26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 67:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious FormBook.Generic Sample 89e0d97c3f6b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 89e0d97c3f6b…. Malware family: FormBook.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 21 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/89e0d97c3f6b79962f97e02152cff003f17d940f973d762874576dab2bc3a312","keywords":["Malicious","FormBook.Generic","malware analysis","sandbox report","threat intelligence","89e0d97c3f6b79962f97e02152cff003f17d940f973d762874576dab2bc3a312"],"about":{"@type":"SoftwareApplication","name":"PO54623.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"89e0d97c3f6b79962f97e02152cff003f17d940f973d762874576dab2bc3a312","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"FormBook.Generic","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":21,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T858,Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "DataGridViewTriState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "set_ReadOnly" (Indicator: "read"; Source: "sample.bin"), Found reference to API "AcceptChanges" (Indicator: "accept"; Source: "sample.bin"), Found reference to API "set_SelectionForeColor" (Indicator: "select"; Source: "sample.bin"), Found reference to API "set_TabIndex" (Indicator: "bind"; Source: "sample.bin"), Found reference to API "EditorBrowsableState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "DbConnection" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "SELECT ma_so AS N'M" (Indicator: "select"; Source: "sample.bin"), Found reference to API "System.Runtime.Versioning" (Indicator: "time"; Source: "sample.bin"), Found reference to API "btnPause_Click" (Indicator: "pause"; Source: "sample.bin"), Found reference to API "isPause" (Indicator: "pause"; Source: "sample.bin"), Found reference to API "RuntimeCompatibilityAttribute" (Indicator: "time"; Source: "sample.bin"), Found reference to API "timer1" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Synchronized" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "btnPause" (Indicator: "pause"; Source: "sample.bin"), Found reference to API "set_SelectionBackColor" (Indicator: "select"; Source: "sample.bin"), Found reference to API "DataGridViewSelectionMode" (Indicator: "select"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=22" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "RuntimeFieldHandle" (Indicator: "time"; Source: "sample.bin"), Found reference to API "SqlConnection" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "Close" (Indicator: "close"; Source: "sample.bin"), Found reference to API "Clone" (Indicator: "clone"; Source: "sample.bin"), Found reference to API "link" (Indicator: "link"; Source: "sample.bin"), Found reference to API "/pause.png" (Indicator: "pause"; Source: "sample.bin")28:Tc98,Found string - function Xn(a){switch(a){case "true":return!0;case "false":return!1;case "null":return null;case "undefined":break;default:try{var b=a.match(/^(?:'(.*)'|"(.*)")$/);if(b)return b[1]||b[2]||"";if(/^[-+]?\d*(\.\d+)?$/.test(a)){var c=parseFloat(a);return c===c?c:void 0}}catch(d){}}};function Yn(a){if(a.google_ad_client)return String(a.google_ad_client);var b,c,d,e,f;if(null!=(e=null!=(d=null==(b=X(a).head_tag_slot_vars)?void 0:b.google_ad_client)?d:null==(c=a.document.querySelector(".adsbygoogle[data-ad-client]"))?void 0:c.getAttribute("data-ad-client")))b=e;else{b:{b=a.document.getElementsByTagName("script");a=a.navigator&&a.navigator.userAgent||"";a=RegExp("appbankapppuzdradb|daumapps|fban|fbios|fbav|fb_iab|gsa/|messengerforios|naver|niftyappmobile|nonavigation|pinterest|twitter|ucbrowser|yjnewsapp|youtube",; Source: "f_3_.txt"), Found string - e>>6&63,128|e&63))}b=new Uint8Array(c)}return b},Gh=/[0-9`~!@#$%^&*()_\-+=:;<>,.?|/\\[\]]/g,Jh=/^\S+@\S+\.\S+$/,Hh=/^\+\d{10,15}$/,Ch=/[.~]/g,Qh=/^[0-9A-Za-z_-]{43}$/,Oh=/^[0-9A-Fa-f]{64}$/,Rh={},Sh=(Rh.email="em",Rh.phone_number="pn",Rh.first_name="fn",Rh.last_name="ln",Rh.street="sa",Rh.city="ct",Rh.region="rg",Rh.country="co",Rh.postal_code="pc",Rh.error_code="ec",Rh),Th={},Uh=(Th.email="sha256_email_address",Th.phone_number="sha256_phone_number",Th.first_name="sha256_first_name",Th.last_name=; Source: "js_4_.js"), Found string - function uK(a){switch(a){case "true":return!0;case "false":return!1;case "null":return null;case "undefined":break;default:try{var b=a.match(/^(?:'(.*)'|"(.*)")$/);if(b)return b[1]||b[2]||"";if(/^[-+]?\d*(\.\d+)?$/.test(a)){var c=parseFloat(a);return c===c?c:void 0}}catch(d){}}};function vK(a){S.call(this);this.win=a;this.i=0;this.g=new u.Map}A(vK,S);function wK(a){a.win.document.visibilityState?xK(a,a.win.document,"visibilitychange",function(b){"hidden"===a.win.document.visibilityState&&yK(a,b);"visible"===a.win.document.visibilityState&&(a.i=0)}):"onpagehide"in a.win?(xK(a,a.win,"pagehide",function(b){yK(a,b)}) xK(a,a.win,"pageshow",function(){a.i=0})):xK(a,a.win,"beforeunload",function(b){yK(a,b)})}; Source: "f_3_.txt") Found string - "x"+bi.screen.height}Tc=Tc+Pe+(al||"");for($h=Tc.length;0ca.length;){Z=ca;ab=Z.push;Ca=X;var bb=new Xn;bb=Qj(bb,1,Ca.tagName);""!==Ca.className&&lj(bb,2,Ca.className.split(" ") ; Source: "f_3_.txt")29:T7fe,"powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF103df5.TMP" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LWDFRJFDT1OPULQ1YX0P.temp" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF106d14.TMP" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1BGDI2JCPY8OSRFHP7GX.temp" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF10a579.TMP" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AX05W37HBZD9AY3Y91KS.temp" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF10cc5a.TMP" "powershell.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Z8VX4JU1VZM1BYX8RYCV.temp" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms"2a:T6f2,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f6cc0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d0701e00"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f6cc0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "50741e00"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f6cc0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "50761e00"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1f6cc0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d0751e00"}2b:Tc63f,Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2Bholo77zGjGxETUEQQU8JyF" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEAHqRFnqJyQkmYqUpX34D7k%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEAHqRFnqJyQkmYqUpX34D7k%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEAHqRFnqJyQkmYqUpX34D7k%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEAHqRFnqJyQkmYqUpX34D7k%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEAHqRFnqJyQkmYqUpX34D7k%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /r.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: s.ss2.us" Contains base64 string in header "User" in header "GET /r.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: s.ss2.us" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "Keep" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "User" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "Keep" in header "GET /rootg2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /rootg2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootg2.amazontrust.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "/rootca1" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "2BsKuKwH5CO65xMY" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "2BHhJmodADfw" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCZXmpIP%2Bo%2BHhJmodADfw%2Fc HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCZXmpIP%2Bo%2BHhJmodADfw%2Fc HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCZXmpIP%2Bo%2BHhJmodADfw%2Fc HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCZXmpIP%2Bo%2BHhJmodADfw%2Fc HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCZXmpIP%2Bo%2BHhJmodADfw%2Fc HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2BqGaCjIQPyd58u0" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGupzMnM%2BqGaCjIQPyd58u0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGupzMnM%2BqGaCjIQPyd58u0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGupzMnM%2BqGaCjIQPyd58u0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGupzMnM%2BqGaCjIQPyd58u0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGupzMnM%2BqGaCjIQPyd58u0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "/gtsr1/gtsr1" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "User" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "digicert" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BWU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "50dd7b0f" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5298608&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CEGFjzswB..html&rnd=1703150114569 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "4105" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5298608&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CEGFjzswB..html&rnd=1703150114569 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "441f" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5298608&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CEGFjzswB..html&rnd=1703150114569 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "8f60" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5298608&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CEGFjzswB..html&rnd=1703150114569 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "18cc3fcb090c" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5298608&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CEGFjzswB..html&rnd=1703150114569 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "page" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5298608&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CEGFjzswB..html&rnd=1703150114569 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "file" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5298608&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CEGFjzswB..html&rnd=1703150114569 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "html" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5298608&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CEGFjzswB..html&rnd=1703150114569 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Language" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5298608&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CEGFjzswB..html&rnd=1703150114569 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "like" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5298608&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CEGFjzswB..html&rnd=1703150114569 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5298608&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CEGFjzswB..html&rnd=1703150114569 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5298608&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CEGFjzswB..html&rnd=1703150114569 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "bepolite" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5298608&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CEGFjzswB..html&rnd=1703150114569 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5298608&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CEGFjzswB..html&rnd=1703150114569 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "50dd7b0f" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1610915&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CjiHIxmFzC.html&rnd=1703149448191 