; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 566870; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 586889; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 619870; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 673063; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 720765; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 737862; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 793090; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 862715; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 943017; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1053648; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1084979; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1096556; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1144633; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1154513; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1217643; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1260707; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1446110; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1455852; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1467228; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1475646; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1482148; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1525286; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1557016; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1607201; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1637064; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1726826; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1874061; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1974724; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 2055036; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 2197587; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 2321935; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 2355035; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 2464026; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 2542006; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 2552154; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 2612921; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 2629841; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 2769770; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 2889473; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 2948530; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 3029594; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 3055329; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 3127207; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 3187378; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 3305485; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 3486964; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 3535195; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 3535539; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 3564183; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 3578932; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 191803; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 202087; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 300637; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 353510; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 387880; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 401626; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 432010; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 530194; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 563779; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 837098; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 933121; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1026122; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1139373; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1242210; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1262607; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1351246; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1404073; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1520232; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1537709; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1571312; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1602241; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1693983; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1701630; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1797314; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1917268; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 2028613; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 2074138; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 2141924; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 2240615; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 2273185; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 2293188; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 2296197; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 2357320; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 2389368; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 2544734; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 2588155; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 2588976; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 2636969; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 2898426; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 2909474; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 2976774; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 2988522; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 3016391; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 3088611; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 3094876; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 3173763; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 3187044; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 3233391; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 3297835; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 3344247; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 3444375; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 3556260; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 40266; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 137202; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 203403; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 323255; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 363765; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 449683; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 494556; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 573939; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 594316; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 606567; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 658559; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 751370; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 907963; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 924157; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1012060; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1149452; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1202608; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1595284; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1642468; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1650283; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1658822; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1742159; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1884619; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1905010; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1921789; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1973508; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 2072670; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 2157095; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 2163032; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 2224320; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 2304241; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 2316160; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 2376479; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 2410381; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 2507128; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 2516439; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 2836450; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 3091013; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 3179854; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 3459720; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 3468659; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 3545694; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 23522; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 132146; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 141686; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 144392; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 331757; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 334720; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 373507; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 503593; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 554046; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 566870; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 586889; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 619870; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 673063; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 720765; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 737862; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 793090; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 862715; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 943017; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1053648; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1084979; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1096556; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1144633; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1154513; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1217643; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1260707; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1446110; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1455852; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1467228; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1475646; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1482148; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1525286; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1557016; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1607201; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1637064; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1726826; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1874061; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1974724; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2055036; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2197587; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2321935; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2355035; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2464026; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2542006; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2552154; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2612921; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2629841; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2769770; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2889473; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 2948530; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 3029594; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 3055329; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 3127207; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 3187378; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 3305485; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 3486964; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 3535195; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 3535539; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 3564183; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 3578932; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 191803; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 202087; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 300637; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 353510; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 387880; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 401626; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 432010; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 530194; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 563779; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 837098; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 933121; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1026122; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1139373; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1242210; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1262607; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1351246; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1404073; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1520232; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1537709; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1571312; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1602241; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1693983; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1701630; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1797314; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1917268; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2028613; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2074138; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2141924; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2240615; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2273185; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2293188; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2296197; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2357320; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2389368; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2544734; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2588155; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2588976; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2636969; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2898426; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2909474; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2976774; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 