34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 65:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4cb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Yogi.Generic Sample d060036bf0a5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d060036bf0a5…. Malware family: Yogi.Generic. Threat score 100/100. 8/24 AV engines flagged this file. 12 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827","keywords":["Malicious","Yogi.Generic","malware analysis","sandbox report","threat intelligence","d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827"],"about":{"@type":"SoftwareApplication","name":"d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe","applicationCategory":["peexe","64bits","assembly","executable"],"identifier":"d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Yogi.Generic","antivirusDetections":{"malicious":8,"total":24},"behavioralIndicators":{"malicious":12,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Ta59,Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "ExecuteReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "System.Threading" (Indicator: "read"; Source: "sample.bin"), Found reference to API "set_TabIndex" (Indicator: "bind"; Source: "sample.bin"), Found reference to API "EditorBrowsableState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "LinkedList`1" (Indicator: "link"; Source: "sample.bin"), Found reference to API "DbConnection" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "System.Runtime.Versioning" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Data Source=DESKTOP-BH4JOH6;Initial Catalog=QL_KARAOKE;User ID=sa;Password=123456;Integrated Security= True" (Indicator: "security"; Source: "sample.bin"), Found reference to API "SqlDataReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "RuntimeCompatibilityAttribute" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Synchronized" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "LinkedListNode`1" (Indicator: "link"; Source: "sample.bin"), Found reference to API "SqlConnection" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "Close" (Indicator: "close"; Source: "sample.bin"), Found reference to API "Thread" (Indicator: "read"; Source: "sample.bin"), Found reference to API "set_SelectedIndex" (Indicator: "select"; Source: "sample.bin"), Found reference to API "get_SelectedIndex" (Indicator: "select"; Source: "sample.bin"), Found reference to API "System.Runtime.CompilerServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet" (Indicator: "read"; Source: "sample.bin"), Found reference to API "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet" (Indicator: "time"; Source: "sample.bin"), Found reference to API "DBConnect" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "Open" (Indicator: "open"; Source: "sample.bin"), Found reference to API "RuntimeTypeHandle" (Indicator: "time"; Source: "sample.bin"), Found reference to API "STAThreadAttribute" (Indicator: "read"; Source: "sample.bin"), Found reference to API "STAThreadAttribute" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "select" (Indicator: "select"; Source: "sample.bin")37:T413,Found string "feature_servicing_cjkextensionfoldercompressionerror" (Source: "00000000-00001068.00000001.135121.C17F0000.00000004.mdmp") Found string "system.io.compression" (Source: "00000000-00001068.00000001.135121.C1820000.00000004.mdmp, 00000000-00001068.00000001.135121.C1870000.00000004.mdmp") Found string "compressionmode" (Source: "00000000-00001068.00000001.135121.C1820000.00000004.mdmp") Found string "decompressionmethods" (Source: "00000000-00001068.00000001.135121.C1820000.00000004.mdmp") Found string "compressionlevel" (Source: "00000000-00001068.00000001.135121.C1820000.00000004.mdmp") Found string "compressionstrategy" (Source: "00000000-00001068.00000001.135121.C1820000.00000004.mdmp") Found string "compressionmethod" (Source: "00000000-00001068.00000001.135121.C1820000.00000004.mdmp") Found string "compressiontracingswitchlevel" (Source: "00000000-00001068.00000001.135121.C1870000.00000004.mdmp") Found string "compressiontracingswitch" (Source: "00000000-00001068.00000001.135121.C1870000.00000004.mdmp")38:T1040,"d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\4") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\4") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\4") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\4") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\4") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\PROPERTYBAG") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\PROPERTYBAG") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_PROTOCOL_LOCKDOWN") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_PROTOCOL_LOCKDOWN") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_PROTOCOL_LOCKDOWN") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0")39:Td37,"d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" queried SystemProcessInformation at 00000000-00005024-00000C15-786520346 [PID: 5024] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" queried SystemProcessInformation at 00000000-00005024-00000C15-786527117 [PID: 5024] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" queried SystemProcessInformation at 00000000-00005024-00000C15-786741840 [PID: 5024] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" queried SystemProcessInformation at 00000000-00005024-00000C15-786749447 [PID: 5024] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" queried SystemProcessInformation at 00000000-00005024-00000C15-786909184 [PID: 5024] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" queried SystemProcessInformation at 00000000-00005024-00000C15-786916603 [PID: 5024] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" queried SystemProcessInformation at 00000000-00005024-00000C15-789199780 [PID: 5024] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" queried SystemProcessInformation at 00000000-00005024-00000C15-789208145 [PID: 5024] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" queried SystemProcessInformation at 00000000-00005024-00000C15-797181972 [PID: 5024] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" queried SystemProcessInformation at 00000000-00005024-00000C15-797189407 [PID: 5024] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" queried SystemProcessInformation at 00000000-00005024-00000C15-797430109 [PID: 5024] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" queried SystemProcessInformation at 00000000-00005024-00000C15-797645821 [PID: 5024] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" queried SystemProcessInformation at 00000000-00005024-00000C15-797896046 [PID: 5024] "powershell.exe" queried SystemProcessInformation at 00000000-00005644-00000C15-798331995 [PID: 5644] "powershell.exe" queried SystemProcessInformation at 00000000-00005644-00000C15-798340004 [PID: 5644] "powershell.exe" queried SystemProcessInformation at 00000000-00005644-00000C15-798590045 [PID: 5644] "powershell.exe" queried SystemProcessInformation at 00000000-00005644-00000C15-798597563 [PID: 5644] "powershell.exe" queried SystemProcessInformation at 00000000-00005644-00000C15-801838451 [PID: 5644] "powershell.exe" queried SystemProcessInformation at 00000000-00005644-00000C15-801846364 [PID: 5644] "powershell.exe" queried SystemProcessInformation at 00000000-00005644-00000C15-802603358 [PID: 5644] "powershell.exe" queried SystemProcessInformation at 00000000-00005644-00000C15-802645647 [PID: 5644] "powershell.exe" queried SystemProcessInformation at 00000000-00005644-00000C15-812717950 [PID: 5644] "powershell.exe" queried SystemProcessInformation at 00000000-00005644-00000C15-812725633 [PID: 5644] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" queried SystemProcessInformation at 00000000-00006660-00000C15-798509265 [PID: 6660] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" queried SystemProcessInformation at 00000000-00006660-00000C15-798533734 [PID: 6660]3a:T5ef7,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDV/poQLjVsb85LnwsCuA0OwrdhOgJ9Idx88iVA/crVxKCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d5fe9a102e356c6fce4b9f0b02b80d0ec2b7613a027d21dc7cf22540fdcad5c4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d5fe9a102e356c6fce4b9f0b02b80d0ec2b7613a027d21dc7cf22540fdcad5c4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" (UID: 