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "4105" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1610915&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CjiHIxmFzC.html&rnd=1703149448191 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "441f" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1610915&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CjiHIxmFzC.html&rnd=1703149448191 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "8f60" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1610915&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CjiHIxmFzC.html&rnd=1703149448191 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "18cc3fcb090c" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1610915&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CjiHIxmFzC.html&rnd=1703149448191 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "page" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1610915&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CjiHIxmFzC.html&rnd=1703149448191 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "file" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1610915&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CjiHIxmFzC.html&rnd=1703149448191 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "html" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1610915&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CjiHIxmFzC.html&rnd=1703149448191 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Language" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1610915&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CjiHIxmFzC.html&rnd=1703149448191 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "like" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1610915&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CjiHIxmFzC.html&rnd=1703149448191 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1610915&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CjiHIxmFzC.html&rnd=1703149448191 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1610915&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CjiHIxmFzC.html&rnd=1703149448191 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "bepolite" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1610915&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CjiHIxmFzC.html&rnd=1703149448191 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1610915&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CjiHIxmFzC.html&rnd=1703149448191 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHvwlxZ6tgTQmj1PR%2BmThA HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHvwlxZ6tgTQmj1PR%2BmThA HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHvwlxZ6tgTQmj1PR%2BmThA HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHvwlxZ6tgTQmj1PR%2BmThA HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDEixfO34qnbCeE6N8VMp00%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "50dd7b0f" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=3786623&screen_width=750&screen_height=368&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvFfIxHmjC.html&rnd=1703154382325 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "4105" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=3786623&screen_width=750&screen_height=368&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvFfIxHmjC.html&rnd=1703154382325 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "441f" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=3786623&screen_width=750&screen_height=368&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvFfIxHmjC.html&rnd=1703154382325 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "8f60" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=3786623&screen_width=750&screen_height=368&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvFfIxHmjC.html&rnd=1703154382325 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "18cc3fcb090c" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=3786623&screen_width=750&screen_height=368&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvFfIxHmjC.html&rnd=1703154382325 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "page" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=3786623&screen_width=750&screen_height=368&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvFfIxHmjC.html&rnd=1703154382325 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "file" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=3786623&screen_width=750&screen_height=368&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvFfIxHmjC.html&rnd=1703154382325 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "html" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=3786623&screen_width=750&screen_height=368&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvFfIxHmjC.html&rnd=1703154382325 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Language" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=3786623&screen_width=750&screen_height=368&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvFfIxHmjC.html&rnd=1703154382325 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "like" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=3786623&screen_width=750&screen_height=368&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvFfIxHmjC.html&rnd=1703154382325 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=3786623&screen_width=750&screen_height=368&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvFfIxHmjC.html&rnd=1703154382325 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=3786623&screen_width=750&screen_height=368&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvFfIxHmjC.html&rnd=1703154382325 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "bepolite" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=3786623&screen_width=750&screen_height=368&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvFfIxHmjC.html&rnd=1703154382325 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=3786623&screen_width=750&screen_height=368&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CvFfIxHmjC.html&rnd=1703154382325 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "50dd7b0f" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6235173&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CakaihtmIB.html&rnd=1703158905029 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "4105" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6235173&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CakaihtmIB.html&rnd=1703158905029 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "441f" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6235173&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CakaihtmIB.html&rnd=1703158905029 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "8f60" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6235173&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CakaihtmIB.html&rnd=1703158905029 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "18cc3fcb090c" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6235173&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CakaihtmIB.html&rnd=1703158905029 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "page" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6235173&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CakaihtmIB.html&rnd=1703158905029 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "file" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6235173&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CakaihtmIB.html&rnd=1703158905029 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "html" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6235173&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CakaihtmIB.html&rnd=1703158905029 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Language" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6235173&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CakaihtmIB.html&rnd=1703158905029 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "like" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6235173&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CakaihtmIB.html&rnd=1703158905029 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6235173&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CakaihtmIB.html&rnd=1703158905029 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6235173&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CakaihtmIB.html&rnd=1703158905029 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "bepolite" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6235173&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CakaihtmIB.html&rnd=1703158905029 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6235173&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CakaihtmIB.html&rnd=1703158905029 HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: serving.bepolite.euDNT: 1Connection: Keep-Alive"2c:T5dc,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decrypt/decode data Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: HTTP request contains Base64 encoded artifacts Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2d:T9da,"PO54623.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002540) "PO54623.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002540) "PO54623.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002b0000000000442b2b00000000008504000000000000a02a2b001904000038202f0000000000990400001800010180000000432ac96c38f1160095e1ae77139718000000000002000002289b2e00f63f00c938202f000100000000000000ff07000030202f00f63f00c938202f000100000000000000020000000c00000070f72e0070f72e006bf72e0000000000e4f0160000002b0038202f0128f01600f0f0160048f6160095e1ae7733971800feffffff435cb2775059b27794000000a00000006af72e0068f72e0094000000ccf11600fdfe5077b00d000074f1160078f11600 (UID: 00000000-00002540) "PO54623.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000cce61600000000000600000000001c65f8e6160002000040fce81600fce816001a12b47700000000e4e616000000000018d02d000203b477000200008801b4770000000040e91600a401b4770000000000000000000000015500530045005200330032002e0064006c006c0000000000000000000000ad770000ad7700000000aae71600d000ad77cce61600a8e71600f4e7160095e1ae77f38d1800fefffffff5f6b27716f8b277e01c2b00aae71600a0e71600a0e716000100000004e816009ef8b277626fb27764f8b2771f6dbc7774121c6564e81600000000000000ad77 (UID: 00000000-00002540)2e:T1d5c,"PO54623.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100342c2c4973576f77363450726f636573732c6b65726e656c33322e646c6c2c223235323a30333a30382e333930222c52583d302c50583d30003000616c2c205075626c69634b6579546f6b656e3d623033663566376631316435306133612220616c6c6f77446566696e6974696f6e3d22 (UID: 00000000-00002540) "PO54623.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f5f6b277876dbc77f42e236518d02d00a0352365776dbc77c4e8160020bc2d00b2f4b277676dbc77d4e8160000001c6500001c650000000030e81600f0000000f0001c650000000040e8160053000000d4e916000000000001000000a4e8160040f5b277000000000000000090e81600 (UID: 00000000-00002540) "PO54623.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c474874f03934008c47487400000000f03934008cdf1600086db2771881ba770000000040e0160000000000de541769ccdf160095e1ae77db941800feffffff6b2cb3773119a675021000000000000000000100a0df1600c89fb2778c4748740000000000000000 (UID: 00000000-00002540) "PO54623.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002540) "PO54623.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002540) "PO54623.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb5f7710b9350000f0fd7f9a5cb37700e0fd7f08dd160044f0fd7f00000000400000003f0000002200000000f0fd7ffcdc1600c15cb3776082ba772200000000f0fd7f9a5cb37700e0fd7f20dd16005789b2778083ba771317a675d8eb5f77 (UID: 00000000-00002540) "PO54623.