2988522; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 3016391; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 3088611; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 3094876; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 3173763; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 3187044; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 3233391; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 3297835; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 3344247; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 3444375; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 3556260; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 40266; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 137202; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 203403; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 323255; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 363765; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 449683; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 494556; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 573939; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 594316; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 606567; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 658559; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 751370; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 907963; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 924157; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1012060; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1149452; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1202608; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1595284; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1642468; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1650283; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1658822; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1742159; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1884619; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1905010; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1921789; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1973508; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2072670; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2157095; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2163032; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2224320; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2304241; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2316160; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2376479; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2410381; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2507128; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2516439; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 2836450; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 3091013; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 3179854; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 3459720; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 3468659; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 3545694; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 23522; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 132146; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 141686; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 144392; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 331757; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 334720; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 373507; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 503593; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 554046; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 566870; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 586889; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 619870; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 673063; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 720765; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 737862; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 793090; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 862715; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 943017; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1053648; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1084979; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1096556; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1144633; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1154513; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1217643; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1260707; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1446110; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1455852; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1467228; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1475646; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1482148; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1525286; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1557016; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1607201; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1637064; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1726826; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1874061; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1974724; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2055036; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2197587; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2321935; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2355035; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2464026; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2542006; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2552154; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2612921; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2629841; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2769770; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2889473; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2948530; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3029594; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3055329; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3127207; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3187378; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3305485; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3486964; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3535195; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3535539; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3564183; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3578932; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 191803; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 202087; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 300637; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 353510; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 387880; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 401626; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 432010; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 530194; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 563779; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 837098; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 933121; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1026122; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1139373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1242210; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1262607; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1351246; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1404073; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1520232; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1537709; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1571312; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1602241; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1693983; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1701630; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1797314; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1917268; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2028613; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2074138; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2141924; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2240615; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2273185; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2293188; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2296197; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2357320; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2389368; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2544734; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2588155; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2588976; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2636969; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2898426; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2909474; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2976774; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2988522; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3016391; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3088611; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3094876; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3173763; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3187044; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3233391; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3297835; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3344247; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3444375; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3556260; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 40266; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 137202; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 203403; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 323255; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 363765; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 449683; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 494556; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 573939; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 594316; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 606567; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 658559; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 751370; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 907963; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 924157; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1012060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1149452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1202608; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1595284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1642468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1650283; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1658822; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1742159; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1884619; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1905010; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1921789; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1973508; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2072670; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2157095; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2163032; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2224320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2304241; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2316160; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2376479; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2410381; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2507128; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2516439; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2836450; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3091013; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3179854; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3459720; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3468659; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3545694; code bytes = 80302f:T2cca,"GameBarPresenceWriters.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000004b030b00000020b04a0313000b00700a1300640000004f618a745c00000000000000d0f2f3001aa05d73d4f2f3000bed8a7400004a030000000000a94b03e4f2f300d8ec8a7400a94b0300000000f0f2f30002d85d7300a94b0354f3f300b7ab5d7300a94b03000000009e29e877080b4a0300000000280000002400000000004a03c8f3f3006c00000028f4f3001f0000001f00000000003f00d0071300300000005c0000000000000000001300f3937252a500f300e5145e7301000000e00a4a03e8b04a0300000000000000002000000000001300d0011300ac0b130000000000a80b130020f4f300c0f3f30050f5e777080b4a0328f4f30074f4f300 (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000877700000000d0b18377a8ec73265cbc837710b64b03000000003dbc8377dc21e04674ab8b77fddb8a775c20e0460000000060db8a7752618377a8d34e0348869b77000000001027e046bced7326c796847700000000a8d34e0348869b7701180000bced7326d2968477d82f7d77501e8477f996847700000000d82f7d7774de4b032cee7326a8d34e03b0ec73260000000008f4732600a88b773c010917fefffffffddb8a77b702847724839b7710b64b03e05a8b776dfa8377f4ef732610b64b03ccfa83770000000010b64b0308f273260000000050377d770000000000010000000000000000cf6d109f4e0300000000000000000000000000000000 (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000877700000000d0b1837708e873265cbc8377d8874f03000000003dbc83777c25e04674ab8b77fddb8a77fc25e0460000000060db8a7752618377b807500348869b7700000000b028e0461ce97326c796847700000000b807500348869b77011800001ce97326d2968477d82f7d77501e8477f996847700000000d82f7d7734e44b038ce97326b807500310e873260000000068ef732600a88b773c010917fefffffffddb8a77b702847724839b77d8874f03e05a8b776dfa837754eb7326d8874f03ccfa8377d069f500d8874f0368ed73260000000050377d7700000000300000000000000002000000782d4e0300000000824c00000000000000000000 (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000877700000000d0b1837730e873265cbc837718b34b03000000003dbc83774425e04674ab8b77fddb8a77c425e0460000000060db8a775261837788924f0348869b77000000009828e04644e97326c79684770000000088924f0348869b770118000044e97326d2968477d82f7d77501e8477f996847700000000d82f7d7774e04b03b4e9732688924f0338e873260000000090ef732600a88b773c010917fefffffffddb8a77b702847724839b7718b34b03e05a8b776dfa83777ceb732618b34b03ccfa8377d069f50018b34b0390ed73260000000050377d770000000030000000000000000500000038534d0300000000ca8000000000000000000000 (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000877700000000d0b18377d0ea73265cbc837718894f03000000003dbc8377a427e04674ab8b77fddb8a772426e0460000000060db8a7752618377d871500348869b7700000000f825e046e4eb7326c796847700000000d871500348869b7701180000e4eb7326d2968477d82f7d77501e8477f996847700000000d82f7d77f4e24b0354ec7326d8715003d8ea73260000000030f2732600a88b773c010917fefffffffddb8a77b702847724839b7718894f03e05a8b776dfa83771cee732618894f03ccfa8377d069f50018894f0330f073260000000050377d770000000030000000000000000600000080534d030000000004ba00000000000000000000 (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007680) "ctfmon.