00000000-00005644) "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD1Ic9VXSKRHe3vJHTviA7n2oanD+d84ekkYUUIWGAvN6CCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420f521cf555d22911dedef2474ef880ee7da86a70fe77ce1e92461450858602f37a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420f521cf555d22911dedef2474ef880ee7da86a70fe77ce1e92461450858602f37a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoTQYJKoZIhvcNAQcCoIIoPjCCKDoCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCr/A9tw2GByeR8Ap2Gq5RzqPPv0zVCx/gDoI5nGZeC0aCCDSkwggZwMIIEWKADAgECAhMzAAABI9" "cchString": "14196" "dwFlags": "1" "pbBinary": "3082284d06092a864886f70d010702a082283e3082283a020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420abfc0f6dc36181c9e47c029d86ab9473a8f3efd33542c7f803a08e67199782d1a0820d293082067030820458a00302010202133300000123d95dfc7026a28135000000000123300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933325a170d3237303432393138333933325a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100e0b2447b321b3a926eb411d4692a7ff00c074e1313ddfc65a06e8ff2bc0710bf30fd7da0cd809caab63c22b611319a264c176e3294f2aad59e71a352e3184cfa40babb929cb080bac2ddc98295ebf760777146f1d5c8a2e4118ca42a13fd9985b1845ea27fac86ff3f8ba15281fc29bd685a4bf106fd2b56064c5e0fc15ba5c844bf456ff13ead32db2d20c37353ebc91fc90db642ee818d9dceba701e632ddd53a8c754a9ab11d0402cf837b8f86e9010c346472fce64bba3c8b2e98d7b30c5ebdfc745cd62931c0f5f7949d602204f891612ea2d9e785cac27ad0836260a45db7872cce3795e6fda36baf94881f56bb3984b15b1ec1ab3e9a9c3bc8aee87431c3c979c2505f3e2bd81c9c0fdad4ae457dad6805246df09a70f31c8826cd39cbdc7843eb70932492839a994b55fa950b097a84784663d44bf7c25a5589f9474cd231b2063fbcd943a9d90baa098658d8494dab941753912a544e0beadf79c6e493b3c72b3f3e472881098569c6f33d13bc5e13e5b420b79719da8d592a76c750203010001a382019e3082019a300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414d1f31e81e6fa79075fa31e975354ed24848a0ec430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d697465643116" "pcbBinary": "51280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoTQYJKoZIhvcNAQcCoIIoPjCCKDoCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14196" "dwFlags": "1" "pbBinary": "3082284d06092a864886f70d010702a082283e3082283a020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420abfc0f6dc36181c9e47c029d86ab9473a8f3efd33542c7f803a08e67199782d1a0820d293082067030820458a00302010202133300000123d95dfc7026a28135000000000123300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933325a170d3237303432393138333933325a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100e0b2447b321b3a926eb411d4692a7ff00c074e1313ddfc65a06e8ff2bc0710bf30fd7da0cd809caab63c22b611319a264c176e3294f2aad59e71a352e3184cfa40babb929cb080bac2ddc98295ebf760777146f1d5c8a2e4118ca42a13fd9985b1845ea27fac86ff3f8ba15281fc29bd685a4bf106fd2b56064c5e0fc15ba5c844bf456ff13ead32db2d20c37353ebc91fc90db642ee818d9dceba701e632ddd53a8c754a9ab11d0402cf837b8f86e9010c346472fce64bba3c8b2e98d7b30c5ebdfc745cd62931c0f5f7949d602204f891612ea2d9e785cac27ad0836260a45db7872cce3795e6fda36baf94881f56bb3984b15b1ec1ab3e9a9c3bc8aee87431c3c979c2505f3e2bd81c9c0fdad4ae457dad6805246df09a70f31c8826cd39cbdc7843eb70932492839a994b55fa950b097a84784663d44bf7c25a5589f9474cd231b2063fbcd943a9d90baa098658d8494dab941753912a544e0beadf79c6e493b3c72b3f3e472881098569c6f33d13bc5e13e5b420b79719da8d592a76c750203010001a382019e3082019a300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414d1f31e81e6fa79075fa31e975354ed24848a0ec430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d697465643116" "pcbBinary": "51280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBtDF2JKI36fdNtow/lvaDOTH2mrMlLIbHrrT8yX5SSpKCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004206d0c5d89288dfa7dd36da30fe5bda0ce4c7da6acc94b21b1ebad3f325f9492a4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004206d0c5d89288dfa7dd36da30fe5bda0ce4c7da6acc94b21b1ebad3f325f9492a4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDWvqMT2Ue8a34LSEuhl06FgxWsXjP0v5BtZeKasdQk/6CCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d6bea313d947bc6b7e0b484ba1974e858315ac5e33f4bf906d65e29ab1d424ffa0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d6bea313d947bc6b7e0b484ba1974e858315ac5e33f4bf906d65e29ab1d424ffa0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"}3b:Tc44,Found XOR loop in file "sample.bin" at offset 226979; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 233582; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 252813; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 347911; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 521739; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 601459; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 615806; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 732096; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 734166; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 753812; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 781823; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 793779; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 972537; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1001774; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 343691; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 349515; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 506213; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 617376; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 651766; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 675857; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 684132; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 688046; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 734866; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 782990; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 835508; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 838028; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 894048; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1036100; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1085966; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 205870; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 216945; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 224984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 239612; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 253847; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 411307; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 420065; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 431116; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 466189; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 530872; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 728641; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 735819; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 774602; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 831609; code bytes = 80303c:T284e,"d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000000cb2ffc7f0000b0070cac9b01000028ee5fc69a0000000600000000000000c1da6c58fc7f00000000000000000000000000000000000010ec5fc69a000000000000000000000060eb5fc69a00000070d37a58fc7f00000000000000000000f0d27a58fc7f0000080000000000000028ec5fc69a00000000000000000000000900000000000000a062d32ffc7f000028ec5fc69a0000000000000000000000cb4d6e58fc7f000090c90cac9b01000000f05fc69a00000021ec5fc69a00000000006c58fc7f0000170000c00000000000000bac9b0100000000cb2ffc7f000093996a58fc7f0000c0ec5fc69a00000008467058fc7f000000f05fc6 (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000070a816ac9b01000010196e58fc7f0000000000000000000000004557fc7f00000000000000000000ee265456fc7f0000070000000000000000c15fc69a00000000c15fc69a000000400e6256fc7f000000004557fc7f00007b63f755fc7f0000030000000000000000000000000000009200000000000000a004b557fc7f0000f0c05fc69a000000bb5f5456fc7f00000d000000fc7f0000a004b557fc7f000092000000000000000000000000000000a004b557fc7f00001c5b5456fc7f0000000000000000000092000000000000000d000000fc7f00000d00000000000000aa00000000000000d2455657fc7f0000a03a5b57 (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000a4286c58fc7f0000d0df0cac9b010000000000000000000000000000000000000965ff57fc7f00000100000002000000f800f727fc7f0000206d17ac9b010000200000009a000000d0df0cac9b010000302eff57fc7f0000f0fb0bac9b0100005441ff57fc7f0000ed0300009b010000484a0028fc7f000000000000fc7f0000f800f727fc7f000000a2ff57fc7f00000000f727fc7f00000000000000000000ee5b6c58fc7f000001000000000000000000000000000000c0b816ac9b010000f8e25fc69a0000000500000000000000c1da6c58fc7f00000100000000000000f800f727fc7f0000a8e75fc69a000000e9fefe27fc7f000040e35fc6 (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000000000000000000010000000000000018dd5fc69a000000000000000000000010694f53fc7f0000090000000100000009000000000000000a0c00009b010000a66b3332fc7f0000a0290cac9b0100001800000001000000000000000000000098de5fc69a000000c6167e26ec1700007958ff5a1bbd000090de5fc69a0000003d36ad2ffc7f0000000000009b010000000000000000000070dd5fc69a000000000062c89b010000000000009b010000a0dd5fc69a0000000100000000000000010000000000000090de5fc69a00000060de5fc69a000000a8de5fc69a000000000000000000000016177e26ec170000020000000000000020003cae (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000ac5c5456fc7f000090717356fc7f0000a7c7f153fc7f000050823e54fc7f0000a04b1fae9b010000000000000000000068f15fc89a00000090717356fc7f000055a9ef53fc7f0000a84b1fae9b010000a84b1fae9b01000068f15fc89a0000000702000000000000000000000000000004796c34c17d000090373f54fc7f0000b04d1fae9b010000384e1fae9b01000020f15fc89a00000020f15fc89a00000048db6c56fc7f0000000000000000000000000000000000000000000004000000a08818ac9b010000a04b1fae9b01000050c9f453fc7f0000b08818ac9b01000013ace653fc7f0000010000000000000050f25fc89a00000000140200 (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000689621ae9b0100002d00310030003000310000000000000001000000c17d000088a15fc89a000000d833fdad9b0100000000000000000000a0661eae9b010000309521ae9b01000060e13454fc7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000096521eae9b010000ac521eae9b01000096521eae9b010000da521eae9b010000000000000000000000000000000000000000000000000000000000000000000096521eae9b010000ac521eae9b01000096521eae9b010000000000000000000000000000 (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000689621ae9b0100002d00310030003000310000000000000001000000c17d000088a15fc89a000000d833fdad9b0100000000000000000000a09623ae9b010000309521ae9b01000060e13454fc7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000096521eae9b010000ae521eae9b01000096521eae9b010000dc521eae9b010000000000000000000000000000000000000000000000000000000000000000000096521eae9b010000ae521eae9b01000096521eae9b010000000000000000000000000000 (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000689621ae9b0100002d00310030003000310000000000000001000000c17d000088a15fc89a000000d833fdad9b0100000000000000000000b09523ae9b010000309521ae9b01000060e13454fc7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000064f16ac9b0100001a4f16ac9b010000064f16ac9b010000484f16ac9b0100000000000000000000000000000000000000000000000000000000000000000000064f16ac9b0100001a4f16ac9b010000064f16ac9b010000000000000000000000000000 (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000689621ae9b0100002d00310030003000310000000000000001000000c17d000088a15fc89a000000d833fdad9b0100000000000000000000009623ae9b010000309521ae9b01000060e13454fc7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000a6421eae9b010000be421eae9b010000a6421eae9b010000ec421eae9b0100000000000000000000000000000000000000000000000000000000000000000000a6421eae9b010000be421eae9b010000a6421eae9b010000000000000000000000000000 (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000689621ae9b0100002d00310030003000310000000000000001000000c17d000088a15fc89a000000d833fdad9b0100000000000000000000b09a23ae9b010000309521ae9b01000060e13454fc7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000565f1eae9b0100006c5f1eae9b010000565f1eae9b0100009a5f1eae9b0100000000000000000000000000000000000000000000000000000000000000000000565f1eae9b0100006c5f1eae9b010000565f1eae9b010000000000000000000000000000 (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000689621ae9b0100002d00310030003000310000000000000001000000c17d000088a15fc89a000000d833fdad9b010000000000000000000040a623ae9b010000309521ae9b01000060e13454fc7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000065a1eae9b0100001e5a1eae9b010000065a1eae9b0100004c5a1eae9b0100000000000000000000000000000000000000000000000000000000000000000000065a1eae9b0100001e5a1eae9b010000065a1eae9b010000000000000000000000000000 (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000689621ae9b0100002d00310030003000310000000000000001000000c17d000088a15fc89a000000d833fdad9b0100000000000000000000809323ae9b010000309521ae9b01000060e13454fc7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000d6451eae9b010000ee451eae9b010000d6451eae9b0100001c461eae9b0100000000000000000000000000000000000000000000000000000000000000000000d6451eae9b010000ee451eae9b010000d6451eae9b010000000000000000000000000000 (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005024)3d:T49a,Found string "select * from TAIKHOAN" (Indicator: "select * from "; File: "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827") Found string "Select * from PHONG" (Indicator: "select * from "; File: "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827") Found string "Select * from PHONG where TENPHONG like N'%" (Indicator: "select * from "; File: "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827") Found string "Select * from KHACHHANG" (Indicator: "select * from "; File: "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827") Found string "Select * from KHACHHANG where TENKH like N'%" (Indicator: "select * from "; File: "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827") Found string "select * from NHANVIEN" (Indicator: "select * from "; File: "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827") Found string "select * from PHONG" (Indicator: "select * from "; File: "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827") Found string "Select * from HOADON" (Indicator: "select * from "; File: "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827")3e:T465,"d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "FXmail.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")3f:Te7e,"d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" queries volume information of "C:\d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" at 00000000-00005024-00000C17-788483722 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00005024-00000C17-791847715 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Design.dll" at 00000000-00005024-00000C17-791967603 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00005644-00000C17-800578142 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00005644-00000C17-800580960 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00005644-00000C17-800775954 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00005644-00000C17-800779892 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00005644-00000C17-803809113 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll" at 00000000-00005644-00000C17-804165535 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00005644-00000C17-804172844 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005644-00000C17-804875197 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00005644-00000C17-812585783 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.4717.cat" at 00000000-00005644-00000C17-813419164 "FXmail.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\F0XMAlL\FXmail.exe" at 00000000-00008540-00000C17-804043121 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00001068-00000C17-818613646 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00001068-00000C17-818617432 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00001068-00000C17-82577671940:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")41:T6c6e,"d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\908b5c1debcfb784bc25157a8ebcdfbe\System.Drawing.ni.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\061200dcb8937e1b9eb2641f2ce9d2ec\System.Windows.Forms.ni.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\66d07c903ec98772aa13edeba020ffa3\Microsoft.VisualBasic.ni.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005024) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005024) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\afd58c711db7cac7f0d5caf525ce8d6c\System.DirectoryServices.ni.d (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\8ecda6b0ffa321000faffbdcdb86175b\System.Management.ni.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\8990b2f5a93202518a0040e15b565f36\System.Data.ni.