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000c0822d005cf82700145cb277435cb27728f927000100000094012b0001000000dcf72700935cb3774083ba77d4a0b277c7728d7728f92700010000000100000018bf2d0000000000acf72700dcf7270048f8270095e1ae77e3811800feffffffd4a0b2771bbea5750000fb7600000000 (UID: 00000000-00002540) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb5f7740f920000030fd7f9a5cb37700f0fd7fa8bb12004430fd7f00000000400000003f0000001e0000000030fd7f9cbb1200c15cb3776082ba771e0000000030fd7f9a5cb37700f0fd7fc0bb12005789b2778083ba771317a675d8eb5f77 (UID: 00000000-00003100) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e00690066006500730074000000 (UID: 00000000-00003100) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000636d986400000a02000000006c6d9864e0cfbebcd8d7f8644ceb120048eb120000000000000000000000000000000000d8d7f864a0ea12000000000010eb12004ceb1200e0ea1200ff239864c83ba16420eb120031179864080000001c5cb17714a1b277ffffffff2400000008eb1200 (UID: 00000000-00003100) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003100) "PO54623.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003776) "PO54623.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb5f77e846230000f0fd7f9a5cb37700e0fd7fb8e91d0044f0fd7f00000000400000003f0000001c00000000f0fd7face91d00c15cb3776082ba771c00000000f0fd7f9a5cb37700e0fd7fd0e91d005789b2778083ba771317a675d8eb5f77 (UID: 00000000-00003776) "PO54623.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000095e1ae777eb51800fefffffff5f6b277634db377c86b21008ef1ea6cbce4ea00b2f4b2779244b7775cf91d000000ea6c0000ea6c804db377b644b777e0000000e000ea6c00000000c8f81d005c12ea6c5cfa1d0000000000010000002cf91d0040f5b277000000000000000018f91d00 (UID: 00000000-00003776) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb5f7750e633000090fd7f9a5cb37700f0fd7fb8b716004490fd7f00000000400000003f0000001e0000000090fd7facb71600c15cb3776082ba771e0000000090fd7f9a5cb37700f0fd7fd0b716005789b2778083ba771317a675d8eb5f77 (UID: 00000000-00002064) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e00690066006500730074000000 (UID: 00000000-00002064) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000636dd46c00006801000000006c6dd46cd92d3f97d8d77e695ce7160058e7160000000000000000000000000000000000d8d77e69b0e616000000000020e716005ce71600f0e61600ff23d46cc83bdd6c30e716003117d46c080000001c5cb17714a1b277ffffffff2400000018e71600 (UID: 00000000-00002064) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002064) "Bins.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031002c2c4973576f77363450726f636573732c6b65726e656c33322e646c6c2c223235323a30333a32352e373936222c52583d302c50583d30003000626c69634b6579546f6b650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001120) "Bins.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001120)2f:T718,"Bins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "Bins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "Bins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "Bins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "Bins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "Bins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Bins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Bins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Bins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Bins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")30:T5c8,"PO54623.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "PO54623.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "PO54623.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "PO54623.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "PO54623.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "APPENDPATH") "PO54623.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH") "PO54623.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\PO54623.EXE") "PO54623.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\PO54623.EXE") "Bins.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "APPENDPATH") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH") "Bins.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "Bins.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE")31:T59f,"powershell.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LWDFRJFDT1OPULQ1YX0P.TEMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LWDFRJFDT1OPULQ1YX0P.temp" "powershell.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF103df5.TMP" "powershell.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1BGDI2JCPY8OSRFHP7GX.TEMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1BGDI2JCPY8OSRFHP7GX.temp" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF106d14.TMP"32:T96d,"Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "Bins.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "Bins.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")33:T4df,"Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\02FAF3E291435468607857694DF5E45B68851868"; Key: "BLOB") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\039EEDB80BE7A03C6953893B20D2D9323A4C2AFD"; Key: "BLOB") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\07E032E020B72C3F192F0628A2593A19A70F069E"; Key: "BLOB") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\2796BAE63F1801E277261BA0D77770028F20EEE4"; Key: "BLOB") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\323C118E1BF7B8B65254E2E2100DD6029037F096"; Key: "BLOB") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\3679CA35668772304D30A5FB873B0FA77BB70D54"; Key: "BLOB") "Bins.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F"; Key: "BLOB")34:T9d9,"PO54623.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002540) "PO54623.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002540) "PO54623.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002540) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003100) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00003100) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003100) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003100) "PO54623.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\Microsoft DN1 (UID: 00000000-00003776) "PO54623.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft Vision\ (UID: 00000000-00003776) "PO54623.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\Documents (UID: 00000000-00003776) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002064) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00002064) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002064) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002064) "Bins.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001120) "Bins.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001120) "Bins.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00001120) "powershell.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003864) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations (UID: 00000000-00003864) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003864) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003864) "Bins.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\Microsoft DN1 (UID: 00000000-00001968)35:T6ad,"PO54623.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\schtasks.exe" /Create /TN "Updates\xzYPjfkAQ" /XML "%TEMP%\tmp3049.tmp"" - (UID: 00000000-00002540) "PO54623.exe" called "CreateProcessA" with parameter "C:\PO54623.exe" - (UID: 00000000-00002540) "PO54623.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%APPDATA%\xzYP" - (UID: 00000000-00002540), "PO54623.exe" called "CreateProcessA" with parameter "powershell Add-MpPreference -ExclusionPath C:\" - (UID: 00000000-00003776), "PO54623.exe" called "CreateProcessW" with parameter "%USERPROFILE%\Documents\Bins.exe" - (UID: 00000000-00003776), "Bins.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\schtasks.exe" /Create /TN "Updates\xzYPjfkAQ" /XML "%TEMP%\tmp8743.tmp"" - (UID: 00000000-00001120), "Bins.exe" called "CreateProcessA" with parameter "%USERPROFILE%\Documents\Bins.exe" - (UID: 00000000-00001120), "Bins.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%APPDATA%\xzYP" - (UID: 00000000-00001120) "Bins.exe" called "CreateProcessA" with parameter "powershell Add-MpPreference -ExclusionPath C:\" - (UID: 00000000-00001968) "Bins.exe" called "CreateProcessW" with parameter ""%TEMP%\135.exe"" - (UID: 00000000-00001968) "Bins.exe" called "CreateProcessW" with parameter ""C:\Program Files\Internet Explorer\iexplore.exe" %APPDATA%\jiHIxmFzC.html" - (UID: 00000000-00001968) "Bins.exe" called "CreateProcessW" with parameter ""C:\Program Files\Internet Explorer\iexplore.exe" %APPDATA%\EGFjzswB..html" - (UID: 00000000-00001968)36:T1028a,"PO54623.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002540) "PO54623.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8229f0505633d4bcef019b9d4fab9f18\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.A#\84c47b5a5813a5f040aee9715a0ff7c0\System.Management.Automation. (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\bd9ff1a4363781a57e8f7392f230a203\System.Core.ni.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\49cae79ac18bad142e1ab5a46a8ac306\Microsoft.PowerShell.Commands (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\d6acc39f6c1ea42d8b3150db6184a969\System.Configuration.Install. (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\fec007ea17ac8956cc5d6d4074dada6a\System.Transactions.ni.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f1831ce4588265a3f72e0a581ba58f2a\Microsoft.PowerShell.Commands (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\344e681515d07b93a4f1383f0d625e1e\Microsoft.PowerShell.Commands (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\573750f17b5b8316f04a10956fdd1d97\Microsoft.PowerShell.Security (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\237ed1739105c1bebe48d41905fdb3ee\System.DirectoryServices.ni.d (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\511c39d1efa06d262a6b2f47e2726c73\System.Data.ni.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00003100) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003100) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003804) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003804) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003804) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003804) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\schtasks.exe (UID: 00000000-00003804) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003804) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003804) "PO54623.exe" called "LoadLibrary" with a parameter USER32.DLL (UID: 00000000-00003776) "PO54623.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003776) "PO54623.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003776) "PO54623.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00003776) "PO54623.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003776) "PO54623.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003776) "PO54623.exe" called "LoadLibrary" with a parameter msdmo.dll (UID: 00000000-00003776) "PO54623.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003776) "PO54623.exe" called "LoadLibrary" with a parameter avicap32.dll (UID: 00000000-00003776) "PO54623.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00003776) "PO54623.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003776) "PO54623.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003776) "PO54623.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003776) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8229f0505633d4bcef019b9d4fab9f18\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.A#\84c47b5a5813a5f040aee9715a0ff7c0\System.Management.Automation. (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\bd9ff1a4363781a57e8f7392f230a203\System.Core.ni.