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000f80018000000c0b1f70014001800080a9500640000004f618a745c0000000000000038f1cf001aa05d733cf1cf000bed8a740000f7000000000058a3f8004cf1cf00d8ec8a7458a3f8000000000058f1cf0002d85d7358a3f800bcf1cf00b7ab5d7358a3f800070000009e29e87788caf8000000000028000000240000000000f70030f2cf006c00000090f2cf001f0000001f00000000003f00d0079500300000005c0000000600000000009500647569add200cf00e5145e730100000010c9f800d8b2f70007000000000000002000000000009500d0019500440b950000000000400b950088f2cf0028f2cf0050f5e77788caf80090f2cf00dcf2cf00 (UID: 00000000-00001408) "ctfmon.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001408) "ctfmon.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001408) "ctfmon.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000877700000000d0b1837730ec08275cbc837728aef800000000003dbc8377ec2de0f074ab8b77fddb8a776c2de0f00000000060db8a7752618377f003fc0048869b77000000003028e0f044ed0827c796847700000000f003fc0048869b770118000044ed0827d2968477d82f7d77501e8477f996847700000000d82f7d7784d9f800b4ed0827f003fc0038ec08270000000090f3082700a88b77940d72a0fefffffffddb8a77b702847724839b7728aef800e05a8b776dfa83777cef082728aef800ccfa83770000000028aef80090f108270000000050377d770000000000010000000000000000cf6dd0c1fb0000000000000000000000000000000000 (UID: 00000000-00001408) "ctfmon.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000877700000000d0b1837780ec08275cbc837730befc00000000003dbc83775c2de0f074ab8b77fddb8a77dc2ce0f00000000060db8a7752618377f0ccfc0048869b7700000000e02be0f094ed0827c796847700000000f0ccfc0048869b770118000094ed0827d2968477d82f7d77501e8477f996847700000000d82f7d776c24fc0004ee0827f0ccfc0088ec082700000000e0f3082700a88b77940d72a0fefffffffddb8a77b702847724839b7730befc00e05a8b776dfa8377ccef082730befc00ccfa8377d069f50030befc00e0f108270000000050377d7700000000300000000000000001000000d054fa0000000000662e00000000000000000000 (UID: 00000000-00001408) "ctfmon.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000877700000000d0b1837778eb08275cbc837700aef800000000003dbc8377a42ae0f074ab8b77fddb8a77242ae0f00000000060db8a775261837798defe0048869b7700000000e828e0f08cec0827c79684770000000098defe0048869b77011800008cec0827d2968477d82f7d77501e8477f996847700000000d82f7d772c21fc00fcec082798defe0080eb082700000000d8f2082700a88b77940d72a0fefffffffddb8a77b702847724839b7700aef800e05a8b776dfa8377c4ee082700aef800ccfa8377d069f50000aef800d8f008270000000050377d770000000030000000000000000200000010adfc0000000000863b00000000000000000000 (UID: 00000000-00001408) "ctfmon.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000877700000000d0b1837710e908275cbc8377a0c1fc00000000003dbc8377cc28e0f074ab8b77fddb8a774c28e0f00000000060db8a7752618377383cfe0048869b77000000001027e0f024ea0827c796847700000000383cfe0048869b770118000024ea0827d2968477d82f7d77501e8477f996847700000000d82f7d77ac21fc0094ea0827383cfe0018e908270000000070f0082700a88b77940d72a0fefffffffddb8a77b702847724839b77a0c1fc00e05a8b776dfa83775cec0827a0c1fc00ccfa8377d069f500a0c1fc0070ee08270000000050377d77000000003000000000000000060000008024fb0000000000a70000000000000000000000 (UID: 00000000-00001408) "ctfmon.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001408) "ctfmon.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000098ea94263cea9426226e9e7400008005000000002d6e9e746ccf5f102d000000ecb74976c0ea94260000950008a8f800e8b1f700150000008000000000ea94260000950084ea942670c89f74a8546f42feffffff2d000000d0cc58762700000054ea9426856aa0741c23a57494ea9426f85fa07408000000bb699f74b2699f74c4cf5f102d000000ecb7497627000000d0cc587668ea94262d000000d0cc58762700000098ea9426856aa0741c23a574e0ea94267e8a5776ee8c5776738a57761a18ca132d000000ecb7497627000000d0cc58767c6f8005106f80051a18ca13a8ea9426fc52957694eb9426e0845776c203cd43feffffff738a5776 (UID: 00000000-00001408) "ctfmon.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000068e3942638cfe877fc37f700d4e3942601000000b037f700fc37f700b037f700040000000400000000e05b7500100000d4e3942601000000b037f700cd97e8779c97e8772dd0acf7b50f5275b037f7000000e8770000000024ffc64e0000000080ee58750100000000000000f8e25b75000000000400000080a97d7448405a75f8e25b75d8e3942680e8f574c8b0fa0080e8f574d4e394260000000080e8f574acd89925feffffff00000000000000000000000013000000cc0bfb00020000000200000018000000a00bfb00cc0bfb00000000008f43d17358e69426ddf34f754ce4942600000000a00bfb0018000000f8f34f75a00bfb00 (UID: 00000000-00001408)30:T4fb,"GameBarPresenceWriters.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "GameBarPresenceWriters.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "ctfmon.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ctfmon.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")31:T4bd,Found reference to API "4,,RtlGetVersion,NTDLL.dll,"00:31:35.578",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00001408.00000001.122751.00FB0000.00000004.mdmp, 00000000-00001408.00000002.124672.00FB0000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API "219768,5460,3024,,RtlGetVersion,NTDLL.dll,"00:32:01.062",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00004432.00000001.122995.07ED0000.00000004.mdmp")32:Td0d,"GameBarPresenceWriters.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")33:Tefc,"GameBarPresenceWriters.exe" queries volume information of "C:\Program Files (x86)" at 00000000-00007680-00000C17-876966282 "GameBarPresenceWriters.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00007680-00000C17-876967151 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages" at 00000000-00001408-00000C17-881920078 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00001408-00000C17-882003929 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data" at 00000000-00001408-00000C17-882006867 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" at 00000000-00001408-00000C17-882010564 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Last Browser" at 00000000-00001408-00000C17-882812306 "ctfmon.exe" queries volume information of "C:\Program Files (x86)\Common Files\ctfmon.exe" at 00000000-00001408-00000C17-882812989 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking" at 00000000-00001408-00000C17-888047896 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent" at 00000000-00001408-00000C17-888049279 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill" at 00000000-00001408-00000C17-888050218 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics" at 00000000-00001408-00000C17-888054973 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation" at 00000000-00001408-00000C17-888061746 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad" at 00000000-00001408-00000C17-888062369 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default" at 00000000-00001408-00000C17-888083880 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" at 00000000-00001408-00000C17-888368688 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" at 00000000-00001408-00000C17-889472651 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" at 00000000-00001408-00000C17-889714598 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings" at 00000000-00001408-00000C17-890472784 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\DeferredBrowserMetrics" at 00000000-00001408-00000C17-890473667 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Domain Actions" at 00000000-00001408-00000C17-890474304 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component" at 00000000-00001408-00000C17-890475106 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config" at 00000000-00001408-00000C17-890475841 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists" at 00000000-00001408-00000C17-890668152 "ctfmon.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Notifications" at 00000000-00001408-00000C17-89067517834:T4468,"GameBarPresenceWriters.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007680) "ctfmon.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00001408) "ctfmon.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00001408) "ctfmon.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001408) "ctfmon.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00001408) "ctfmon.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00001408) "ctfmon.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001408) "ctfmon.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001408) "ctfmon.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001408) "ctfmon.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001408) "ctfmon.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00001408) "ctfmon.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00001408) "ctfmon.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001408) "ctfmon.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001408) "ctfmon.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001408) "ctfmon.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00001408) "ctfmon.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001408) "ctfmon.exe" called "LoadLibrary" with a parameter Crypt32.dll (UID: 00000000-00001408) "ctfmon.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00001408) "ctfmon.exe" called "LoadLibrary" with a parameter rstrtmgr.dll (UID: 00000000-00001408) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00004432) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00004432) "ctfmon.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00002968) "ctfmon.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00002968) "ctfmon.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002968) "ctfmon.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00002968) "ctfmon.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002968) "ctfmon.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002968) "ctfmon.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002968) "ctfmon.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002968) "ctfmon.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002968) "ctfmon.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002968) "ctfmon.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002968) "ctfmon.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00006896) "ctfmon.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00006896) "ctfmon.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006896) "ctfmon.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00006896) "ctfmon.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00006896) "ctfmon.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006896) "ctfmon.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00006896) "ctfmon.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006896) "ctfmon.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006896) "ctfmon.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006896) "ctfmon.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006896)35:T16547,"GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter WerGetFlags (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter RaiseFailFastException (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetErrorMode (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter NtAssociateWaitCompletionPacket (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter NtCancelWaitCompletionPacket (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter getsockname (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter getsockopt (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter WSARecvFrom (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter WSASendTo (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter VariantInit (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetVolumeInformationByHandleW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00007680) "GameBarPresenceWriters.exe" called "GetProcAddress" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00007680) "ctfmon.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter WerGetFlags (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter RaiseFailFastException (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetErrorMode (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter NtAssociateWaitCompletionPacket (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter NtCancelWaitCompletionPacket (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter getsockname (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter getsockopt (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter WSARecvFrom (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter WSASendTo (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter VariantInit (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter WTSEnableChildSessions (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetVolumeInformationByHandleW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00001408) "ctfmon.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00001408) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandleW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter _create_locale (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter _free_locale (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter _wcstod_l (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObjectW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnum (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnumW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MI_Application_InitializeV1 (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeStreamedParameterResultCallback (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativePromptUserCallback (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutput (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutputW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutput (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutputW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_GetInstance (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SHGetFileInfo (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter SHGetFileInfoW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsShuttingDown (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_SessionHandle_OnReleaseHandleCompleted (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_SetAppDomainIsUnloading (UID: 00000000-00004432) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_ScheduleCleanupCallback (UID: 00000000-00004432) "ctfmon.