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter Kernel32 (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter NtDll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\beabd14f0ab9a67d348911645772e933\System.Transactions.ni.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00005644) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005644) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006660) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006660) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006660) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00006660) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter Psapi (UID: 00000000-00006660) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter shcore (UID: 00000000-00006660) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006660) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006660) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter Shell32 (UID: 00000000-00006660) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter Shlwapi (UID: 00000000-00006660) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter Iphlpapi (UID: 00000000-00006660) "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" called "LoadLibrary" with a parameter Advapi32.dll (UID: 00000000-00006660) "FXmail.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\908b5c1debcfb784bc25157a8ebcdfbe\System.Drawing.ni.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\061200dcb8937e1b9eb2641f2ce9d2ec\System.Windows.Forms.ni.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00008540) "FXmail.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008540) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00001068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001068) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001068) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001068) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001068) "powershell.exe" called "LoadLibrary" with a parameter NtDll (UID: 00000000-00001068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\8ecda6b0ffa321000faffbdcdb86175b\System.Management.ni.dll (UID: 00000000-00001068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\8990b2f5a93202518a0040e15b565f36\System.Data.ni.dll (UID: 00000000-00001068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00001068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00001068) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00001068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00001068) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00001068) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001068) "FXmail.exe" called "LoadLibrary" with a parameter Iphlpapi (UID: 00000000-00005312)42:Tabf,"select * from TAIKHOAN" (Source: 6000013-ctor, Indicator: "select * from taikhoan") "select count(*) from TAIKHOAN where username='" (Source: 6000014-fm_taiKhoan~btn_them_Click, Indicator: "select count(*) from taikhoan where username='"), "insert into TAIKHOAN Values ('" (Source: 6000014-fm_taiKhoan~btn_them_Click, Indicator: "insert into taikhoan values ('") "Delete from TAIKHOAN where username = '" (Source: 6000017-fm_taiKhoan~btn_xoa_Click, Indicator: "delete from taikhoan where username = '") "Select * from PHONG" (Source: 600001c-ctor, Indicator: "select * from phong") "Select * from PHONG where TENPHONG like N'%" (Source: 600001f-fm_thanhToan~txt_timkiem_TextChanged, Indicator: "select * from phong where tenphong like n'%") "Insert into HOADON Values('" (Source: 6000023-fm_thanhToan~btn_ThanhToan_Click, Indicator: "insert into hoadon values('") "Select count(*) from taikhoan where username='" (Source: 6000031-form_DangNhap~btn_dangNhap_Click, Indicator: "select count(*) from taikhoan where username='"), "Select isAdmin from taikhoan where username='" (Source: 6000031-form_DangNhap~btn_dangNhap_Click, Indicator: "select isadmin from taikhoan where username='"), "Select * from KHACHHANG" (Source: 6000037-ctor, Indicator: "select * from khachhang"), "Insert into KHACHHANG values('" (Source: 600003a-frm_khachHang~btn_them_Click, Indicator: "insert into khachhang values('") "Delete from KHACHHANG where MAKH= '" (Source: 600003d-frm_khachHang~btn_xoa_Click, Indicator: "delete from khachhang where makh= '") "Select * from KHACHHANG where TENKH like N'%" (Source: 6000043-frm_khachHang~txt_search_TextChanged, Indicator: "select * from khachhang where tenkh like n'%") "select * from NHANVIEN" (Source: 6000049-ctor, Indicator: "select * from nhanvien") "select count(*) from NHANVIEN where MANV='" (Source: 600004a-frm_nhanVien~btn_them_Click, Indicator: "select count(*) from nhanvien where manv='"), "insert into NHANVIEN Values ('" (Source: 600004a-frm_nhanVien~btn_them_Click, Indicator: "insert into nhanvien values ('") "Delete from NHANVIEN where MANV = '" (Source: 600004d-frm_nhanVien~btn_xoa_Click, Indicator: "delete from nhanvien where manv = '") "select * from PHONG" (Source: 6000053-ctor, Indicator: "select * from phong") "select count(*) from PHONG where MAPHONG='" (Source: 6000054-frm_phong~btn_them_Click, Indicator: "select count(*) from phong where maphong='"), "insert into PHONG Values ('" (Source: 6000054-frm_phong~btn_them_Click, Indicator: "insert into phong values ('") "Delete from PHONG where MAPHONG = '" (Source: 6000057-frm_phong~btn_xoa_Click, Indicator: "delete from phong where maphong = '") "Select * from HOADON" (Source: 6000067-ctor, Indicator: "select * from hoadon")43:Tcd9,Process d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5024:304:WilStaging_02" Process d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5024:304:WilStaging_02" Process d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5024:120:WilError_03" Process d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe created mutex with name "\Sessions\1\BaseNamedObjects\iHEOvKhWEndGELokNpikV" Process d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe created mutex with name "iHEOvKhWEndGELokNpikV" Process d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe created mutex with name "Local\SM0:5024:304:WilStaging_02" Process d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe created mutex with name "SM0:5024:120:WilError_03" Process d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe created mutex with name "Local\SM0:5024:120:WilError_03" Process d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe created mutex with name "Local\ZonesCacheCounterMutex" Process d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe created mutex with name "SM0:5024:304:WilStaging_02" Process d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5024:120:WilError_03" Process d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5644:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:5644:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:5644:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:5644:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5644:304:WilStaging_02" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5644:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6660:304:WilStaging_02" Process d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe created mutex with name "\Sessions\1\BaseNamedObjects\Rmc-K81550"44:T16fa,"d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "FXmail.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "FXmail.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "FXmail.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "FXmail.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "FXmail.