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\49cae79ac18bad142e1ab5a46a8ac306\Microsoft.PowerShell.Commands (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\d6acc39f6c1ea42d8b3150db6184a969\System.Configuration.Install. (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\fec007ea17ac8956cc5d6d4074dada6a\System.Transactions.ni.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f1831ce4588265a3f72e0a581ba58f2a\Microsoft.PowerShell.Commands (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\344e681515d07b93a4f1383f0d625e1e\Microsoft.PowerShell.Commands (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\573750f17b5b8316f04a10956fdd1d97\Microsoft.PowerShell.Security (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\237ed1739105c1bebe48d41905fdb3ee\System.DirectoryServices.ni.d (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\511c39d1efa06d262a6b2f47e2726c73\System.Data.ni.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll (UID: 00000000-00002064) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002064) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001120) "Bins.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8229f0505633d4bcef019b9d4fab9f18\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.A#\84c47b5a5813a5f040aee9715a0ff7c0\System.Management.Automation. (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\bd9ff1a4363781a57e8f7392f230a203\System.Core.ni.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\49cae79ac18bad142e1ab5a46a8ac306\Microsoft.PowerShell.Commands (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\d6acc39f6c1ea42d8b3150db6184a969\System.Configuration.Install. (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\fec007ea17ac8956cc5d6d4074dada6a\System.Transactions.ni.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f1831ce4588265a3f72e0a581ba58f2a\Microsoft.PowerShell.Commands (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\344e681515d07b93a4f1383f0d625e1e\Microsoft.PowerShell.Commands (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\573750f17b5b8316f04a10956fdd1d97\Microsoft.PowerShell.Security (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\237ed1739105c1bebe48d41905fdb3ee\System.DirectoryServices.ni.d (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003864) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00003864) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\schtasks.exe (UID: 00000000-00001984) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001984) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001984) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter USER32.DLL (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter msdmo.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter avicap32.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter Ws2_32.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\termsrv.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001968) "Bins.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00001968) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8229f0505633d4bcef019b9d4fab9f18\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.A#\84c47b5a5813a5f040aee9715a0ff7c0\System.Management.Automation. (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\bd9ff1a4363781a57e8f7392f230a203\System.Core.ni.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\49cae79ac18bad142e1ab5a46a8ac306\Microsoft.PowerShell.Commands (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\d6acc39f6c1ea42d8b3150db6184a969\System.Configuration.Install. (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\fec007ea17ac8956cc5d6d4074dada6a\System.Transactions.ni.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f1831ce4588265a3f72e0a581ba58f2a\Microsoft.PowerShell.Commands (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\344e681515d07b93a4f1383f0d625e1e\Microsoft.PowerShell.Commands (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\573750f17b5b8316f04a10956fdd1d97\Microsoft.PowerShell.Security (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\237ed1739105c1bebe48d41905fdb3ee\System.DirectoryServices.ni.d (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\511c39d1efa06d262a6b2f47e2726c73\System.Data.ni.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003168) "135.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001080) "netsh.exe" called "LoadLibrary" with a parameter NSHWFP.DLL (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter DHCPCMONITOR.DLL (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter Dhcpqec.dll (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter WSHELPER.DLL (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter NSHHTTP.DLL (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter FWCFG.DLL (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter AUTHFWCFG.DLL (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter IFMON.DLL (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter NETIOHLP.DLL (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter WHHELPER.DLL (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter HNETMON.DLL (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter RPCNSH.DLL (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter DOT3CFG.DLL (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter NAPMONTR.DLL (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter NSHIPSEC.DLL (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter NETTRACE.DLL (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter WCNNETSH.DLL (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter P2PNETSH.DLL (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter WLANCFG.DLL (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter WWANCFG.DLL (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter PEERDISTSH.DLL (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter HTTPAPI.dll (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002104) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002104)37:T79b,"sqlmap.dll" contains export function called "ServiceMain" at ordinal 1 "sqlmap.dll" contains export function called "SvchostPushServiceGlobals" at ordinal 2 "rfxvmt.dll" contains export function called "RfxVmtAcquireSharedBuffer" at ordinal 1 "rfxvmt.dll" contains export function called "RfxVmtCancelCreateChannel" at ordinal 2 "rfxvmt.dll" contains export function called "RfxVmtCloseChannel" at ordinal 3 "rfxvmt.dll" contains export function called "RfxVmtCreateChannel" at ordinal 4 "rfxvmt.dll" contains export function called "RfxVmtCreateChannelCancelable" at ordinal 5 "rfxvmt.dll" contains export function called "RfxVmtDisableLibrary" at ordinal 6 "rfxvmt.dll" contains export function called "RfxVmtEnableLibrary" at ordinal 7 "rfxvmt.dll" contains export function called "RfxVmtGetChannelStatus" at ordinal 8 "rfxvmt.dll" contains export function called "RfxVmtGetDataAvailableEvent" at ordinal 9 "rfxvmt.dll" contains export function called "RfxVmtGetVramDescriptor" at ordinal 10 "rfxvmt.dll" contains export function called "RfxVmtIsWriteDataConsumed" at ordinal 11 "rfxvmt.dll" contains export function called "RfxVmtPauseLibrary" at ordinal 12 "rfxvmt.dll" contains export function called "RfxVmtReadChannel" at ordinal 13 "rfxvmt.dll" contains export function called "RfxVmtReadChannelAndCache" at ordinal 14 "rfxvmt.dll" contains export function called "RfxVmtRegisterForVmTerminatedNotification" at ordinal 15 "rfxvmt.dll" contains export function called "RfxVmtReleaseSharedBuffer" at ordinal 16 "rfxvmt.dll" contains export function called "RfxVmtResumeLibrary" at ordinal 17 "rfxvmt.dll" contains export function called "RfxVmtRevokeSharedBuffer" at ordinal 18 "rfxvmt.dll" contains export function called "RfxVmtShareBuffer" at ordinal 19 "rfxvmt.dll" contains export function called "RfxVmtVWriteChannel" at ordinal 20 "rfxvmt.dll" contains export function called "RfxVmtWriteChannel" at ordinal 2138:T6fb,"\Opera Software\Opera Stable\Login Data" in Source: 00001968.000007B0.7943390.00419000.wprm "software\Aerofox\FoxmailPreview" in Source: 00001968.000007B0.7943390.00419000.wprm "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" in Source: 00001968.000007B0.7943390.00419000.wprm "SOFTWARE\_rptls" in Source: 00001968.000007B0.7943390.00419000.wprm "Software\Classes\Folder\shell\open\command" in Source: 00001968.000007B0.7943390.00419000.wprm "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00001968.000007B0.7943390.00419000.wprm "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001120.00000001.69598.00170000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001120.00000001.69598.00170000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001120.00000001.69598.00170000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001120.00000001.69598.00170000.00000004.mdmp "istry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00001968.00000000.69879.00700000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001968.00000001.71800.00700000.00000004.mdmp 00000000-00001968.00000002.73720.00700000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001968.00000001.71800.00700000.00000004.mdmp 00000000-00001968.00000002.73720.00700000.00000004.mdmp39:T149b,"PO54623.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "PO54623.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "PO54623.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "PO54623.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "PO54623.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "PO54623.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "PO54623.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "PO54623.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "PO54623.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "PO54623.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "PO54623.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "PO54623.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "PO54623.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "PO54623.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "Bins.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "135.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "netsh.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "netsh.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135]3a:T44da,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4839 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 21 Dec 2023 06:22:25 GMT Last-Modified: Thu 21 Dec 2023 05:01:46 GMT Server: ECAcc (sac/2570) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEAHqRFnqJyQkmYqUpX34D7k%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1228 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 21 Dec 2023 06:22:27 GMT Last-Modified: Thu 21 Dec 2023 06:01:59 GMT Server: ECAcc (sac/255F) X-Cache: HIT Content-Length: 727 with response body ==>308202D30A0100A08202CC308202C806092B0601050507300101048202B9308202B530819EA2160414F09C85FDA29F7D8FC968BBD5D4894D1DBED390FF180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3589 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 21 Dec 2023 06:22:50 GMT Last-Modified: Thu 21 Dec 2023 05:23:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /r.