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter WerGetFlags (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter RaiseFailFastException (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter GetErrorMode (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter NtAssociateWaitCompletionPacket (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter NtCancelWaitCompletionPacket (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter SysAllocStringByteLen (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002968) "ctfmon.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter WerGetFlags (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter RaiseFailFastException (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter GetErrorMode (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter NtAssociateWaitCompletionPacket (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter NtCancelWaitCompletionPacket (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter SysAllocStringByteLen (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00006896) "ctfmon.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006896)36:T16e4,"Select Name from Win32_VideoController" (Source: 00000000-00007680-00002714-875813991, Indicator: "select name from win32_videocontroller") "select Name from Win32_Processor" (Source: 00000000-00007680-00002714-876057278, Indicator: "select name from win32_processor") "select * from Win32_OperatingSystem" (Source: 00000000-00007680-00002714-876388865, Indicator: "select * from win32_operatingsystem") "select TotalPhysicalMemory from Win32_ComputerSystem" (Source: 00000000-00007680-00002714-876633927, Indicator: "select totalphysicalmemory from win32_computersystem") "select TotalPhysicalMemory from Win32_ComputerSystem" (Source: 00000000-00001408.00000000.120834.00F70000.00000004.mdmp, 00000000-00001408.00000001.122751.00F70000.00000004.mdmp, 00000000-00001408.00000002.124672.00F70000.00000004.mdmp, Indicator: "select totalphysicalmemory from win32_computersystem") "select * from Win32_OperatingSystem" (Source: 00000000-00001408.00000000.120834.00FB0000.00000004.mdmp, Indicator: "select * from win32_operatingsystem") "CREATE TABLE x" (Source: 00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp, Indicator: "create table x") "CREATE TABLE %Q.'%q_%q'(%s)%s" (Source: 00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp, Indicator: "create table %q.'%q_%q'(%s)%s"), "SELECT word rank NULL langid id FROM "%w"."%w_vocab"%s" (Source: 00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp, Indicator: "select word rank null langid id from "%w"."%w_vocab"%s"), "SELECT rowid rank FROM %Q.%Q ORDER BY %s("%w"%s%s) %s" (Source: 00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp, Indicator: "select rowid rank from %q.%q order by %s("%w"%s%s) %s"), "INSERT INTO"%w"."%w_rowid"(rowid,nodeno)VALUES(?1,?2)ON CONFLICT(rowid)DO UPDATE SET nodeno=excluded.nodeno" (Source: 00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp, Indicator: "insert into"%w"."%w_rowid"(rowid,nodeno)values(?1,?2)on conflict(rowid)do update set nodeno=excluded.nodeno"), "CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY,nodeno" (Source: 00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp, Indicator: "create table "%w"."%w_rowid"(rowid integer primary key,nodeno") "SELECT iLang, cFrom, cTo, iCost FROM "%w" WHERE iLang>=0 ORDER BY iLang" (Source: 00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp, Indicator: "select ilang, cfrom, cto, icost from "%w" where ilang>=0 order by ilang") "SELECT idx,count(*) FROM %Q.sqlite_stat4 GROUP BY idx COLLATE nocase" (Source: 00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp, Indicator: "select idx,count(*) from %q.sqlite_stat4 group by idx collate nocase"), "CREATE TABLE x(_shape" (Source: 00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp, Indicator: "create table x(_shape") "UPDATE OR %s "%w"."%w_vocab" SET id=%lld, rank=%d, langid=%d, word=%Q, k1=nullif(%Q,%Q), k2=%Q WHERE id=%lld" (Source: 00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp, Indicator: "update or %s "%w"."%w_vocab" set id=%lld, rank=%d, langid=%d, word=%q, k1=nullif(%q,%q) k2=%q where id=%lld"), "DELETE FROM "%w"."%w_vocab" WHERE id=%lld" (Source: 00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp, Indicator: "delete from "%w"."%w_vocab" where id=%lld"), "SELECT*FROM"%w".%s ORDER BY rowid" (Source: 00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp, Indicator: "select*from"%w".%s order by rowid"), "SELECT*FROM"%w".%s WHERE %s ORDER BY rowid" (Source: 00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp, Indicator: "select*from"%w".%s where %s order by rowid"), "UPDATE %Q.sqlite_master SET rootpage=%d WHERE #%d AND rootpage=#%d" (Source: 00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp, Indicator: "update %q.sqlite_master set rootpage=%d where #%d and rootpage=#%d"), "UPDATE %Q.sqlite_master SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp, Indicator: "update %q.sqlite_master set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "UPDATE %Q.sqlite_master SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp, Indicator: "update %q.sqlite_master set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d"), "CREATE TABLE x(%.*s INT" (Source: 00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp, Indicator: "create table x(%.*s int") "SELECT %s FROM %s AS T" (Source: 00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp, Indicator: "select %s from %s as t") "DELETE FROM %Q.%s WHERE %s=%Q" (Source: 00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp, Indicator: "delete from %q.%s where %s=%q")37:T4a4f,Found reference to API (Indicator: "LoadLibraryA"; File: "GameBarPresenceWriters.exe") Found reference to API (Indicator: "VirtualProtect"; File: "GameBarPresenceWriters.exe") Found reference to API (Indicator: "ExitProcess"; File: "GameBarPresenceWriters.exe") Found reference to API (Indicator: "GetProcAddress"; File: "GameBarPresenceWriters.exe") Found reference to API (Indicator: "InitializeConditionVariable"; File: "00000000-00004432.00000000.121075.00E81000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "00000000-00004432.00000000.121075.00E81000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "00000000-00004432.00000000.121075.00E81000.00000020.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00002968.00000000.121198.037F0000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp, 00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004432.00000000.121075.00E81000.00000020.mdmp, 00000000-00004432.00000000.121075.6FA51000.00000020.mdmp, 00000000-00004432.00000001.122995.6F391000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004432.00000000.121075.00E81000.00000020.mdmp, 00000000-00004432.00000000.121075.6FA51000.00000020.mdmp, 00000000-00004432.00000001.122995.6F391000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004432.00000000.121075.00E81000.00000020.mdmp, 00000000-00004432.00000000.121075.6FA51000.00000020.mdmp, 00000000-00004432.00000001.122995.6F391000.00000020.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004432.00000000.121075.6FA51000.00000020.mdmp, 00000000-00004432.00000001.122995.6F391000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00004432.00000000.121075.6FA51000.00000020.mdmp, 00000000-00004432.00000001.122995.6F391000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00004432.00000000.121075.6FA51000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00004432.00000000.121075.6FA51000.00000020.mdmp, 00000000-00004432.00000001.122995.6F391000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00004432.00000000.121075.6FA51000.00000020.mdmp, 00000000-00004432.00000001.122995.6F391000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00004432.00000000.121075.6FA51000.00000020.mdmp, 00000000-00004432.00000001.122995.6F391000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004432.00000000.121075.6FA51000.00000020.mdmp, 00000000-00004432.00000001.122995.6F391000.00000020.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004432.00000000.121075.6FA51000.00000020.mdmp, 00000000-00004432.00000001.122995.6F391000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F391000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp, 00000000-00004432.00000002.123099.6FA65000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004432.00000001.122995.00E91000.00000002.mdmp, 00000000-00004432.00000001.122995.6F421000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00004432.00000001.122995.07ED0000.00000004.mdmp")38:T22d3,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 63298-166-00E8D560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 63298-201-00E88190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 63298-201-00E88190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 63298-201-00E88190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 63298-203-00E8BFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 63298-214-00E88AF0 "c:\users\hapubws\appdata\roaming\opera software\opera gx stable\web data" in Source: 00000000-00001408.00000000.120834.00F70000.00000004.mdmp "mpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432No7" in Source: 00000000-00001408.00000000.120834.00F70000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07" in Source: 00000000-00001408.00000000.120834.00F70000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Web Data" in Source: 00000000-00001408.00000000.120834.00FB0000.00000004.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001408.00000000.120834.00FB0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001408.00000000.120834.00FB0000.00000004.mdmp ".0\\REGISTRY\MACHINE\SOFTWARE\Classes\Wn" in Source: 00000000-00001408.00000000.120834.00FB0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Web Data" in Source: 00000000-00001408.00000001.122751.00FB0000.00000004.mdmp 00000000-00001408.00000002.124672.00FB0000.00000004.mdmp "??\c:\users\hapubws\appdata\roaming\opera software\opera stable\web data" in Source: 00000000-00001408.00000001.122751.00FB0000.00000004.mdmp 00000000-00001408.00000002.124672.00FB0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\8" in Source: 00000000-00001408.00000001.122751.2694B000.00000004.mdmp 00000000-00001408.00000002.124672.2694B000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002968.00000000.121198.037F0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00002968.00000000.121198.05C80000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004432.00000000.121075.00550000.00000004.mdmp 00000000-00004432.00000001.122995.00550000.00000004.mdmp 00000000-00004432.00000002.123099.00550000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004432.00000000.121075.00550000.00000004.mdmp 00000000-00004432.00000001.122995.00550000.00000004.mdmp 00000000-00004432.00000002.123099.00550000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECF5BF46-E3B6-449A-B56" in Source: 00000000-00004432.00000000.121075.00550000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004432.00000000.121075.00E81000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004432.00000000.121075.00E81000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004432.00000000.121075.00E81000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004432.00000000.121075.00E81000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004432.00000000.121075.00E81000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004432.00000000.121075.00E81000.00000020.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}" in Source: 00000000-00004432.00000001.122995.00550000.00000004.mdmp 00000000-00004432.00000002.123099.00550000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{E7D35CFA-348B-485E-B524-252725D697CA}" in Source: 00000000-00004432.00000001.122995.00550000.00000004.mdmp 00000000-00004432.00000002.123099.00550000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00004432.00000001.122995.00550000.00000004.mdmp 00000000-00004432.00000002.123099.00550000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00004432.00000001.122995.00550000.00000004.mdmp 00000000-00004432.00000002.123099.00550000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004432.00000001.122995.00550000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004432.00000001.122995.06F32000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004432.00000001.122995.06F32000.00000004.mdmp 00000000-00004432.00000002.123099.06FBB000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004432.00000001.122995.07ED0000.00000004.mdmp39:T92c,Process GameBarPresenceWriters.exe created mutex with name "\BaseNamedObjects\TRUE_62AEJHJ8G1KS" Process GameBarPresenceWriters.exe created mutex with name "SM0:7680:168:WilStaging_02" Process GameBarPresenceWriters.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7680:168:WilStaging_02" Process ctfmon.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1408:168:WilStaging_02" Process ctfmon.exe created mutex with name "RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process ctfmon.exe created mutex with name "RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process ctfmon.exe created mutex with name "Local\SM0:1408:168:WilStaging_02" Process ctfmon.exe created mutex with name "SM0:1408:168:WilStaging_02" Process ctfmon.exe created mutex with name "Local\SM0:1408:64:WilError_01" Process ctfmon.exe created mutex with name "SM0:1408:64:WilError_01" Process ctfmon.exe created mutex with name "\BaseNamedObjects\TRUE_62AEJHJ8G1KS" Process ctfmon.exe created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process ctfmon.exe created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process ctfmon.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1408:168:WilStaging_02" Process ctfmon.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1408:64:WilError_01" Process ctfmon.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1408:64:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4432:168:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:4432:64:WilError_01" Process powershell.exe created mutex with name "Local\SM0:4432:168:WilStaging_02" Process powershell.exe created mutex with name "SM0:4432:168:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "SM0:4432:64:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex"3a:T1280,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]3b:T2b72,"c:\users\hapubws\appdata\roaming\opera software\opera gx stable\web data" in Source: 00000000-00001408.00000000.120834.00F70000.00000004.mdmp "mpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432No7" in Source: 00000000-00001408.00000000.120834.00F70000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07" in Source: 00000000-00001408.00000000.120834.00F70000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Web Data" in Source: 00000000-00001408.00000000.120834.00FB0000.00000004.