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135]45:T225d,"\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001068.00000001.135121.CCD70000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001068.00000001.135121.CCD70000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00001068.00000001.135121.CD038000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005024.00000000.132348.AC0B0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005024.00000000.132348.AC0B0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005024.00000001.132795.AC0B0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005024.00000001.132795.AC0B0000.00000004.mdmp "Registry\Machine\Software\Classes\AppID\d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" in Source: 00000000-00005024.00000001.132795.AE1E0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\OverrideFileSystemProperties" in Source: 00000000-00005024.00000001.132795.AE1E0000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00005024.00000001.132795.AE1E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005024.00000001.132795.AE1E0000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\powershell.exe" in Source: 00000000-00005024.00000001.132795.AE1E0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005024.00000001.132795.AE1E0000.00000004.mdmp "\Software\CZ" in Source: 00000000-00005024.00000001.132795.AE1E0000.00000004.mdmp "y\Machine\Software\Classes\AppID\d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" in Source: 00000000-00005024.00000001.132795.AE1E0000.00000004.mdmp "USERDNSDOMAIN=DESKTOP-FVV\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}r=C:\WINDOWS" in Source: 00000000-00005024.00000001.132795.AE1E0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00p" in Source: 00000000-00005024.00000001.132795.AE1E0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}" in Source: 00000000-00005024.00000001.132795.AE1E0000.00000004.mdmp "145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{Cw" in Source: 00000000-00005024.00000001.132795.AE1E0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005024.00000001.132795.AE1E0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005644.00000000.133091.6E48B000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005644.00000000.133091.6E48B000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005644.00000000.133091.6E48B000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005644.00000000.133091.6E48B000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005644.00000000.133091.6E48B000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005644.00000000.133091.6E48B000.00000002.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}P" in Source: 00000000-00005644.00000001.135009.6A4C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005644.00000001.135009.6A5C0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00005644.00000001.135009.6A649000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}L" in Source: 00000000-00005644.00000001.135009.6A649000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00005644.00000001.135009.6B592000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005644.00000001.135009.6B592000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006660.00000000.133101.40000000.00000040.mdmp "Software\" in Source: 00000000-00006660.00000000.133101.40000000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00006660.00000000.133101.40000000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006660.00000000.133101.40000000.00000040.mdmp "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00006660.00000000.133101.40000000.00000040.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00006660.00000000.133101.40000000.00000040.mdmp "\Opera Software\Opera Stable" in Source: 00000000-00006660.00000000.133101.40000000.00000040.mdmp "\Opera Software\Opera GX Stable" in Source: 00000000-00006660.00000000.133101.40000000.00000040.mdmp "\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00006660.00000000.133101.40000000.00000040.mdmp "\Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00006660.00000000.133101.40000000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00006660.00000000.133101.40000000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\" in Source: 00000000-00006660.00000000.133101.40000000.00000040.mdmp "S-1-5-21-735145574-3570218355-1207367261-1001\Software\Rmc-K81550\" in Source: 00000000-00006660.00000000.133101.44140000.00000004.mdmp "e\Software\C" in Source: 00000000-00006660.00000000.133101.44140000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006660.00000000.133101.44140000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00006660.00000000.133101.44140000.00000004.mdmp "\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4" in Source: 00000000-00006660.00000000.133101.44140000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00006660.00000000.133101.44140000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006660.00000000.133101.44140000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6" in Source: 00000000-00006660.00000000.133101.44140000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00006660.00000000.133101.44140000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00006660.00000000.133101.44140000.00000004.mdmp "chine\Software\Classes\WOW6432Node\CLSID\{F" in Source: 00000000-00006660.00000000.133101.44140000.00000004.mdmp "y\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00006660.00000000.133101.44140000.00000004.mdmp "ppD\Registry\Machine\Software\Classes\WOW6432Node\C" in Source: 00000000-00006660.00000000.133101.44140000.00000004.mdmp "\Re\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{C" in Source: 00000000-00006660.00000000.133101.44140000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00006660.00000000.133101.44140000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00006660.00000000.133101.44140000.00000004.mdmp46:T3f4d,"GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.businesswire.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/x-icon Date: Thu 05 Nov 2026 14:58:01 GMT Last-Modified: Tue 29 Sep 2026 20:14:20 GMT Content-Security-Policy: frame-ancestors 'self' Akamai-Cache-Status: Hit from child Vary: Accept-Encoding Content-Encoding: gzip Etag: W/"3aee-1a0eecdcd60" Server-Timing: 0ms Accept-Ranges: bytes Cache-Control: public must-revalidate max-age=235723 Alt-Svc: h3=":443"; ma=93600 with no response body "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: www.rswebsols.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/x-icon Date: Thu 05 Nov 2026 14:58:01 GMT Server: cloudflare Expires: Fri 05 Nov 2027 20:56:44 GMT Vary: Accept-Encoding Content-Encoding: br X-Frame-Options: SAMEORIGIN Access-Control-Allow-Headers: Content-Type Authorization X-Turbo-Charged-By: LiteSpeed Cross-Origin-Opener-Policy: unsafe-none Platform: hostinger Last-Modified: Fri 12 Jun 2026 19:42:56 GMT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Referrer-Policy: strict-origin-when-cross-origin Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=t2UTTwVA7UKXAQJbu9kJED4t3Ds%2BkCAdLLrEpWHqcXTmZFPI9Y813I9Jwqlogva6wEMrIwjDLVcY4mTv0M2oEXe%2By8FVmyr7xBLvVN%2FOfsHxpiznH6%2FldoJydYYfy5WMX8h%2FDA%3D%3D"}]} Cross-Origin-Resource-Policy: cross-origin Cache-Control: public max-age=31557600 Panel: hpanel Cross-Origin-Embedder-Policy-Report-Only: unsafe-none; report-to='default' Cross-Origin-Opener-Policy-Report-Only: unsafe-none; report-to='default' Cf-Ray: a55cb6d9a9104900-SJC Permissions-Policy: accelerometer=() autoplay=() camera=() cross-origin-isolated=() display-capture=(self) encrypted-media=() fullscreen=* geolocation=(self) gyroscope=() keyboard-map=() magnetometer=() microphone=() midi=() payment=* picture-in-picture=* publickey-credentials-get=() screen-wake-lock=() sync-xhr=* usb=() xr-spatial-tracking=() gamepad=() serial=() X-Permitted-Cross-Domain-Policies: none Cf-Cache-Status: HIT Expect-Ct: max-age=86400 enforce Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Methods: GET POST Content-Security-Policy: upgrade-insecure-requests; X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Etag: "47e-6a2c6140-cbc63111d1712e45;br" Cf-Apo-Via: origin qs Cross-Origin-Embedder-Policy: unsafe-none; report-to='default' Accept-Ranges: bytes Alt-Svc: h3=":443"; ma=86400 Age: 77 with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: wotdev.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/vnd.microsoft.icon Date: Thu 05 Nov 2026 14:58:02 GMT Server: cloudflare Cf-Ray: a55cb6d9f9e970f0-SJC Vary: accept-encoding Content-Encoding: br Cf-Cache-Status: REVALIDATED Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Etag: W/"9bff2e381b52492b32391a402b8ea71d" Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=o92cy%2B4FtU3SDtgdqiGsGKZiK0BAoGVR1XeplszciuQm%2FO1tnJxmVCgH88bvuwmtPnq7i7aCLo8dfIh9YaKbVayvZPjYf%2BGMy0O%2BxPsjWKHhYl%2B8FWRRtQAxQHDJ"}]} Cache-Control: public max-age=14400 must-revalidate Alt-Svc: h3=":443"; ma=86400 with response body ==>BINARY_CONTENT....... "GET /favicon?url=cybersecuritynews.