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: s.ss2.us" Response ==> HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 486 Connection: keep-alive Last-Modified: Wed 08 Nov 2023 23:31:41 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: vh9_.F5f0qUMnY3L0UoDMODo4pSLvpbc Accept-Ranges: bytes Server: AmazonS3 Date: Thu 21 Dec 2023 02:28:27 GMT ETag: "a8fb889989c036b9c5f50300861d295c" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 3dde68f1f52282c9e1ee336d97233b0a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO5-P2 X-Amz-Cf-Id: uj98XYHYw4s1Ym6XsTmV9rIJUosNj7khvHTTW12i1Xz9eVkn8xTZYQ== Age: 14074 with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 575 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 21 Dec 2023 06:23:00 GMT Last-Modified: Thu 21 Dec 2023 06:13:25 GMT Server: ECAcc (sac/254F) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: o.ss2.us" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 2065 Connection: keep-alive Server: Sucuri/Cloudproxy Date: Wed 20 Dec 2023 17:22:02 GMT X-Sucuri-ID: 11041 Content-Transfer-Encoding: Binary Cache-Control: public no-transform must-revalidate Last-Modified: Wed 20 Dec 2023 14:52:30 GMT Expires: Thu 21 Dec 2023 14:52:30 GMT ETag: "3fff78797cfdb8fa92dfc2566ca22616beebd6e1" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" X-Sucuri-Cache: EXPIRED X-Cache: Hit from cloudfront Via: 1.1 3ac908fbf7ece372aa92fb8586b6b0cc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO20-C1 X-Amz-Cf-Id: HAuVSWWASqqAISoQylIIrkP6BVgDr2FN3NeOuGOcq9vEEpUMeU_gHw== Age: 46858 with response body ==>....... "GET /rootg2.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 713 Connection: keep-alive Last-Modified: Tue 19 Dec 2023 14:32:06 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: EiLyfWbiUENPnDRPID7nN8VSQR7.ATIi Accept-Ranges: bytes Server: AmazonS3 Date: Thu 21 Dec 2023 03:08:16 GMT ETag: "17529b3e2cbd518730e68190e9f121a9" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a87319e8c7e956cbba29cd5f6931dbee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO53-C1 X-Amz-Cf-Id: lHCQPoKx4pqtZX-g9cLLqHp3O199RjzQlx5LV92oMVso7jk0pB3fxw== Age: 11685 with response body ==>....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 21 Dec 2023 05:41:51 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2469 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1426 Connection: keep-alive Date: Thu 21 Dec 2023 05:29:05 GMT Last-Modified: Thu 21 Dec 2023 05:29:05 GMT ETag: bcd33fcc85589d38a1583b70f29cfa34b3b3eac7 Expires: Thu 28 Dec 2023 05:29:05 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Server: with response body ==>....... "GET /rootca1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 651 Connection: keep-alive Last-Modified: Tue 19 Dec 2023 14:31:56 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: .ZkV25BdNGPSQbTBX9HUJUD8KvZN8SLs Accept-Ranges: bytes Server: AmazonS3 Date: Thu 21 Dec 2023 05:15:05 GMT ETag: "9058c82ab542b2701eb78e0a4e482593" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d32136caad5f6a80e6bec65185c2a290.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO5-P2 X-Amz-Cf-Id: Fdy8m6CA82uTgou51B_b3xVD079sRyYEn75QrUJmJQgeWDZGeauXbg== Age: 4077 with response body ==>....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1548 Connection: keep-alive Date: Thu 21 Dec 2023 05:54:51 GMT Last-Modified: Thu 21 Dec 2023 05:54:51 GMT ETag: 2b00bbf5c6e488fa5fd406ae34a8cef2ea6f78f4 Expires: Thu 28 Dec 2023 05:54:51 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Server: with response body ==>....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCZXmpIP%2Bo%2BHhJmodADfw%2Fc HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 21 Dec 2023 05:35:17 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2866 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGupzMnM%2BqGaCjIQPyd58u0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 21 Dec 2023 05:33:01 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3003 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 21 Dec 2023 05:40:49 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2535 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4878 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 21 Dec 2023 06:23:04 GMT Last-Modified: Thu 21 Dec 2023 05:01:46 GMT Server: ECAcc (sac/2570) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 18235 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu 21 Dec 2023 05:36:38 GMT Expires: Thu 21 Dec 2023 06:26:38 GMT Cache-Control: public max-age=3000 Age: 2787 Last-Modified: Thu 21 Dec 2023 01:38:51 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308247373082461F020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/moVDfISia2k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 18448 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu 21 Dec 2023 06:21:08 GMT Expires: Thu 21 Dec 2023 07:11:08 GMT Cache-Control: public max-age=3000 Age: 117 Last-Modified: Thu 21 Dec 2023 02:22:41 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>3082480C308246F4020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 854 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu 21 Dec 2023 05:59:40 GMT Expires: Thu 21 Dec 2023 06:49:40 GMT Cache-Control: public max-age=3000 Age: 1407 Last-Modified: Mon 18 Sep 2023 16:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308203523082013A020101300D06092A864886F70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 149636 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Thu 21 Dec 2023 06:23:12 GMT Etag: "614b5ba7-243" expires: Sat 23 Dec 2023 06:23:12 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 149637 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Thu 21 Dec 2023 06:23:13 GMT Etag: "614b5ba7-243" expires: Sat 23 Dec 2023 06:23:13 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1964 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Thu 21 Dec 2023 06:23:17 GMT Last-Modified: Thu 21 Dec 2023 05:50:33 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 314 with response body ==>308201360A0100A082012F3082012B06092B06010505073001010482011C3082011830819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32....... "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5298608&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CEGFjzswB..html&rnd=1703150114569 HTTP/1.1 Accept: application/javascript, */*;q=0.8 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: serving.bepolite.eu DNT: 1 Connection: Keep-Alive" Response ==> HTTP/1.1 302 Found Date: Thu 21 Dec 2023 06:21:32 GMT Server: Varnish X-Varnish: 398886089 Location: https://serving.bepolite.eu/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=5298608&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CEGFjzswB..html&rnd=1703150114569 Content-Length: 0 Connection: keep-alive with response body ==>....... "GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1610915&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CjiHIxmFzC.html&rnd=1703149448191 HTTP/1.1 Accept: application/javascript, */*;q=0.8 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: serving.bepolite.eu DNT: 1 Connection: Keep-Alive" Response ==> HTTP/1.1 302 Found Date: Thu 21 Dec 2023 06:21:32 GMT Server: Varnish X-Varnish: 398790242 Location: https://serving.bepolite.eu/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=1610915&screen_width=750&screen_height=346&os=Win32&refurl=&pageurl=file%3A%2F%2FC%3A%5CUsers%5CHAPUBWS%5CAppData%5CRoaming%5CjiHIxmFzC.html&rnd=1703149448191 Content-Length: 0 Connection: keep-alive with response body ==>....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDHvwlxZ6tgTQmj1PR%2BmThA HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Thu 21 Dec 2023 05:47:20 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2176 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32.......3b:T962d,"PO54623.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73280000 "PO54623.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "PO54623.exe" loaded module "KERNEL32" at base 774c0000 "PO54623.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "PO54623.exe" loaded module "ADVAPI32.DLL" at base 75ee0000 "PO54623.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6cb90000 "PO54623.exe" loaded module "SHLWAPI.DLL" at base 76d20000 "PO54623.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "PO54623.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "PO54623.exe" loaded module "VERSION.DLL" at base 74f50000 "PO54623.exe" loaded module "USER32.DLL" at base 771b0000 "PO54623.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "PO54623.exe" loaded module "MSCOREE.DLL" at base 6ccc0000 "PO54623.exe" loaded module "KERNEL32.DLL" at base 774c0000 "PO54623.exe" loaded module "RPCRT4.DLL" at base 778c0000 "PO54623.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 67c70000 "PO54623.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "PO54623.exe" loaded module "OLE32.DLL" at base 77970000 "PO54623.exe" loaded module "CRYPTBASE.DLL" at base 758d0000 "PO54623.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 744f0000 "PO54623.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6ede0000 "PO54623.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6cd10000 "PO54623.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 67210000 "PO54623.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 661f0000 "PO54623.exe" loaded module "UXTHEME.DLL" at base 744f0000 "PO54623.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 659d0000 "PO54623.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6c9d0000 "PO54623.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 65250000 "PO54623.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6ce00000 "PO54623.exe" loaded module "SHELL32.DLL" at base 760d0000 "PO54623.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77c20000 "PO54623.exe" loaded module "PROFAPI.DLL" at base 759f0000 "PO54623.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "PO54623.exe" loaded module "BCRYPT.DLL" at base 754f0000 "PO54623.exe" loaded module "CRYPTSP.DLL" at base 753e0000 "PO54623.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75170000 "PO54623.exe" loaded module "IMM32.DLL" at base 775a0000 "PO54623.exe" loaded module "COMCTL32.DLL" at base 651c0000 "PO54623.exe" loaded module "GDI32.DLL" at base 76020000 "PO54623.exe" loaded module "GDIPLUS.DLL" at base 74310000 "PO54623.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 74310000 "PO54623.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 774c0000 "PO54623.exe" loaded module "AMSI.DLL" at base 0 "PO54623.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "PO54623.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75d00000 "PO54623.exe" loaded module "URLMON.DLL" at base 77050000 "PO54623.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75ad0000 "PO54623.exe" loaded module "SECUR32.DLL" at base 75710000 "PO54623.exe" loaded module "OLEAUT32.DLL" at base 77c80000 "PO54623.exe" loaded module "WINDOWSCODECS.DLL" at base 74030000 "PO54623.exe" loaded module "NTDLL" at base 77ad0000 "PO54623.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "PO54623.exe" loaded module "NTDLL.DLL" at base 77ad0000 "PO54623.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "PO54623.exe" loaded module "SSPICLI.DLL" at base 75860000 "PO54623.exe" loaded module "COMCTL32.DLL" at base 74850000 "PO54623.exe" loaded module "APPHELP.DLL" at base 75880000 "PO54623.exe" loaded module "CLBCATQ.DLL" at base 75f90000 "PO54623.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6d450000 "PO54623.exe" loaded module "SETUPAPI.DLL" at base 76e10000 "PO54623.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74700000 "PO54623.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75880000 "PO54623.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77c20000 "PO54623.exe" loaded module "RPCRTREMOTE.DLL" at base 75970000 "PO54623.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 775a0000 "PO54623.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 69080000 "PO54623.