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001408.00000000.120834.00FB0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001408.00000000.120834.00FB0000.00000004.mdmp ".0\\REGISTRY\MACHINE\SOFTWARE\Classes\Wn" in Source: 00000000-00001408.00000000.120834.00FB0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Web Data" in Source: 00000000-00001408.00000001.122751.00FB0000.00000004.mdmp "??\c:\users\hapubws\appdata\roaming\opera software\opera stable\web data" in Source: 00000000-00001408.00000001.122751.00FB0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\8" in Source: 00000000-00001408.00000001.122751.2694B000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Web Data" in Source: 00000000-00001408.00000002.124672.00FB0000.00000004.mdmp "??\c:\users\hapubws\appdata\roaming\opera software\opera stable\web data" in Source: 00000000-00001408.00000002.124672.00FB0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\8" in Source: 00000000-00001408.00000002.124672.2694B000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002968.00000000.121198.037F0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00002968.00000000.121198.05C80000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004432.00000000.121075.00550000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004432.00000000.121075.00550000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECF5BF46-E3B6-449A-B56" in Source: 00000000-00004432.00000000.121075.00550000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004432.00000000.121075.00E81000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004432.00000000.121075.00E81000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004432.00000000.121075.00E81000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004432.00000000.121075.00E81000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004432.00000000.121075.00E81000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004432.00000000.121075.00E81000.00000020.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004432.00000000.121075.04620000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004432.00000001.122995.00550000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}" in Source: 00000000-00004432.00000001.122995.00550000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{E7D35CFA-348B-485E-B524-252725D697CA}" in Source: 00000000-00004432.00000001.122995.00550000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00004432.00000001.122995.00550000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00004432.00000001.122995.00550000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004432.00000001.122995.00550000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004432.00000001.122995.00550000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004432.00000001.122995.06F32000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004432.00000001.122995.06F32000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004432.00000001.122995.07ED0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001" in Source: 00000000-00004432.00000001.122995.09685000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00004432.00000001.122995.6F391000.00000020.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00004432.00000001.122995.6F391000.00000020.mdmp "HKLM\" in Source: 00000000-00004432.00000001.122995.6F391000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00004432.00000001.122995.6F391000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004432.00000001.122995.6F391000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004432.00000002.123099.00550000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}" in Source: 00000000-00004432.00000002.123099.00550000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{E7D35CFA-348B-485E-B524-252725D697CA}" in Source: 00000000-00004432.00000002.123099.00550000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00004432.00000002.123099.00550000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00004432.00000002.123099.00550000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004432.00000002.123099.00550000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004432.00000002.123099.06FBB000.00000004.mdmp "0218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004432.00000002.123099.07FFE000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006896.00000000.121719.039E0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4991D34B-80A1-4291-83B" in Source: 00000000-00006896.00000000.121719.039E0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00006896.00000000.121719.06000000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007680.00000000.120546.034A0000.00000004.mdmp3c:T1dc5,"GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2 Host: px.ads.linkedin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67" Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Tue 28 Jul 2026 18:56:23 GMT Server: cloudflare X-Li-Fabric: prod-lva1 Cf-Ray: a2261a801985f497-SJC Vary: Accept-Encoding X-Li-Proto: http/2 Content-Encoding: gzip Cf-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=31536000 Set-Cookie: __cf_bm=L0clvIEsrEYzeGPyEAwsFB5YBjwhvwmrBN0d4MAE7gE-1785264983.0600786-1.0.1.1-pZDxfo6XD6di1Hm5dd8W608zIFnh3AeyuxifptkIEgpmjhR6wsBFrEIgTMmOuMj6KI5.PZZ1p3cCKCLX4yWP.MNgRaROcMs2HJ7AFLHlkXTJqTHV0wMEtrinQeGn6Alp; HttpOnly; SameSite=None; Secure; Path=/; Domain=linkedin.com; Expires=Tue 28 Jul 2026 19:26:23 GMT X-Li-Uuid: AAZXsGUlztggYRkED6yaCQ== Nel: {"report_to":"network-errors" "max_age":1296000 "success_fraction":0.00066 "failure_fraction":1 "include_subdomains":true} X-Content-Type-Options: nosniff X-Li-Pop: cf-prod-lva1-x Report-To: {"group":"network-errors" "max_age":2592000 "endpoints":[{"url":"https://www.linkedin.com/li/rep"}] "include_subdomains":true} Alt-Svc: h3=":443"; ma=86400 Linkedin-Action: 1 with response body ==>BINARY_CONTENT....... "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Date: Tue 28 Jul 2026 18:56:23 GMT Server: nginx X-Service-Version: v1 X-Served-By: cache-lax-kwhp1940105-LAX P3p: policyref="http://trc.taboola.com/p3p.xml" CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Pragma: no-cache X-Cache-Hits: 0 Via: 1.1 varnish Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Fastly-To-Nlb-Rtt: 43613 X-Timer: S1785264983.154527 VS0 VE46 X-Cache: MISS X-Vcl-Time-Ms: 46 Cache-Control: no-cache no-store Accept-Ranges: bytes with response body ==>BINARY_CONTENT....... "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 307 Temporary Redirect Content-Type: text/html; charset=utf-8 Date: Tue 28 Jul 2026 18:56:23 GMT Server: nginx/1.25.5 Set-Cookie: uuid2=2530976820267231611; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon 26-Oct-2026 18:56:23 GMT; Domain=.adnxs.com; Secure; HttpOnly Expires: Sat 15 Nov 2008 16:00:00 GMT X-Xss-Protection: 0 An-X-Request-Uuid: 4841d6f9-7b81-44cd-947e-de2693d94176 X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 904.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; *.adnxs.com Location: https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D Cache-Control: no-store no-cache private P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness with no response body "GET /mouse-gesture/config.json HTTP/2 Host: edge-consumer-static.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json Date: Tue 28 Jul 2026 18:56:45 GMT X-Azure-Ref: 20260728T185645Z-15bbff6776dtvqvrhC1FTYwv7w00000002400000000005e8 X-Ms-Version: 2009-09-19 X-Ms-Lease-Status: unlocked X-Ms-Blob-Type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id Server x-ms-version Content-Type ETag Last-Modified x-ms-lease-status x-ms-blob-type Content-Length Date Transfer-Encoding Access-Control-Allow-Origin: * Last-Modified: Tue 24 Oct 2023 08:27:00 GMT X-Fd-Int-Roxy-Purgeid: 83583309 Etag: 0x8DBD46AFE482320 X-Cache: TCP_HIT Cache-Control: public max-age=432000 Accept-Ranges: bytes X-Ms-Request-Id: 86047d47-401e-0023-27af-1d28b4000000 with no response body "GET /crx/blobs/AUU14H9liFl_XdfOVyc6ev9d9iA6qcY2fPGgD1ueVUk_yoQWcsmD13FEXvuVU2CN93z41_hoU8Y7vuIVVHJKVqKxhviwY8EqaSZI6UVSH8cwZZ02ZvEGbus0D2HNwvROEQEAxlKa5cc_zZnN-sn4gCVn46um6OJs-pSr/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-Os: Windows Priority: u=4, i Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Accept-Encoding: gzip, deflate, br, zstd Sec-Mesh-Client-Os-Version: 10.0.16299 Sec-Mesh-Client-Webview: 0 Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-chrome-extension X-Guploader-Uploadid: AKhXX7I-xULi8tm9VLqVoYY2pyY6L8emNoEwFcp_We1ayFEIS2zOrOdY_zUXw7_KNBpvkyfc48twW2Y Date: Tue 28 Jul 2026 18:16:50 GMT Server: UploadServer Last-Modified: Thu 16 Jul 2026 20:29:27 GMT Expires: Wed 28 Jul 2027 18:16:50 GMT Etag: 72b90ec3_767af3da_a8ce09bb_28a9baf6_fe91ebeb Accept-Ranges: bytes Cache-Control: public max-age=31536000 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 2395 X-Goog-Hash: crc32c=GsUU2Q== with response body ==>BINARY_CONTENT.......3d:T3154,"GameBarPresenceWriters.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 734e0000 "GameBarPresenceWriters.exe" loaded module "KERNEL32.DLL" at base 77d50000 "GameBarPresenceWriters.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 74d90000 "GameBarPresenceWriters.exe" loaded module "NTDLL.DLL" at base 77e40000 "GameBarPresenceWriters.exe" loaded module "WINMM.DLL" at base 73470000 "GameBarPresenceWriters.exe" loaded module "POWRPROF.DLL" at base 75eb0000 "GameBarPresenceWriters.exe" loaded module "WS2_32.DLL" at base 75660000 "GameBarPresenceWriters.exe" loaded module "USER32.DLL" at base 75b10000 "GameBarPresenceWriters.exe" loaded module "ADVAPI32.DLL" at base 74d10000 "GameBarPresenceWriters.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73630000 "GameBarPresenceWriters.exe" loaded module "IPHLPAPI.DLL" at base 74780000 "GameBarPresenceWriters.exe" loaded module "RPCRT4.DLL" at base 75f50000 "GameBarPresenceWriters.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 73430000 "GameBarPresenceWriters.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 733e0000 "GameBarPresenceWriters.exe" loaded module "USERENV.DLL" at base 733b0000 "GameBarPresenceWriters.exe" loaded module "SECUR32.DLL" at base 733a0000 "GameBarPresenceWriters.exe" loaded module "SSPICLI.DLL" at base 74860000 "GameBarPresenceWriters.exe" loaded module "OLE32.DLL" at base 76090000 "GameBarPresenceWriters.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 743b0000 "GameBarPresenceWriters.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75410000 "GameBarPresenceWriters.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 73360000 "GameBarPresenceWriters.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74d10000 "GameBarPresenceWriters.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 732e0000 "GameBarPresenceWriters.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 77bf0000 "GameBarPresenceWriters.exe" loaded module "OLEAUT32.DLL" at base 77bf0000 "GameBarPresenceWriters.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 73230000 "GameBarPresenceWriters.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 73220000 "GameBarPresenceWriters.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 73160000 "GameBarPresenceWriters.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 75410000 "GameBarPresenceWriters.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 75410000 "GameBarPresenceWriters.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 73dc0000 "GameBarPresenceWriters.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 747b0000 "ctfmon.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 734e0000 "ctfmon.exe" loaded module "KERNEL32.DLL" at base 77d50000 "ctfmon.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 74d90000 "ctfmon.exe" loaded module "NTDLL.DLL" at base 77e40000 "ctfmon.exe" loaded module "WINMM.DLL" at base 73470000 "ctfmon.exe" loaded module "POWRPROF.DLL" at base 75eb0000 "ctfmon.exe" loaded module "WS2_32.DLL" at base 75660000 "ctfmon.exe" loaded module "USER32.DLL" at base 75b10000 "ctfmon.exe" loaded module "ADVAPI32.DLL" at base 74d10000 "ctfmon.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73630000 "ctfmon.exe" loaded module "IPHLPAPI.DLL" at base 74780000 "ctfmon.exe" loaded module "RPCRT4.DLL" at base 75f50000 "ctfmon.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 73430000 "ctfmon.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 733e0000 "ctfmon.exe" loaded module "USERENV.DLL" at base 733b0000 "ctfmon.exe" loaded module "SECUR32.DLL" at base 733a0000 "ctfmon.exe" loaded module "SSPICLI.DLL" at base 74860000 "ctfmon.exe" loaded module "OLE32.DLL" at base 76090000 "ctfmon.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 743b0000 "ctfmon.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75410000 "ctfmon.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 73360000 "ctfmon.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74d10000 "ctfmon.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 732e0000 "ctfmon.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 77bf0000 "ctfmon.exe" loaded module "OLEAUT32.DLL" at base 77bf0000 "ctfmon.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 73230000 "ctfmon.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 73220000 "ctfmon.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 73160000 "ctfmon.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 75410000 "ctfmon.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 75410000 "ctfmon.exe" loaded module "WTSAPI32.DLL" at base 744d0000 "ctfmon.exe" loaded module "GDI32.DLL" at base 75630000 "ctfmon.exe" loaded module "CRYPT32.DLL" at base 74b10000 "ctfmon.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 747b0000 "ctfmon.exe" loaded module "RSTRTMGR.DLL" at base 6f4a0000 "ctfmon.