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 14:58:01 GMT X-Msedge-Ref: Ref A: C8BE5745446849E49563082D63AC7F74 Ref B: BY1AA1072317042 Ref C: 2026-11-05T14:58:01Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: C8BE5745446849E49563082D63AC7F74 Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS000005_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-QSQLK Ref C: 2026-11-05T14:58:01Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=thinkamerican.foundation?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 14:58:01 GMT X-Msedge-Ref: Ref A: E7533BF8D97144D4951B4B9FFD295719 Ref B: BY1AA1072317042 Ref C: 2026-11-05T14:58:02Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: E7533BF8D97144D4951B4B9FFD295719 Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS000008_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-GTRXG Ref C: 2026-11-05T14:58:02Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=bastillepost.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 14:58:01 GMT X-Msedge-Ref: Ref A: 92190D4F642747AC92589C3A524F4F5B Ref B: BY1AA1072317042 Ref C: 2026-11-05T14:58:02Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 92190D4F642747AC92589C3A524F4F5B Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS00000G_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-77QWQ Ref C: 2026-11-05T14:58:02Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=cmaworld.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 14:58:01 GMT X-Msedge-Ref: Ref A: 45E0CBACA14D4A689AE65DE35CE4FE35 Ref B: BY1AA1072317042 Ref C: 2026-11-05T14:58:02Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 45E0CBACA14D4A689AE65DE35CE4FE35 Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS00000V_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-KH6ZR Ref C: 2026-11-05T14:58:02Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=suprahow.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 14:58:01 GMT X-Msedge-Ref: Ref A: 7503E38E4A864EB6A982B32D061D18A6 Ref B: BY1AA1072317042 Ref C: 2026-11-05T14:58:02Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 7503E38E4A864EB6A982B32D061D18A6 Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS00000I_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-7HMR8 Ref C: 2026-11-05T14:58:02Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: carinterior.alibaba.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: text/html;charset=UTF-8 Date: Thu 05 Nov 2026 14:58:02 GMT S-Brt: 280 Server: Tengine Vary: Accept-Encoding Eagleid: 2101fb9317938906821247443e0f5b Content-Encoding: gzip S-Rt: 281 Strict-Transport-Security: max-age=31536000 Eagleeye-Traceid: 2101fb9317938906821247443e0f5b X-Protocol: HTTP/2.0 Ups-Target-Key: icbu-seo-ai-backend.vipserver Timing-Allow-Origin: * Server-Timing: rt;dur=0.281 eagleid;desc=2101fb9317938906821247443e0f5b brt;dur=280 Cache-Control: max-age=0 s-maxage=86400 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.aftermarketmatters.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 302 Found Content-Type: text/html; charset=UTF-8 Date: Thu 05 Nov 2026 14:58:03 GMT Server: Sucuri/Cloudproxy X-Sucuri-Id: 11012 Expires: Fri 06 Nov 2026 14:58:03 GMT X-Redirect-By: WordPress X-Frame-Options: SAMEORIGIN Permissions-Policy: private-state-token-redemption=(self "https://www.google.com" "https://www.gstatic.com" "https://recaptcha.net" "https://challenges.cloudflare.com" "https://hcaptcha.com") private-state-token-issuance=(self "https://www.google.com" "https://www.gstatic.com" "https://recaptcha.net" "https://challenges.cloudflare.com" "https://hcaptcha.com") Link: ; rel="https://api.w.org/" X-Sucuri-Cache: HIT Content-Security-Policy: upgrade-insecure-requests; X-Content-Type-Options: nosniff Location: https://www.aftermarketmatters.com/wp-content/uploads/2020/01/cropped-am-32x32.png Cache-Control: max-age=86400 Alt-Svc: h3=":443"; ma=86400 with no response body "GET /wp-content/uploads/2020/01/cropped-am-32x32.png HTTP/2 Host: www.aftermarketmatters.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 14:58:03 GMT Server: Sucuri/Cloudproxy X-Sucuri-Id: 11012 Expires: Fri 06 Nov 2026 14:58:03 GMT X-Frame-Options: SAMEORIGIN X-Sucuri-Cache: HIT Last-Modified: Tue 28 Jan 2020 23:44:37 GMT Content-Security-Policy: upgrade-insecure-requests; X-Content-Type-Options: nosniff Etag: "3e4080b-2f5-59d3bce84e340" Cache-Control: max-age=86400 Alt-Svc: h3=":443"; ma=86400 Accept-Ranges: bytes with no response body47:T4a96,"d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc2fcb0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "ADVAPI32.DLL" at base 7ffc567e0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffc55f30000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffc55f30000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffc55f30000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffc37d20000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "SHLWAPI.DLL" at base 7ffc56f20000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffc53bb0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "VERSION.DLL" at base 7ffc4cb30000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffc20830000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "USER32.DLL" at base 7ffc57f50000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffc55f30000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "MSCOREE.DLL" at base 7ffc417b0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "NTDLL" at base 7ffc58690000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 19badcd0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "PSAPI.DLL" at base 7ffc57440000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "RPCRT4.DLL" at base 7ffc58530000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "KERNEL32.DLL" at base 7ffc569e0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\6078762B90671C2FF9BA39318E2176D8\MSCORLIB.NI.DLL" at base 7ffc1f1d0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "OLE32.DLL" at base 7ffc572f0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffc536c0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 19badcd0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffc55f30000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffc2f5a0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\FE3C9CF707273488C6C658D52D624640\SYSTEM.NI.DLL" at base 7ffc1e550000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\908B5C1DEBCFB784BC25157A8EBCDFBE\SYSTEM.DRAWING.NI.DLL" at base 7ffc2f3a0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\061200DCB8937E1B9EB2641F2CE9D2EC\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ffc1d490000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "UXTHEME.DLL" at base 7ffc536c0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\21FF4BA4607B18A9B179AB90FD3B0BC1\SYSTEM.CORE.NI.DLL" at base 7ffc1ca10000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\24206316825BB75EBFBDD31895DF2F1F\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffc2eaf0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\76FF225C5A523F0BE2364B0FC02BF7F9\SYSTEM.XML.NI.DLL" at base 7ffc1c160000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "NTDLL.DLL" at base 7ffc58690000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "SHELL32.DLL" at base 7ffc57450000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "BCRYPT.DLL" at base 7ffc55eb0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffc54cf0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "IMM32.DLL" at base 7ffc568a0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "COMCTL32.DLL" at base 7ffc27f70000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "GDI32.DLL" at base 7ffc57070000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\66D07C903EC98772AA13EDEBA020FFA3\MICROSOFT.VISUALBASIC.NI.DLL" at base 7ffc2deb0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "GDIPLUS.DLL" at base 7ffc32330000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.19041.6456_NONE_91A399B0CC88BC24\GDIPLUS.DLL" at base 7ffc32330000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffc55f30000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "WINDOWSCODECS.DLL" at base 7ffc534e0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "WLDP.DLL" at base 7ffc55670000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "AMSI.DLL" at base 7ffc47340000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "KERNEL32" at base 7ffc569e0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\SYSTEM32\7X03SSOH.DLL" at base 