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "PO54623.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "PO54623.exe" loaded module "PSAPI.DLL" at base 75e20000 "PO54623.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 67060000 "PO54623.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "PO54623.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 64fd0000 "PO54623.exe" loaded module "NTMARTA.DLL" at base 74ef0000 "PO54623.exe" loaded module "PROPSYS.DLL" at base 74700000 "PO54623.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77050000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 744f0000 "powershell.exe" loaded module "CLBCATQ.DLL" at base 75f90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 760d0000 "powershell.exe" loaded module "OLE32.DLL" at base 77970000 "powershell.exe" loaded module "USERENV.DLL" at base 75b00000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77c20000 "powershell.exe" loaded module "COMCTL32.DLL" at base 74850000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 75ee0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 774c0000 "powershell.exe" loaded module "SHELL32.DLL" at base 760d0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 77c80000 "powershell.exe" loaded module "SETUPAPI.DLL" at base 76e10000 "powershell.exe" loaded module "RPCRT4.DLL" at base 778c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74700000 "powershell.exe" loaded module "NTMARTA.DLL" at base 74ef0000 "powershell.exe" loaded module "APPHELP.DLL" at base 75880000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6f460000 "powershell.exe" loaded module "PROPSYS.DLL" at base 74700000 "powershell.exe" loaded module "LINKINFO.DLL" at base 6f450000 "powershell.exe" loaded module "PROFAPI.DLL" at base 759f0000 "powershell.exe" loaded module "USER32.DLL" at base 771b0000 "powershell.exe" loaded module "NTSHRUI.DLL" at base 733a0000 "powershell.exe" loaded module "SRVCLI.DLL" at base 755d0000 "powershell.exe" loaded module "CSCAPI.DLL" at base 70f50000 "powershell.exe" loaded module "SLC.DLL" at base 73a00000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 76d20000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 753e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75170000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 758d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73280000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "powershell.exe" loaded module "KERNEL32" at base 774c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6cb90000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "VERSION.DLL" at base 74f50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 64a20000 "powershell.exe" loaded module "MSCOREE.DLL" at base 6ccc0000 "powershell.exe" loaded module "NTDLL" at base 77ad0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6ccc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\9F895C66454577EFF9C77442D0C84F71\MSCORLIB.NI.DLL" at base 68d30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLE32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\AD92DAB7F418877D6A1E0358CE35658A\SYSTEM.NI.DLL" at base 68580000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\8229F0505633D4BCEF019B9D4FAB9F18\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 6cd40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT.A#\84C47B5A5813A5F040AEE9715A0FF7C0\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 67a10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 75e20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77ad0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CORE\BD9FF1A4363781A57E8F7392F230A203\SYSTEM.CORE.NI.DLL" at base 677d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\49CAE79AC18BAD142E1AB5A46A8AC306\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 6cb40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATIO#\D6ACC39F6C1EA42D8B3150DB6184A969\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6cd10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.WSMAN.MAN#\7BF5729401CFF7EA7898124E9818ED20\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 6cab0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.TRANSACTIONS\FEC007EA17AC8956CC5D6D4074DADA6A\SYSTEM.TRANSACTIONS.NI.DLL" at base 6ca10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 67780000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\F1831CE4588265A3F72E0A581BA58F2A\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 675e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\344E681515D07B93A4F1383F0D625E1E\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 67510000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\573750F17B5B8316F04A10956FDD1D97\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 6c9e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 6ceb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\77C1DC46EA139BF5E1EAA9B87EF03C7A\SYSTEM.XML.NI.DLL" at base 66fd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT\00C2B464E52D4E82C04D61592A12A89D\SYSTEM.MANAGEMENT.NI.DLL" at base 66ec0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DIRECTORYSER#\237ED1739105C1BEBE48D41905FDB3EE\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 66da0000 "powershell.exe" loaded module "SHFOLDER.DLL" at base 6ceb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 75710000 "powershell.exe" loaded module "SSPICLI.DLL" at base 75860000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DATA\511C39D1EFA06D262A6B2F47E2726C73\SYSTEM.DATA.NI.DLL" at base 66740000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 66460000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 66400000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 774c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DIASYMREADER.DLL" at base 65b10000 "powershell.exe" loaded module "NETUTILS.DLL" at base 73f30000 "powershell.exe" loaded module "GDI32.DLL" at base 76020000 "schtasks.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73280000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "schtasks.exe" loaded module "KERNEL32" at base 774c0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "schtasks.exe" loaded module "CRYPTBASE.DLL" at base 758d0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 744f0000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 778c0000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77c20000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 75ee0000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 75f90000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 73ab0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 75860000 "PO54623.exe" loaded module "%WINDIR%\SYSTEM32\DEVENUM.DLL" at base 6cde0000 "PO54623.exe" loaded module "WINTRUST.DLL" at base 75a20000 "PO54623.exe" loaded module "MSDMO.DLL" at base 6cdd0000 "PO54623.exe" loaded module "AVICAP32.DLL" at base 6cea0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 69280000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\9F895C66454577EFF9C77442D0C84F71\MSCORLIB.NI.DLL" at base 68780000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\AD92DAB7F418877D6A1E0358CE35658A\SYSTEM.NI.DLL" at base 67fd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\8229F0505633D4BCEF019B9D4FAB9F18\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 6cb00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT.A#\84C47B5A5813A5F040AEE9715A0FF7C0\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 67460000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CORE\BD9FF1A4363781A57E8F7392F230A203\SYSTEM.CORE.NI.DLL" at base 67030000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\49CAE79AC18BAD142E1AB5A46A8AC306\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 6cab0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATIO#\D6ACC39F6C1EA42D8B3150DB6184A969\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6ca80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.WSMAN.MAN#\7BF5729401CFF7EA7898124E9818ED20\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 6c9f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.TRANSACTIONS\FEC007EA17AC8956CC5D6D4074DADA6A\SYSTEM.TRANSACTIONS.NI.DLL" at base 66f90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 66f40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\F1831CE4588265A3F72E0A581BA58F2A\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 66da0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\344E681515D07B93A4F1383F0D625E1E\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 66cd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\573750F17B5B8316F04A10956FDD1D97\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 6cd10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 6ede0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\77C1DC46EA139BF5E1EAA9B87EF03C7A\SYSTEM.XML.NI.DLL" at base 66790000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT\00C2B464E52D4E82C04D61592A12A89D\SYSTEM.MANAGEMENT.NI.DLL" at base 66680000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DIRECTORYSER#\237ED1739105C1BEBE48D41905FDB3EE\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 66560000 "powershell.exe" loaded module "SHFOLDER.DLL" at base 6ede0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DATA\511C39D1EFA06D262A6B2F47E2726C73\SYSTEM.DATA.NI.DLL" at base 649c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 61130000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 66500000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DIASYMREADER.DLL" at base 66470000 "Bins.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73280000 "Bins.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "Bins.exe" loaded module "KERNEL32" at base 774c0000 "Bins.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "Bins.exe" loaded module "ADVAPI32.DLL" at base 75ee0000 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6cb90000 "Bins.exe" loaded module "SHLWAPI.DLL" at base 76d20000 "Bins.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "Bins.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "Bins.exe" loaded module "VERSION.DLL" at base 74f50000 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 65c50000 "Bins.exe" loaded module "USER32.DLL" at base 771b0000 "Bins.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "Bins.exe" loaded module "MSCOREE.DLL" at base 6ccc0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "Bins.exe" loaded module "PSAPI.DLL" at base 75e20000 "Bins.exe" loaded module "RPCRT4.DLL" at base 778c0000 "Bins.exe" loaded module "KERNEL32.DLL" at base 774c0000 "Bins.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63570000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 744f0000 "Bins.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6cea0000 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 65a80000 "Bins.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 65020000 "Bins.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 633c0000 "Bins.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 62550000 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "Bins.exe" loaded module "OLE32.DLL" at base 77970000 "Bins.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61d30000 "Bins.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 61c20000 "Bins.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 614a0000 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6cde0000 "Bins.exe" loaded module "NTDLL.DLL" at base 77ad0000 "Bins.