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74d90000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 734e0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 74d10000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75410000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75410000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75410000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 731c0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 74df0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 763d0000 "powershell.exe" loaded module "VERSION.DLL" at base 74580000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72a10000 "powershell.exe" loaded module "USER32.DLL" at base 75b10000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 75410000 "powershell.exe" loaded module "MSCOREE.DLL" at base 73320000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 777b0000 "powershell.exe" loaded module "PSAPI.DLL" at base 74ca0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 75f50000 "powershell.exe" loaded module "KERNEL32.DLL" at base 77d50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 71550000 "powershell.exe" loaded module "OLE32.DLL" at base 76090000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 777b0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 77bf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71520000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74d90000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 75410000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71490000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70a30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 70210000 "powershell.exe" loaded module "COMBASE.DLL" at base 777b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 777b0000 "powershell.exe" loaded module "NTDLL.DLL" at base 77e40000 "powershell.exe" loaded module "SHELL32.DLL" at base 76470000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6fa90000 "powershell.exe" loaded module "WINTRUST.DLL" at base 77d00000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 77d00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 74b10000 "powershell.exe" loaded module "AMSI.DLL" at base 732e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74580000 "powershell.exe" loaded module "CRYPT32.DLL" at base 74b10000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6fa50000 "powershell.exe" loaded module "KERNEL32" at base 77d50000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\7561CCK9.DLL" at base 6fa10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6f990000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6f630000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 777b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6f5e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6f4d0000 "powershell.exe" loaded module "SECUR32.DLL" at base 733a0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 74860000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 743b0000 "powershell.exe" loaded module "WLDP.DLL" at base 6f460000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6f390000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 77d50000 "powershell.exe" loaded module "USERENV.DLL" at base 733b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74d10000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 6f2a0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6f280000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77d50000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6f250000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6f0f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6f0c0000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6f0c0000 "powershell.exe" loaded module "URLMON.DLL" at base 741f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 75410000 "powershell.exe" loaded module "MSISO.DLL" at base 6f050000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6efa0000 "powershell.exe" loaded module "BCRYPT.DLL" at base 73700000 "powershell.exe" loaded module "OLEAUT32" at base 77bf0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 75410000 "powershell.exe" loaded module "MSVCRT.DLL" at base 749a0000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 6ecc0000 "powershell.exe" loaded module "MI.DLL" at base 6eca0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 75410000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6ec10000 "powershell.exe" loaded module "GDI32.DLL" at base 75630000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75410000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6ec00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6eb80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6eac0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 75410000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 75410000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 77d50000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 75410000 "ctfmon.exe" loaded module "OLEAUT32" at base 77bf00003e:Tf7b,Found string ">> if (Test-Path $ProgramFilesX86) {" (Indicator: "Test-Path"; Source: "00000000-00001408.00000001.122751.08E80000.00000004.mdmp, 00000000-00001408.00000002.124672.08E80000.00000004.mdmp") Found string "if (Test-Path $ProgramFilesX86) {" (Indicator: "Test-Path"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00004432.00000000.121075.06F32000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00004432.00000000.121075.06F32000.00000004.mdmp") Found string "if(Test-Path -LiteralPath $filePath -PathType Container)" (Indicator: "Test-Path"; Source: "00000000-00004432.00000000.121075.06F32000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ReadError -ErrorId "FileReadError" -TargetObject $FilePath" (Indicator: "Write-Error"; Source: "00000000-00004432.00000000.121075.06F32000.00000004.mdmp") Found string "Write-Error -ErrorRecord $errorRecord" (Indicator: "Write-Error"; Source: "00000000-00004432.00000000.121075.06F32000.00000004.mdmp")3f:Tb74,"GameBarPresenceWriters.exe" touched "WBEM Scripting Locator" (Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}") "GameBarPresenceWriters.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "GameBarPresenceWriters.exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "GameBarPresenceWriters.exe" touched "PSTypeInfo" (Path: "HKCU\WOW6432NODE\CLSID\{00020422-0000-0000-C000-000000000046}\TREATAS") "GameBarPresenceWriters.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "GameBarPresenceWriters.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "GameBarPresenceWriters.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "GameBarPresenceWriters.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "GameBarPresenceWriters.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "GameBarPresenceWriters.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "GameBarPresenceWriters.exe" touched "PSEnumVariant" (Path: "HKCU\WOW6432NODE\CLSID\{00020421-0000-0000-C000-000000000046}\TREATAS") "GameBarPresenceWriters.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS") "ctfmon.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "ctfmon.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "ctfmon.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "ctfmon.exe" touched "PSOAInterface" (Path: "HKCU\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS")40:T47a,"GameBarPresenceWriters.exe" file has an entrypoint instructions - "pushal ,mov esi, 0xce6015,lea edi, [esi - 0x8e5015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x10522a8,inc esi,inc esi,push ebx,push 0xc50380,push edi,add ebx, 4,push ebx,push 0x36c26e,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,mov edi, 0,push esi,push ebx,sub esp, 0x64,mov edx, dword ptr [esp + 0x78],mov dword ptr [esp + 0x5c], 0,lea eax, [edx + 4],mov dword ptr [esp + 0x60], eax,mov eax, 1,movzx ecx, byte ptr [edx + 2]," "ctfmon.exe" file has an entrypoint instructions - "pushal ,mov esi, 0xce6015,lea edi, [esi - 0x8e5015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x10522a8,inc esi,inc esi,push ebx,push 0xc50380,push edi,add ebx, 4,push ebx,push 0x36c26e,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,mov edi, 0,push esi,push ebx,sub esp, 0x64,mov edx, dword ptr [esp + 0x78],mov dword ptr [esp + 0x5c], 0,lea eax, [edx + 4],mov dword ptr [esp + 0x60], eax,mov eax, 1,movzx ecx, byte ptr [edx + 2],"41:T18fd,Process "ctfmon.exe" (UID: 00000000-00001408) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "ctfmon.exe" (UID: 00000000-00001408) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "ReAgentc.exe" (UID: 00000000-00005320) was launched with modified environment variables: "PSModulePath, PATHEXT" Process "msedge.exe" (UID: 00000000-00002648) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, Path, PATHEXT, ProgramFiles, NUMBER_OF_PROCESSORS" Process "msedge.exe" (UID: 00000000-00002648) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00006628) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_2648_BKAMCYKXTKENEOUB", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="2648"" Process "msedge.exe" (UID: 00000000-00006004) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="7", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00004336) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00007400) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="sPsgwtkOvpFa16f", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="kykCHkw", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="sPsgwtkOvpFa16f", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\kykCHkw", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\kykCHkw", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00007028) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00000096) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="sPsgwtkOvpFa16f", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="kykCHkw", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="sPsgwtkOvpFa16f", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\kykCHkw", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\kykCHkw", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00000848) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH"42:T68d,"GameBarPresenceWriters.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "GameBarPresenceWriters.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "GameBarPresenceWriters.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "GameBarPresenceWriters.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "GameBarPresenceWriters.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "ctfmon.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ctfmon.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "ctfmon.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "ctfmon.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "ctfmon.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")43:Tfac,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004432-00000C2E-445429490] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004432-00000C2B-882138844] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004432-00000C2B-882232534] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004432-00000C2B-882313755] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004432-00000C2B-882509260] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004432-00000C2B-882532957] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004432-00000C2B-882594208] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00004432-00000C2B-882660459] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004432-00000C2B-882844285] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00004432-00000C2B-882907346] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004432-00000C2B-883126341] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00004432-00000C2B-883157024] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00004432-00000C2B-883207183] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00004432-00000C2B-883410580] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00004432-00000C2B-883730465] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004432-00000C2B-883835673] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00004432-00000C2B-883956077] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00004432-00000C2B-884129373] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004432-00000C2B-884242234] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00004432-00000C2B-884458305] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00004432-00000C2B-884809859] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00004432-00000C2B-884862774] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00004432-00000C2B-884921027] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00004432-00000C2B-885054072] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00004432-00000C2B-885454328]44:Tab3,Spawned process "ctfmon.exe" (UID: 00000000-00001408) Spawned process "powershell.exe" (UID: 00000000-00004432) Spawned process "ctfmon.exe" with commandline "-" (UID: 00000000-00002968) Spawned process "ctfmon.exe" with commandline "-" (UID: 00000000-00006896) Spawned process "ReAgentc.exe" with commandline "/disable" (UID: 00000000-00005320) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00002648) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00006628), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00006004), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00007156), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00005196), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00004336), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00005824), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00007756), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00004548), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00007400), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007028), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00000096), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00007936), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00000848), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00004032), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00004656), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007880)45:Tab3,Spawned process "ctfmon.exe" (UID: 00000000-00001408) Spawned process "powershell.exe" (UID: 00000000-00004432) Spawned process "ctfmon.exe" with commandline "-" (UID: 00000000-00002968) Spawned process "ctfmon.exe" with commandline "-" (UID: 00000000-00006896) Spawned process "ReAgentc.exe" with commandline "/disable" (UID: 00000000-00005320) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00002648) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00006628), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00006004), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00007156), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00005196), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00004336), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00005824), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00007756), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00004548), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00007400), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007028), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00000096), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00007936), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00000848), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00004032), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00004656), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007880)46:T137e,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 