7ffc416e0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffc53db0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffc50250000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffc43730000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffc48ef0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "SSPICLI.DLL" at base 7ffc55bb0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffc55f30000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "VIRTDISK.DLL" at base 7ffc467f0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ffc51470000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ffc3f990000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\SYSTEM32\ONECORECOMMONPROXYSTUB.DLL" at base 7ffc42570000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffc4ee80000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc2fcb0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffc567e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffc55f30000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffc55f30000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffc55f30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffc37d20000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffc56f20000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffc53bb0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffc4cb30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffc20830000 "powershell.exe" loaded module "USER32.DLL" at base 7ffc57f50000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffc55f30000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffc417b0000 "powershell.exe" loaded module "NTDLL" at base 7ffc58690000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffc58160000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffc57440000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffc58530000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffc569e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\6078762B90671C2FF9BA39318E2176D8\MSCORLIB.NI.DLL" at base 7ffc1f1d0000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffc572f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffc58160000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffc56f90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffc54cf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffc56230000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffc55f30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffc2f5a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\FE3C9CF707273488C6C658D52D624640\SYSTEM.NI.DLL" at base 7ffc1e550000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\21FF4BA4607B18A9B179AB90FD3B0BC1\SYSTEM.CORE.NI.DLL" at base 7ffc1dad0000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffc58160000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffc58160000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffc58690000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffc57450000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffc56630000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffc55d50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\76FF225C5A523F0BE2364B0FC02BF7F9\SYSTEM.XML.NI.DLL" at base 7ffc1d220000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffc47340000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffc55670000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffc55d50000 "powershell.exe" loaded module "KERNEL32" at base 7ffc569e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\7X03SSOH.DLL" at base 7ffc416e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffc41620000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffc3c4a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ffc2fa50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 7ffc420c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\AFD58C711DB7CAC7F0D5CAF525CE8D6C\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffc2df70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\8ECDA6B0FFA321000FAFFBDCDB86175B\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffc2de00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\8990B2F5A93202518A0040E15B565F36\SYSTEM.DATA.NI.DLL" at base 7ffc1b7e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffc2bfa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\24206316825BB75EBFBDD31895DF2F1F\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffc2eaf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\BEABD14F0AB9A67D348911645772E933\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffc2f2c0000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffc49ce0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffc536c0000 "powershell.exe" loaded module "VIRTDISK.DLL" at base 7ffc467f0000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffc57070000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffc55f30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffc48070000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffc47740000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffc55f30000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffc55f30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffc477e0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "PSAPI" at base 7ffc57440000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "SHCORE" at base 7ffc566b0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "SHELL32" at base 7ffc57450000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "SHLWAPI" at base 7ffc56f20000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "IPHLPAPI" at base 7ffc550b0000 "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffc53250000 "FXmail.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc2fcb0000 "FXmail.exe" loaded module "ADVAPI32.DLL" at base 7ffc567e0000 "FXmail.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffc55f30000 "FXmail.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffc55f30000 "FXmail.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffc55f30000 "FXmail.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffc37d20000 "FXmail.exe" loaded module "SHLWAPI.DLL" at base 7ffc56f20000 "FXmail.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffc53bb0000 "FXmail.exe" loaded module "VERSION.DLL" at base 7ffc4cb30000 "FXmail.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffc20830000 "FXmail.exe" loaded module "USER32.DLL" at base 7ffc57f50000 "FXmail.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffc55f30000 "FXmail.exe" loaded module "MSCOREE.DLL" at base 7ffc417b0000 "FXmail.exe" loaded module "NTDLL" at base 7ffc58690000 "FXmail.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 1b74cc40000 "FXmail.exe" loaded module "PSAPI.DLL" at base 7ffc57440000 "FXmail.exe" loaded module "RPCRT4.DLL" at base 7ffc58530000 "FXmail.exe" loaded module "KERNEL32.DLL" at base 7ffc569e0000 "FXmail.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\6078762B90671C2FF9BA39318E2176D8\MSCORLIB.NI.DLL" at base 7ffc1f1d0000 "FXmail.exe" loaded module "OLE32.DLL" at base 7ffc572f0000 "FXmail.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffc536c0000 "FXmail.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 1b74cc40000 "FXmail.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffc55f30000 "FXmail.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffc2f5a0000 "FXmail.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\FE3C9CF707273488C6C658D52D624640\SYSTEM.NI.DLL" at base 7ffc1e550000 "FXmail.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\908B5C1DEBCFB784BC25157A8EBCDFBE\SYSTEM.DRAWING.NI.DLL" at base 7ffc2f3a0000 "FXmail.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\061200DCB8937E1B9EB2641F2CE9D2EC\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ffc1c160000 "FXmail.exe" loaded module "UXTHEME.DLL" at base 7ffc536c0000 "FXmail.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\21FF4BA4607B18A9B179AB90FD3B0BC1\SYSTEM.CORE.NI.DLL" at base 7ffc1dad0000 "FXmail.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\24206316825BB75EBFBDD31895DF2F1F\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffc2eaf0000 "FXmail.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\76FF225C5A523F0BE2364B0FC02BF7F9\SYSTEM.XML.NI.DLL" at base 7ffc1d220000 "FXmail.exe" loaded module "NTDLL.DLL" at base 7ffc58690000 "FXmail.exe" loaded module "SHELL32.DLL" at base 7ffc57450000 "FXmail.exe" loaded module "BCRYPT.DLL" at base 7ffc55eb0000 "FXmail.