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77c20000 "Bins.exe" loaded module "PROFAPI.DLL" at base 759f0000 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "Bins.exe" loaded module "CRYPTSP.DLL" at base 753e0000 "Bins.exe" loaded module "CRYPTBASE.DLL" at base 758d0000 "Bins.exe" loaded module "IMM32.DLL" at base 775a0000 "Bins.exe" loaded module "COMCTL32.DLL" at base 61410000 "Bins.exe" loaded module "GDIPLUS.DLL" at base 74310000 "Bins.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 774c0000 "Bins.exe" loaded module "AMSI.DLL" at base 0 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "Bins.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75d00000 "Bins.exe" loaded module "OLEAUT32.DLL" at base 77c80000 "Bins.exe" loaded module "WINDOWSCODECS.DLL" at base 74030000 "Bins.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 67270000 "Bins.exe" loaded module "NTDLL" at base 77ad0000 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "Bins.exe" loaded module "SHELL32.DLL" at base 760d0000 "Bins.exe" loaded module "PROPSYS.DLL" at base 74700000 "Bins.exe" loaded module "COMCTL32.DLL" at base 74850000 "Bins.exe" loaded module "APPHELP.DLL" at base 75880000 "Bins.exe" loaded module "SETUPAPI.DLL" at base 76e10000 "Bins.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "Bins.exe" loaded module "UXTHEME.DLL" at base 744f0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6d450000 "Bins.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77c20000 "Bins.exe" loaded module "RPCRTREMOTE.DLL" at base 75970000 "Bins.exe" loaded module "BCRYPT.DLL" at base 754f0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75170000 "Bins.exe" loaded module "GDI32.DLL" at base 76020000 "Bins.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 74310000 "Bins.exe" loaded module "URLMON.DLL" at base 77050000 "Bins.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75ad0000 "Bins.exe" loaded module "SECUR32.DLL" at base 75710000 "Bins.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71f80000 "Bins.exe" loaded module "CLBCATQ.DLL" at base 75f90000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74700000 "Bins.exe" loaded module "NTMARTA.DLL" at base 74ef0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77050000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75880000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6cb00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 68cd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\9F895C66454577EFF9C77442D0C84F71\MSCORLIB.NI.DLL" at base 681d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\AD92DAB7F418877D6A1E0358CE35658A\SYSTEM.NI.DLL" at base 67a20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\8229F0505633D4BCEF019B9D4FAB9F18\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 6cb90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT.A#\84C47B5A5813A5F040AEE9715A0FF7C0\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 671a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CORE\BD9FF1A4363781A57E8F7392F230A203\SYSTEM.CORE.NI.DLL" at base 69300000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\49CAE79AC18BAD142E1AB5A46A8AC306\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 6ca10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATIO#\D6ACC39F6C1EA42D8B3150DB6184A969\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6cdf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.WSMAN.MAN#\7BF5729401CFF7EA7898124E9818ED20\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 67110000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.TRANSACTIONS\FEC007EA17AC8956CC5D6D4074DADA6A\SYSTEM.TRANSACTIONS.NI.DLL" at base 67070000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6c9c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\F1831CE4588265A3F72E0A581BA58F2A\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 66ed0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\344E681515D07B93A4F1383F0D625E1E\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 66e00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\573750F17B5B8316F04A10956FDD1D97\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 692d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 6cde0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\77C1DC46EA139BF5E1EAA9B87EF03C7A\SYSTEM.XML.NI.DLL" at base 668c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT\00C2B464E52D4E82C04D61592A12A89D\SYSTEM.MANAGEMENT.NI.DLL" at base 667b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DIRECTORYSER#\237ED1739105C1BEBE48D41905FDB3EE\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 66690000 "powershell.exe" loaded module "SHFOLDER.DLL" at base 6cde0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DATA\511C39D1EFA06D262A6B2F47E2726C73\SYSTEM.DATA.NI.DLL" at base 66030000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 65d50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 6cd60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DIASYMREADER.DLL" at base 65cc0000 "schtasks.exe" loaded module "VERSION.DLL" at base 74f50000 "schtasks.exe" loaded module "KERNEL32.DLL" at base 774c0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\DEVENUM.DLL" at base 6cdc0000 "Bins.exe" loaded module "WINTRUST.DLL" at base 75a20000 "Bins.exe" loaded module "MSDMO.DLL" at base 6ede0000 "Bins.exe" loaded module "AVICAP32.DLL" at base 6ce00000 "Bins.exe" loaded module "DNSAPI.DLL" at base 75260000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 753a0000 "Bins.exe" loaded module "IPHLPAPI.DLL" at base 74f30000 "Bins.exe" loaded module "RASADHLP.DLL" at base 721f0000 "Bins.exe" loaded module "DHCPCSVC.DLL" at base 74e50000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74e40000 "Bins.exe" loaded module "WS2_32.DLL" at base 75d10000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6f680000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6f2c0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6f6f0000 "Bins.exe" loaded module "SAMLIB.DLL" at base 74830000 "Bins.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 6c9b0000 "Bins.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75af0000 "Bins.exe" loaded module "WINHTTP.DLL" at base 710d0000 "Bins.exe" loaded module "CRYPT32.DLL" at base 75b30000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 75390000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 738b0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 75d10000 "Bins.exe" loaded module "USERENV.DLL" at base 75b00000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6f3f0000 "Bins.exe" loaded module "DHCPCSVC6.DLL" at base 73890000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6edc0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 77c80000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 70f00000 "Bins.exe" loaded module "SSPICLI.DLL" at base 75860000 "Bins.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77c20000 "Bins.exe" loaded module "CRYPTNET.DLL" at base 70f00000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75b30000 "Bins.exe" loaded module "CREDSSP.DLL" at base 750a0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 751e0000 "Bins.exe" loaded module "NCRYPT.DLL" at base 75510000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 750b0000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 77610000 "Bins.exe" loaded module "GPAPI.DLL" at base 74fb0000 "Bins.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 77c20000 "Bins.exe" loaded module "SENSAPI.DLL" at base 6e4b0000 "Bins.exe" loaded module "NSI.DLL" at base 77c70000 "Bins.exe" loaded module "CFGMGR32.DLL" at base 75aa0000 "Bins.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 77c20000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6f460000 "Bins.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 760d0000 "Bins.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 6ce40000 "Bins.exe" loaded module "IERTUTIL.DLL" at base 77280000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6cd30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\8229F0505633D4BCEF019B9D4FAB9F18\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 6caf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CORE\BD9FF1A4363781A57E8F7392F230A203\SYSTEM.CORE.NI.DLL" at base 67220000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\49CAE79AC18BAD142E1AB5A46A8AC306\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 6caa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATIO#\D6ACC39F6C1EA42D8B3150DB6184A969\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6e610000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.WSMAN.MAN#\7BF5729401CFF7EA7898124E9818ED20\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 6ca10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.TRANSACTIONS\FEC007EA17AC8956CC5D6D4074DADA6A\SYSTEM.TRANSACTIONS.NI.DLL" at base 67180000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 67130000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\F1831CE4588265A3F72E0A581BA58F2A\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 66f90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\344E681515D07B93A4F1383F0D625E1E\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 66ec0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\573750F17B5B8316F04A10956FDD1D97\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 6cdf0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 6e4b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\77C1DC46EA139BF5E1EAA9B87EF03C7A\SYSTEM.XML.NI.DLL" at base 66980000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT\00C2B464E52D4E82C04D61592A12A89D\SYSTEM.MANAGEMENT.NI.DLL" at base 66870000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DIRECTORYSER#\237ED1739105C1BEBE48D41905FDB3EE\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 66750000 "powershell.exe" loaded module "SHFOLDER.DLL" at base 6e4b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DATA\511C39D1EFA06D262A6B2F47E2726C73\SYSTEM.DATA.NI.DLL" at base 660f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 65e10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 65db0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6cc20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DIASYMREADER.DLL" at base 65d20000 "135.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75880000 "135.exe" loaded module "KERNEL32.DLL" at base 774c0000 "135.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 753a0000 "135.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74e40000 "135.exe" loaded module "DHCPCSVC6.DLL" at base 73890000 "135.exe" loaded module "IPHLPAPI.DLL" at base 74f30000 "135.exe" loaded module "RPCRT4.DLL" at base 778c0000 "135.exe" loaded module "DHCPCSVC.DLL" at base 74e50000 "135.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "netsh.exe" loaded module "NSHWFP.DLL" at base 694a0000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 6cea0000 "netsh.exe" loaded module "WSHELPER.DLL" at base 714c0000 "netsh.exe" loaded module "KERNEL32.DLL" at base 774c0000 "netsh.exe" loaded module "NSHHTTP.DLL" at base 70d30000 "netsh.exe" loaded module "FWCFG.DLL" at base 6e620000 "netsh.exe" loaded module "AUTHFWCFG.DLL" at base 6ca10000 "netsh.