69:FA:A3:AA:B5:EF:4D:AD:AF:39:01:2F:B4:61:55:4A:8A:2F:CF:55; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 ECC CA OCSP 06, O=Microsoft Corporation, C=US" (SHA1: 00:BA:C4:07:AF:A8:44:07:94:31:14:8E:1D:BD:83:95:78:95:CE:3E; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS ECC Root G2, O=Microsoft Corporation, C=US" (SHA1: 9B:C5:75:46:AC:BD:B2:9E:38:8C:D1:79:1B:43:DE:4F:65:9B:84:4B; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7F:A0:5A:CF:9B:4A:AB:B0:DE:0C:FA:FA:29:7D:DF:92:FD:C5:F3:F5; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 ECC CA OCSP 02, O=Microsoft Corporation, C=US" (SHA1: 22:F0:A7:3D:5B:63:A2:0B:38:9D:62:F1:0E:B0:98:33:BA:F2:E8:4A; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS ECC Root G2, O=Microsoft Corporation, C=US" (SHA1: 33:6D:3E:54:51:31:52:94:F6:E1:E7:CF:DA:84:E5:1C:8B:1E:40:54; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7E:04:DE:89:6A:3E:66:6D:00:E6:87:D3:3F:FA:D9:3B:E8:3D:34:9E; see report for more information) The input sample is signed with a certificate issued by "CN=GeoTrust TLS ECC CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: C6:A7:9F:4F:A3:32:C1:3F:51:DB:C6:1F:5D:2B:37:2F:71:ED:6B:69; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: BF:E7:BA:21:A2:FA:56:71:9B:61:F6:4E:E1:B2:69:D0:B8:0B:44:E5; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 9B:11:B0:70:AE:60:F2:0E:B2:4D:34:65:C9:F8:5D:33:2F:37:89:2F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1D:73:22:B4:1E:D9:9F:DD:68:51:1B:AB:78:6C:8E:26:E0:83:1B:3B; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 8B:F7:F1:78:A7:45:A1:1B:AC:6A:E5:B5:86:FC:18:38:EA:DC:B2:CF; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 02, O=Microsoft Corporation, C=US" (SHA1: 8E:B0:B8:72:C4:57:AF:BC:1A:2D:BE:E8:A5:01:2A:0E:76:5A:AB:54; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: F8:A4:08:B8:FB:EE:A0:77:B7:57:38:65:86:41:BE:77:15:47:20:EB; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB" (SHA1: 48:62:BA:29:DB:48:52:50:EC:DE:95:62:15:70:58:A6:E2:13:BC:AE; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB" (SHA1: DD:55:B4:52:02:91:E2:76:58:8F:0D:D0:2F:AF:D8:3A:73:68:E0:FA; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:18:94:7A:6A:9F:C7:76:4F:D8:B5:FB:18:A8:63:B0:C6:DA:C2:4F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 7B:40:95:9C:A6:F3:08:E5:89:4E:40:4C:00:30:B1:DF:B8:63:30:45; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information)47:T820,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "function New-TemporaryFile" (Indicator: "New-TemporaryFile"; Source: "00000000-00004432.00000000.121075.06F32000.00000004.mdmp") Found string "function New-Guid" (Indicator: "New-Guid"; Source: "00000000-00004432.00000000.121075.06F32000.00000004.mdmp")48:T503,"ctfmon.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\Google\Chrome\Application\ctfmon.exe]- [targetUID: 00000000-00007680] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00004432] "ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00004432] "StartupProfileData-Interactive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-Interactive]- [targetUID: 00000000-00004432] "ctfmon.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\ctfmon.exe]- [targetUID: 00000000-00007680] "smss.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%LOCALAPPDATA%\Publishers\smss.exe]- [targetUID: 00000000-00007680] "ctfmon.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\ctfmon.exe]- [targetUID: 00000000-00007680]49:T776,"GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\HVSI"; Key: ""; Value: "") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: ""; Value: "") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKCU\WBEMSCRIPTING.SWBEMLOCATOR"; Key: ""; Value: "") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WBEMSCRIPTING.SWBEMLOCATOR"; Key: ""; Value: "") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKCU\WBEMSCRIPTING.SWBEMLOCATOR\CLSID"; Key: ""; Value: "") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WBEMSCRIPTING.SWBEMLOCATOR\CLSID"; Key: ""; Value: "") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM"; Key: ""; Value: "") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PROGIDINDEX"; Key: ""; Value: "") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}"; Key: ""; Value: "") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}"; Key: ""; Value: "") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\TREATAS"; Key: ""; Value: "") "GameBarPresenceWriters.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\TREATAS"; Key: ""; Value: "")4a:Tc71,"GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "PROFILEIMAGEPATH"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: "COM+ENABLED"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WBEMSCRIPTING.SWBEMLOCATOR\CLSID"; Key: ""; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}"; Key: ""; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: ""; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXIMUMALLOWEDALLOCATIONSIZE"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXSXSHASHCOUNT"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPX"; Key: "ALLOWDEVELOPMENTWITHOUTDEVLICENSE"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODELUNLOCK"; Key: "ALLOWDEVELOPMENTWITHOUTDEVLICENSE"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\APPCOMPAT"; Key: "RAISEDEFAULTAUTHNLEVEL"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "DEFAULTACCESSPERMISSION"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "ANONYMOUSAPPCONTAINERIMPERSONATIONLEVELCHECK"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "EVERYONEINCLUDESANONYMOUS"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{00000134-0000-0000-C000-000000000046}\PROXYSTUBCLSID32"; Key: ""; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC\EXTENSIONS"; Key: "NDROLEEXTDLL"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: "GIPACTIVITYBYPASS"; Value: "") "GameBarPresenceWriters.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\PROGID"; Key: ""; Value: "")4b:T5ca,"GameBarPresenceWriters.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "GameBarPresenceWriters.exe" trying to access non-existent file "C:\FLTLIB.DLL" "GameBarPresenceWriters.exe" trying to access non-existent file "C:\MSVCP140.DLL" "GameBarPresenceWriters.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "GameBarPresenceWriters.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "GameBarPresenceWriters.exe" trying to access non-existent file "C:\BCRYPT.DLL" "GameBarPresenceWriters.exe" trying to access non-existent file "C:\bcrypt.dll" "GameBarPresenceWriters.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "GameBarPresenceWriters.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "GameBarPresenceWriters.exe" trying to access non-existent file "C:\Windows\SysWOW64\wbem\WBEMCOMN.DLL" "GameBarPresenceWriters.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "ctfmon.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "ctfmon.exe" trying to access non-existent file "C:\Program Files (x86)\Common Files\FLTLIB.DLL" "ctfmon.exe" trying to access non-existent file "C:\Program Files (x86)\Common Files\MSVCP140.DLL" "ctfmon.exe" trying to access non-existent file "C:\Program Files (x86)\Common Files\VCRUNTIME140.DLL" "ctfmon.exe" trying to access non-existent file "C:\Program Files (x86)\Common Files\CRYPTSP.DLL"4c:T5f4,"GameBarPresenceWriters.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" "GameBarPresenceWriters.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}" "GameBarPresenceWriters.exe" trying to access non-existent file "\Device\RasAcd" "GameBarPresenceWriters.exe" trying to access non-existent file "C:\B8396B01-49E1-1147-6C60-A648F6530149" "GameBarPresenceWriters.exe" trying to access non-existent file "C:\PROGRAM FILES (X86)(X86)" "GameBarPresenceWriters.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Publishers\B8396B01-49E1-1147-6C60-A648F6530149" "GameBarPresenceWriters.exe" trying to access non-existent file "C:\Program Files (x86)\Common Files\B8396B01-49E1-1147-6C60-A648F6530149" "ctfmon.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" "ctfmon.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}" "ctfmon.exe" trying to access non-existent file "\Device\RasAcd" "ctfmon.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\B8396B01-49E1-1147-6C60-A648F6530149" "ctfmon.exe" trying to access non-existent file "C:\powershell.exe.com" "ctfmon.exe" trying to access non-existent file "C:\powershell.exe.bat" "ctfmon.exe" trying to access non-existent file "C:\powershell.exe.cmd" "ctfmon.exe" trying to access non-existent file "C:\powershell.exe.vbs"4d:T4a1,"2.5.29.37" "2.5.29.35" "192.168.0.2" Potential IP "64.124.12.162" found in string "api-81556a20.duosecurity.com TRUE / TRUE 253402300799 hac|DUD6DIRR543N9IBROX6Q|DAZP9NPAYTJWJEMDJ86O |64.124.12.162|1531830438|a70d281e4438b3d8bfe84f32a61684be948d3b62" "2.5.29.15" "2.5.29.19" "2.5.29.14" "2.5.29.31" "2.5.29.16" "2.5.29.32" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "2.5.29.37" found in string "%2.5.29.37" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.17" "2.5.29.1" "2.5.4.5" "2.5.4.3" "2.5.4.6" "2.5.4.7" "2.5.4.10" "2.5.4.8" "2.5.4.11" "2.5.29.10" "1.3.6.1" "3.0.0.0" "1.1.0.1" Potential IP "4.0.0.0" found in string "Maximum number of drives allowed in a sessionnonon=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Potential IP "1.0.0.0" found in string "anagement.Infrastructure,1.0.0.0,,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.Commands.Management.resources,3.0.0.0,en-US,31bf3856ad364e35"4e:T2d33,Heuristic match: "/8n.aq" Heuristic match: "rv3.mx" Heuristic match: "or.tz" Heuristic match: "rl.ps" Heuristic match: "w7&.pt" Heuristic match: "hi.cu" Heuristic match: "&z7b.sn" Heuristic match: "q<.vu" Heuristic match: "*k.bj" Heuristic match: "uh.fr" Heuristic match: "deff.nelreports.net" Pattern match: "https://img-s-msn-com.akamaized.netaccess-control-request-method" Pattern match: "https://img-s-msn-com.akamaized.netuser-agent" Heuristic match: "px.ads.linkedin.com" Heuristic match: "trc.taboola.com" Heuristic match: "m.adnxs.com" Heuristic match: "edge-consumer-static.azureedge.net" Heuristic match: "clients2.googleusercontent.com" Heuristic match: "ib.adnxs.com" Heuristic match: "r.msftstatic.com" Heuristic match: "sb.scorecardresearch.com" Heuristic match: "??\c:\programdata\oracle\java\javapath\powershell.exe.com" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "??\c:\windows\system32\powershell.exe.com" Pattern match: "http://o.pki.goog/wr20%" Pattern match: "http://i.pki.goog/wr2.crt0" Heuristic match: "dns.google.com" Heuristic match: "*.dns.google.com" Pattern match: "http://c.pki.goog/wr2/gsyt1n4pbrg.crl0" Heuristic match: "ma.aw" Pattern match: "http://i.pki.goog/r1.crt0+" Pattern match: "http://c.pki.goog/r/r1.crl0" Pattern match: "http://ocsp.pki.goog/gsr10" Pattern match: "http://pki.goog/gsr1/gsr1.crt02" Pattern match: "http://crl.pki.goog/gsr1/gsr1.crl0" Pattern match: "i.goog/r/gsr1.crl0" Pattern match: "http://i.pki.goog/we1.crt0#" Heuristic match: "salator.es" Pattern match: "http://c.pki.goog/we1/pig1fj9hzew.crl0" Pattern match: "http://i.pki.goog/r4.crt0+" Pattern match: "http://c.pki.goog/r/r4.crl0" Pattern match: "http://i.pki.goog/gsr1.crt0-" Pattern match: "http://c.pki.goog/r/gsr1.crl0" Heuristic match: "ww.at" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=wrmqzzfvr%2fwkc%2bdyoenzv7h0hu%2f5q%2ffhsvhgd2wd%2boyuix2hga7vx9buvfy9%2fidfkz1f83asbsdkf26heqd%2fgulzjrens%2fswfmb6hkjevwgqy31ggqparviwu6zrwj%2fwjaekmlyyhz%2busdkkgsa7dxkdqg%3d%3d" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=4vo2ci%2btzgq5i9hfetemucb%2fislb%2f8dicavbp%2bfgdaqjkwoei%2f6jnt76hxib4qi%2b%2fpbszymqpylzvhw0t5yxkypfymoyuankfmr94ed6csjq%2bii9tqdv%2f6vsme7fvxyf6slqyd5jvg%3d%3d" Pattern match: "http://c.pki.goog/r/gsr1.crl" Pattern match: "www.google.com" Pattern match: "github.com/ncruces/go-sqlite3.pointer" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=d1o5vw5z%2brt7w4h0lqxsutsvs7hihd7xaazjcvblifv3ikzeu6r%2brveleg%2feauqai4bm7plwcedyrrqrpfforlixatr01nxbsljhn6qt6kmejjqjhxj07zhlztbqjmmakgd%2b0zkoeutecz%2bp1xuvkczxmg%3d%3d" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%20ev%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist" Pattern match: "www.entrust.net/cps_2048" Pattern match: "www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl" Pattern match: "http://crl.comodoca.com/aaacertificateservices.crl" Pattern match: "http://crl.usertrust.com/utn-userfirst-object.crl" Pattern match: "www.camerfirma.com/address" Heuristic match: "secom trust.net" Heuristic match: "entrust.net" Pattern match: "www.digicert.com" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "www.xrampsecurity.com1$0" Pattern match: "http://crl.xrampsecurity.com/xgca.crl0" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%20ev%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0f" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0c" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0" Pattern match: "http://crl.securetrust.com/stca.crl" Pattern match: "www.entrust.net/cps" Pattern match: "http://crl.xrampsecurity.com/xgca.crl" Pattern match: "http://www.usertrust.com1" Pattern match: "www.xrampsecurity.com" Pattern match: "http://www.usertrust.comutn-userfirst-object" Pattern match: "http://www.chambersign.org10" Heuristic match: "putin@kremlin.ru" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://policy.camerfirma.com0" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "ntrust.net" Pattern match: "www.digicert.com1" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Heuristic match: "/crl.com" Heuristic match: "doca.com" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1+0" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "0www.entrust.net/cps" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://www.microsoft.com/windows" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "www.digicert.com1/0-" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526726" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526920" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraz" Pattern match: "icrosoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ndows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-appmanagement-appv-wow64-package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0x" Pattern match: "http://www.microsoft.com/pki/certs/microsofttimestamppca.