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 774c0000 "netsh.exe" loaded module "IFMON.DLL" at base 6e610000 "netsh.exe" loaded module "NETIOHLP.DLL" at base 69580000 "netsh.exe" loaded module "WHHELPER.DLL" at base 6ceb0000 "netsh.exe" loaded module "HNETMON.DLL" at base 6cde0000 "netsh.exe" loaded module "RPCNSH.DLL" at base 6c9e0000 "netsh.exe" loaded module "DOT3CFG.DLL" at base 69480000 "netsh.exe" loaded module "NAPMONTR.DLL" at base 693a0000 "netsh.exe" loaded module "NSHIPSEC.DLL" at base 692e0000 "netsh.exe" loaded module "RPCRT4.DLL" at base 778c0000 "netsh.exe" loaded module "NETTRACE.DLL" at base 69180000 "netsh.exe" loaded module "WCNNETSH.DLL" at base 6c990000 "netsh.exe" loaded module "P2PNETSH.DLL" at base 69070000 "netsh.exe" loaded module "WLANCFG.DLL" at base 68f90000 "netsh.exe" loaded module "WWANCFG.DLL" at base 69550000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 68ec0000 "netsh.exe" loaded module "OLE32.DLL" at base 77970000 "netsh.exe" loaded module "CRYPTBASE.DLL" at base 758d0000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 744f0000 "netsh.exe" loaded module "CRYPTSP.DLL" at base 753e0000 "netsh.exe" loaded module "USER32.DLL" at base 771b0000 "netsh.exe" loaded module "CLBCATQ.DLL" at base 75f90000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\QAGENT.DLL" at base 72b70000 "netsh.exe" loaded module "ADVAPI32.DLL" at base 75ee0000 "netsh.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77c20000 "netsh.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 77c20000 "netsh.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 77c20000 "netsh.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77c20000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75170000 "netsh.exe" loaded module "RPCRTREMOTE.DLL" at base 75970000 "netsh.exe" loaded module "HTTPAPI.DLL" at base 6f670000 "netsh.exe" loaded module "USERENV.DLL" at base 75b00000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 750b0000 "netsh.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73280000 "netsh.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "netsh.exe" loaded module "KERNEL32" at base 774c0000 "netsh.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "netsh.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6cc20000 "netsh.exe" loaded module "OLEAUT32.DLL" at base 77c80000 "netsh.exe" loaded module "GPAPI.DLL" at base 74fb00003c:T8a7,"INSERT INTO GiamKhao VALUES ('" (Source: PO54623.exe, Indicator: "insert into giamkhao values ('") "INSERT INTO TieuChuan VALUES (N'" (Source: PO54623.exe, Indicator: "insert into tieuchuan values (n'") "SELECT ma_so AS N'Mã số', trong_so AS N'Trọng số' FROM dbo.GiamKhao" (Source: 6000066-QueryGiamKhao~get_data_source, Indicator: "select ma_so as n'mã số', trong_so as n'trọng số' from dbo.giamkhao") "SELECT ma_so AS N'Mã số', chuyen_mon AS N'Chuyên môn', kinh_nghiem AS N'Kinh nghiệm', ky_nang_mem AS N'Kỹ năng mềm', do_tuoi AS N'Độ tuổi', tong_diem AS N'Tổng điểm' FROM NhanSu" (Source: 600006b-QueryNhanSu~get_data_source, Indicator: "select ma_so as n'mã số', chuyen_mon as n'chuyên môn', kinh_nghiem as n'kinh nghiệm', ky_nang_mem as n'kỹ năng mềm', do_tuoi as n'độ tuổi', tong_diem as n'tổng điểm' from nhansu") "INSERT INTO NhanSu VALUES ('" (Source: 600006c-QueryNhanSu~insert, Indicator: "insert into nhansu values ('") "SELECT ten_tieu_chuan AS N'Bộ tiêu chuẩn', w_chuyen_mon AS N'TS Chuyên môn', w_kinh_nghiem AS N'TS Kinh nghiệm', w_ky_nang_mem AS N'TS Kỹ năng mềm', W_do_tuoi AS N'TS Độ tuổi', CR FROM dbo.TieuChuan" (Source: 6000070-QueryTieuChuan~get_data_source, Indicator: "select ten_tieu_chuan as n'bộ tiêu chuẩn', w_chuyen_mon as n'ts chuyên môn', w_kinh_nghiem as n'ts kinh nghiệm', w_ky_nang_mem as n'ts kỹ năng mềm', w_do_tuoi as n'ts độ tuổi', cr from dbo.tieuchuan") "select signon_realm, origin_url, username_value, password_value from logins" (Source: 00001968.000007B0.7943390.00419000.wprm, Indicator: "select signon_realm, origin_url, username_value, password_value from logins") "select host_key, path, name, encrypted_value, expires_utc, is_httponly, samesite, is_secure from cookies" (Source: 00001968.000007B0.7943390.00419000.wprm, Indicator: "select host_key, path, name, encrypted_value, expires_utc, is_httponly, samesite, is_secure from cookies") "SELECT host, path, name, value, expiry, isHttpOnly, isSecure FROM moz_cookies" (Source: 00001968.000007B0.7943390.00419000.wprm, Indicator: "select host, path, name, value, expiry, ishttponly, issecure from moz_cookies")3d:T1a41,"PO54623.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "PO54623.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "PO54623.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "PO54623.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "PO54623.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "PO54623.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "PO54623.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "PO54623.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "PO54623.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "PO54623.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "PO54623.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "PO54623.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "PO54623.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "PO54623.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "PO54623.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "PO54623.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "PO54623.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "PO54623.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "PO54623.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "PO54623.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "PO54623.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "PO54623.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "PO54623.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "PO54623.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "PO54623.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") "powershell.exe" touched "Start Menu Pin" (Path: "HKCU\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}\TREATAS") "powershell.exe" touched "Taskband Pin" (Path: "HKCU\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "User Pinned" (Path: "HKCU\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") "powershell.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\INPROCSERVER32") "powershell.exe" touched "User Assist" (Path: "HKCU\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS") "powershell.exe" touched "Shared Task Scheduler" (Path: "HKCU\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "PO54623.exe" touched "System Device Enumerator" (Path: "HKCU\CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}") "PO54623.exe" touched "VFW Capture Class Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}") "Bins.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "Bins.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}") "Bins.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}") "Bins.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32") "Bins.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32") "Bins.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS") "Bins.exe" touched "Search Gatherer Notification" (Path: "HKCU\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS") "Bins.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "Bins.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "Bins.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "Bins.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "netsh.exe" touched "Nap Config Read class" (Path: "HKCU\CLSID\{EA4A0A43-1C8F-4C7B-A4B1-28ECBD96BA8C}") "netsh.exe" touched "Quarantine Agent Management class" (Path: "HKCU\CLSID\{EB082BA1-DF8A-46BE-82F3-35BF9E9BE52F}")3e:T108f,"PO54623.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],push ebx,inc esi,inc edi,cmp byte ptr [edx + 0x35], al,aaa ,xor dword ptr [0x38384850], esi,dec edi,cmp byte ptr [ecx + 0x5a], al,xor eax, 0x45465337,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "Bins.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],push ebx,inc esi,inc edi,cmp byte ptr [edx + 0x35], al,aaa ,xor dword ptr [0x38384850], esi,dec edi,cmp byte ptr [ecx + 0x5a], al,xor eax, 0x45465337,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "sqlmap.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x40,mov eax, 0x40ddfc,call 0x40794c,xor eax, eax,push ebp,push 0x41018c,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,xor eax, eax,pop edx,pop ecx,pop ecx,mov dword ptr fs:[eax], edx,push 0x410193,ret ,jmp 0x403d50,jmp 0x41018b,call 0x404418,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "135.exe" file has an entrypoint instructions - "pushal ,mov esi, 0x41a000,lea edi, [esi - 0x19000],push edi,or ebp, 0xffffffff,jmp 0x42af72,nop ,nop ,nop ,nop ,nop ,nop ,mov al, byte ptr [esi],inc esi,mov byte ptr [edi], al,inc edi,add ebx, ebx,jne 0x42af79,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,jb 0x42af68,mov eax, 1,add ebx, ebx,jne 0x42af8b,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,adc eax, eax,add ebx, ebx,jae 0x42af80,jne 0x42af9c,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,jae 0x42af80,xor ecx, ecx,sub eax, 3,jb 0x42afb0,shl eax, 8,mov al, byte ptr [esi],inc esi,xor eax, 0xffffffff,je 0x42b022,mov ebp, eax,add ebx, ebx,jne 0x42afbb," "rfxvmt.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10005cc0,call 0x10006258,pop ebp,jmp 0x10005cf0,int3 ,int3 ,int3 ,int3 ,int3 ,mov edi, edi,push ebp,mov ebp, esp,mov eax, 0xe06d7363,cmp dword ptr [ebp + 8], eax,jne 0x10005ce7,push dword ptr [ebp + 0xc],push eax,call 0x100060e0,pop ecx,pop ecx,pop ebp,ret ,xor eax, eax,pop ebp,ret ,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x30,push 0x100065b0,call 0x1000630c,mov dword ptr [ebp - 0x20], 1,xor esi, esi,mov dword ptr [ebp - 4], esi,mov eax, dword ptr [ebp + 0xc],cmp eax, 1,ja 0x10005d15,"3f:T76c,Observed system executable string:"/C:\ PROGRA~2 MICROS~1 WindowsSTARTM~1ProgramsACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPShapubws-pc/C:\ PROGRA~2 MICROS~1 WindowsSTARTM~1ProgramsACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPShapubws-pc/C:\WindowsSystem32WINDOW~1v1.0powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPShapubws-pc/C:\Windowshh.exeC:\Windows\hh.exe%systemroot%\hh.exe1SPS1SPShapubws-pc" [Source: Z8VX4JU1VZM1BYX8RYCV.temp] Observed system executable string:"%WINDIR%\System32\schtasks.exe" [Source: 00000000-00002540-00000C41-12657061854] Observed system executable string:""%WINDIR%\System32\schtasks.exe" /Create /TN "Updates\xzYPjfkAQ" /XML "%TEMP%\tmp3049.tmp"" [Source: 00000000-00002540-00000C41-12657061854] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00002540-00000C41-30809789681] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%APPDATA%\xzYP" [Source: 00000000-00002540-00000C41-30809789681], Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00003100-00000C28-18446744060666076256], Observed system executable string:""%WINDIR%\System32\schtasks.exe" /Create /TN "Updates\xzYPjfkAQ" /XML "%TEMP%\tmp8743.tmp"" [Source: 00000000-00001120-00000C41-26475940500]40:T52d,"PO54623.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "PO54623.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "PO54623.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "PO54623.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "PO54623.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Bins.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Bins.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Bins.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "Bins.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "Bins.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")41:T443,file/memory contains long string with (Indicator: "text/javascript"; File: "SSL") file/memory contains long string with (Indicator: "text/javascript"; File: "js_3_.js") file/memory contains long string with (Indicator: "text/javascript"; File: "f_3_.txt") file/memory contains long string with (Indicator: "text/javascript"; File: "js_4_.js") Found string "" (Indicator: "text/javascript"; File: "EGFjzswB..html") Found string "" (Indicator: "text/javascript"; File: "EGFjzswB..html") Found string "