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Pattern match: "microsoft.net/assembly/gac_32/microsoft.management.infrastructure.native/" Heuristic match: "icrosoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "icrosoft.powershell.co" Pattern match: "https://go.microsoft.com/fwlink/?linkid=623621" Pattern match: "http://www.g" Pattern match: "t.com/windows0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-2" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06"4f:T9d9c,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001408.00000000.120834.00F70000.00000004.mdmp") Found URL "http://o.pki.goog/wr20%http://i.pki.goog/wr2.crt0dns.googledns.google.com*.dns.google.com8888.googledns64.dns.googleh" - Source: "00000000-00001408.00000000.120834.0640E000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/gsyt1n4pbrg.crl0golf2u5o+ng" - Source: "00000000-00001408.00000000.120834.0640E000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/gsyt1n4pbrg.crl0golf2u5o" - Source: "00000000-00001408.00000000.120834.0640E000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00001408.00000000.120834.0640E000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o" - Source: "00000000-00001408.00000000.120834.0640E000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr10)http://pki.goog/gsr1/gsr1.crt02+0)0'!http://crl.pki.goog/gsr1/gsr1.crl0;40207okzgm=" - Source: "00000000-00001408.00000000.120834.0640E000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt0" - Source: "00000000-00001408.00000000.120834.0648C000.00000004.mdmp") Found URL "http://c.pki.goog/we1/pig1fj9hzew.crl0hi+o$mq)," - Source: "00000000-00001408.00000000.120834.0648C000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00001408.00000000.120834.0648C000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00001408.00000000.120834.0648C000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00001408.00000000.120834.0648C000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:[+afqvbqqgeaaadqjj3farxreyx6ambpwpfraqaaaiqz9oc/n3dagspuj6vzz+0qaaaahgaaae0aaqbjahiabwbzag8azgb0acaarqbkagcazqaaabbmaaaaaqaaiaaaaoch9kdeaufqzsdsiviyomysavkybrouj/t5d5cctbucaaaaaa6aaaaaagaaiaaaaokfabd95pi9gdv3zsdp2tgoynhpnaenpebty1i7jz4auaeaaabdkdfasv63lknrcomamtwzru20kput3yde5nvwg/ri3tmnepiewritdbf/oalouclzmmfasafljybbpqw4htxrj2wi54neihotjaoar4munjdgqsqcnjca5oqou3dlxvyza107u3invnpuhedexe4zioiuswvqqx+j/jfe0omono9wzcgka0bdkybjhhmqbvka58sekaig8cxvfjjcgtrcmeffehexkjefgip/k8s69ujlugl/+igehftwgpenettu5nzd66v2j1rww25vj+m7ns4wt0m33nwyenhgyi6+uxtnvrtcpax74671o7yiwnkjouncnuqx/sawjaibk4zlll5xjvdcmavbr0l9+k5zsflza1u2v/bw4juvzkihgef7rix+mj5ei+61ns9mk+dpkquciw+bmnl5yt3feck1z070ekmseu8z4ms3cma94kaaaabtncf3me2ab65zvst2z1dyeetvoe+ecdba9t9muq48bdpwdpj5h6ywabkklnluv50r3wh0jdic2tx1e67delg4pgoogle" - Source: "00000000-00001408.00000000.120834.0648C000.00000004.mdmp") Found URL "http://c.pki.goog/we1/pig1fj9hzew.crl0hi+o$mq)globalsign" - Source: "00000000-00001408.00000000.120834.0648C000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:globalsign" - Source: "00000000-00001408.00000000.120834.0648C000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:9" - Source: "00000000-00001408.00000000.120834.0648C000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0grease" - Source: "00000000-00001408.00000000.120834.0648C000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=wrmqzzfvr%2fwkc%2bdyoenzv7h0hu%2f5q%2ffhsvhgd2wd%2boyuix2hga7vx9buvfy9%2fidfkz1f83asbsdkf26heqd%2fgulzjrens%2fswfmb6hkjevwgqy31ggqparviwu6zrwj%2fwjaekmlyyhz%2busdkkgsa7dxkdqg%3d%3d" - Source: "00000000-00001408.00000000.120834.06500000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=4vo2ci%2btzgq5i9hfetemucb%2fislb%2f8dicavbp%2bfgdaqjkwoei%2f6jnt76hxib4qi%2b%2fpbszymqpylzvhw0t5yxkypfymoyuankfmr94ed6csjq%2bii9tqdv%2f6vsme7fvxyf6slqyd5jvg%3d%3d" - Source: "00000000-00001408.00000000.120834.06500000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00001408.00000000.120834.06500000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00001408.00000000.120834.06500000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00001408.00000000.120834.06500000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl290220140000z0;1google" - Source: "00000000-00001408.00000000.120834.06500000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crlgrease" - Source: "00000000-00001408.00000000.120834.06500000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001408.00000001.122751.00F70000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001408.00000002.124672.00F70000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=d1o5vw5z%2brt7w4h0lqxsutsvs7hihd7xaazjcvblifv3ikzeu6r%2brveleg%2feauqai4bm7plwcedyrrqrpfforlixatr01nxbsljhn6qt6kmejjqjhxj07zhlztbqjmmakgd%2b0zkoeutecz%2bp1xuvkczxmg%3d%3d" - Source: "00000000-00001408.00000002.124672.08E80000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002968.00000000.121198.037F0000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpm*vppc:\windows\system32\/drivers/etc/hostssetfilecompletionnotificationmodes" - Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found URL "http://policy.camerfirma.com0+,t" - Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcxszd2zxszd2z2.5.29.172.5.29.1pkcsy6?m2.5.4.52.5.4.32.5.4.6r=$q2.5.4.72.5.4.102.5.4.82.5.4.11*dpcz!frq2.5.29.10thawte," - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0txy" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lus1" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004432.00000000.121075.009E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004432.00000000.121075.009E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004432.00000000.121075.009E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004432.00000000.121075.06F32000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004432.00000000.121075.06F32000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004432.00000000.121075.06F32000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lt8'btx$ct8acth$ctx" - Source: "00000000-00004432.00000000.121075.06F32000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00004432.00000000.121075.06F32000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00004432.00000000.121075.06F32000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00004432.00000000.121075.06F32000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraz06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004432.00000000.121075.06F32000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004432.00000000.121075.06F32000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004432.00000000.121075.6FA51000.00000020.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcxszd2zxszd2z2.5.29.172.5.29.1pkcs2.5.4.52.5.4.32.5.4.6r=$q2.5.4.72.5.4.102.5.4.82.5.4.113*pl3*pg2.5.29.10thawte," - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0washington1redmond1microsoft" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0txy" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lus1" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00004432.00000001.122995.00550000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004432.00000001.122995.06F32000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004432.00000001.122995.06F32000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004432.00000001.122995.06F32000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lt8'btx$ct8acth$ctx" - Source: "00000000-00004432.00000001.122995.06F32000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004432.00000001.122995.06F32000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0^" - Source: "00000000-00004432.00000001.122995.06F32000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.x^od[lqt[lq\[lq\[lqd[lqd[lql[lql[lqt[lql[lq%" - Source: "00000000-00004432.00000001.122995.06F32000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00004432.00000001.122995.6F391000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00004432.00000001.122995.6F391000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00004432.00000001.122995.6F391000.00000020.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004432.00000002.123099.00550000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcxszd2zxszd2z2.5.29.172.5.29.1pkcs2.5.4.52.5.4.32.5.4.6r=$q2.5.4.72.5.4.102.5.4.82.5.4.113*pl3*pg2.5.29.10thawte," - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0washington1redmond1microsoft" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0txy" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lus1" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004432.00000002.123099.06F32000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004432.00000002.123099.06F32000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004432.00000002.123099.06F32000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lt8'btx$ct8acth$ctx" - Source: "00000000-00004432.00000002.123099.06F32000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004432.00000002.123099.06F32000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0^" - Source: "00000000-00004432.00000002.123099.06F32000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.x^od[lqt[lq\[lq\[lqd[lqd[lql[lql[lqt[lql[lq%" - Source: "00000000-00004432.00000002.123099.06FBB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0asyc" - Source: "00000000-00004432.00000002.123099.07F5F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00004432.00000002.123099.07F5F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0$%'%" - Source: "00000000-00004432.00000002.123099.07F5F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0x&" - Source: "00000000-00004432.00000002.123099.07F5F000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004432.00000002.123099.07F5F000.00000004.mdmp") Found URL "http://www.gt.com/windows0at-kt20170929063406.466z0washington1redmond1microsoft" - Source: "00000000-00004432.00000002.123099.07F5F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-21http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004432.00000002.123099.07F5F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0washington1redmond1microsoft" - Source: "00000000-00004432.00000002.123099.07F5F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06lql9lqc:lqc@lqc;lqc" (Indicator: "GetDC"; Source: "00000000-00001408.00000000.120834.00F70000.00000004.mdmp, 00000000-00001408.00000001.122751.00F70000.00000004.mdmp, 00000000-00001408.00000002.124672.00F70000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001408.00000000.120834.00F70000.00000004.mdmp, 00000000-00001408.00000001.122751.00F70000.00000004.mdmp, 00000000-00001408.00000002.124672.00F70000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001408.00000000.120834.00F70000.00000004.mdmp, 00000000-00001408.00000001.122751.00F70000.00000004.mdmp, 00000000-00001408.00000002.124672.00F70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001408.00000000.120834.00F70000.00000004.mdmp, 00000000-00001408.00000001.122751.00F70000.00000004.mdmp, 00000000-00001408.00000002.124672.00F70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001408.00000000.120834.00F70000.00000004.mdmp, 00000000-00001408.00000001.122751.00F70000.00000004.mdmp, 00000000-00001408.00000002.124672.00F70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001408.00000000.120834.00F70000.00000004.mdmp, 00000000-00001408.00000001.122751.00F70000.00000004.mdmp, 00000000-00001408.00000002.124672.00F70000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001408.00000000.120834.00F70000.00000004.mdmp, 00000000-00001408.00000001.122751.00F70000.00000004.mdmp, 00000000-00001408.00000002.124672.00F70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001408.00000000.120834.00F70000.00000004.mdmp, 00000000-00001408.00000001.122751.00F70000.00000004.mdmp, 00000000-00001408.00000002.124672.00F70000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002968.00000000.121198.037F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002968.00000000.121198.037F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002968.00000000.121198.037F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002968.00000000.121198.037F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002968.00000000.121198.037F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002968.00000000.121198.037F0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002968.00000000.121198.037F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002968.00000000.121198.037F0000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002968.00000000.121198.05C80000.00000004.mdmp")56:T1306,Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00004432.00000000.121075.00E81000.00000020.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00001408.00000001.122751.08E80000.00000004.mdmp, 00000000-00001408.00000002.124672.08E80000.00000004.mdmp") Found string "base64 accepts only blob or text" (Indicator: "base64"; Source: "00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp") Found string "blob from base64 may be too big" (Indicator: "base64"; Source: "00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp") Found string "blob expanded to base64 too big" (Indicator: "base64"; Source: "00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp") Found string "base64 OOM" (Indicator: "base64"; Source: "00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp") Found string "base64" (Indicator: "base64"; Source: "00000000-00001408.00000001.122751.27840000.00000004.mdmp, 00000000-00001408.00000002.124672.29870000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp, 00000000-00004432.00000001.122995.00550000.00000004.mdmp, 00000000-00004432.00000002.123099.00550000.00000004.mdmp, 00000000-00004432.00000002.123099.005FB000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004432.00000000.121075.00550000.00000004.mdmp, 00000000-00004432.00000001.122995.00550000.00000004.mdmp, 00000000-00004432.00000001.122995.06F32000.00000004.mdmp, 00000000-00004432.00000001.122995.07ED0000.00000004.mdmp, 00000000-00004432.00000002.123099.005FB000.00000004.mdmp, 00000000-00004432.00000002.123099.06F32000.00000004.mdmp, 00000000-00004432.00000002.123099.07ED0000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00004432.00000000.121075.00E81000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004432.00000000.121075.00E81000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004432.00000000.121075.00E81000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004432.00000000.121075.00E81000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004432.00000000.121075.00E81000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004432.00000000.121075.00E81000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004432.00000000.121075.00E81000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004432.00000000.121075.00E81000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004432.00000000.121075.00E81000.00000020.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00004432.00000000.121075.04620000.00000004.mdmp") Found string "[-WindowStyle