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffc54cf0000 "FXmail.exe" loaded module "WINDOWSCODECS.DLL" at base 7ffc534e0000 "FXmail.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffc50250000 "FXmail.exe" loaded module "VIRTDISK.DLL" at base 7ffc467f0000 "FXmail.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ffc51470000 "FXmail.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffc4ee80000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ffc55f30000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ffc42600000 "powershell.exe" loaded module "MI.DLL" at base 7ffc4ba50000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7ffc55f30000 "FXmail.exe" loaded module "PSAPI" at base 7ffc57440000 "FXmail.exe" loaded module "IPHLPAPI" at base 7ffc550b000048:T1c91,"d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "This Device" (Path: "HKCU\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "StreamBackedFolder" (Path: "HKCU\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "Removable Drives" (Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PROGID") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER32") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\INPROCHANDLER") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" touched "Known Folder Manager" (Path: "HKCU\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\LOCALSERVER32") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER32")49:T9c2,"d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NATION") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")4a:T104d,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00005024-00000C2B-787183698] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00005024-00000C2B-787984259] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00005024-00000C2B-788075135] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005024-00000C2B-788156047] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll" [Source: 00000000-00005024-00000C2B-788457580] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00005024-00000C2B-788484681] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005024-00000C2B-788544017] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00005024-00000C2B-788622644] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll" [Source: 00000000-00005024-00000C2B-788679139] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\908b5c1debcfb784bc25157a8ebcdfbe\System.Drawing.ni.dll" [Source: 00000000-00005024-00000C2B-788709205] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\061200dcb8937e1b9eb2641f2ce9d2ec\System.Windows.Forms.ni.dll" [Source: 00000000-00005024-00000C2B-788753002] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00005024-00000C2B-788924904] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll" [Source: 00000000-00005024-00000C2B-789023377] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll" [Source: 00000000-00005024-00000C2B-789047810] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll" [Source: 00000000-00005024-00000C2B-789097364] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005024-00000C2B-789357723] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\66d07c903ec98772aa13edeba020ffa3\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00005024-00000C2B-789834136] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005024-00000C2B-790892454] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005024-00000C2B-790916045] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00005024-00000C2B-790939989] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" [Source: 00000000-00005024-00000C2B-791892614] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005024-00000C2B-797112257] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005024-00000C2B-797144845] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00005644-00000C2B-800505730] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00005644-00000C2B-800688458]4b:T92b,Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "C:\\d060036bf0a5275d798388bb267 ..." (UID: 00000000-00005644), Spawned process "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (UID: 00000000-00006660), Spawned process "FXmail.exe" (UID: 00000000-00008540), Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "%APPDATA%\\F0XMAlL\\FXmail.exe"" (UID: 00000000-00001068), Spawned process "FXmail.exe" (UID: 00000000-00005312), Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00002000), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00005156) Spawned process "msedge.exe" with commandline "--type=gpu-process --subproc-heap-profiling --gpu-preferences=SA ..." (UID: 00000000-00004836) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00001736) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00008324) Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --subproc-heap-profiling -- ..." (UID: 00000000-00001372) Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --subproc ..." (UID: 00000000-00005588) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00003132) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00008748) Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00006224) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00005908) Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00006620) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=audio.mojom.AudioService --lan ..." (UID: 00000000-00007720)4c:T92b,Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "C:\\d060036bf0a5275d798388bb267 ..." (UID: 00000000-00005644), Spawned process "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (UID: 00000000-00006660), Spawned process "FXmail.exe" (UID: 00000000-00008540), Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "%APPDATA%\\F0XMAlL\\FXmail.exe"" (UID: 00000000-00001068), Spawned process "FXmail.exe" (UID: 00000000-00005312), Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00002000), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00005156) Spawned process "msedge.exe" with commandline "--type=gpu-process --subproc-heap-profiling --gpu-preferences=SA ..." (UID: 00000000-00004836) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00001736) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00008324) Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --subproc-heap-profiling -- ..." (UID: 00000000-00001372) Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --subproc ..." (UID: 00000000-00005588) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00003132) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00008748) Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00006224) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00005908) Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00006620) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=audio.mojom.AudioService --lan ..." (UID: 00000000-00007720)4d:T1215,The input sample is signed with a certificate issued by "CN=GlobalSign GCC R46 OV TLS CA 2025, O=GlobalSign nv-sa, C=BE" (SHA1: 63:49:20:BF:F8:9C:B1:1B:37:B5:77:1A:3A:E4:65:41:B5:EE:FC:FF; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root R46, O=GlobalSign nv-sa, C=BE" (SHA1: 82:F8:D7:11:87:5F:A3:B9:CF:92:01:AB:F6:22:4F:BA:C6:71:27:70; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 45:D1:6C:B4:60:3D:CD:0A:12:1D:2F:E9:CE:14:CA:AC:3B:5A:8D:A4; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 76:7A:3B:FA:D0:F8:92:94:22:AC:46:9B:F5:92:44:E3:9B:62:43:32; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 4D:9A:CB:31:3D:73:DA:2E:9E:B4:51:A7:CF:63:09:AF:45:C9:93:C1; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: 9C:FF:31:B5:1D:22:B9:BF:D3:80:8A:8C:35:B4:BB:DF:36:13:71:F0; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: 27:E6:66:32:99:D3:40:DF:E5:45:71:CE:CC:EC:01:BE:74:49:5D:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 02, O=Microsoft Corporation, C=US" (SHA1: 20:68:99:D7:5C:1F:E1:8F:14:28:B6:96:30:2F:F8:D4:78:01:64:46; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: F8:A4:08:B8:FB:EE:A0:77:B7:57:38:65:86:41:BE:77:15:47:20:EB; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 M04, O=Amazon, C=US" (SHA1: E7:26:0D:F0:1C:8D:4A:F7:5D:16:41:FB:C8:4E:3A:04:86:AD:99:8A; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon Root CA 1, O=Amazon, C=US" (SHA1: E7:B8:B5:A6:74:3C:E1:B2:F1:7B:04:1D:E5:95:58:A4:14:72:D7:0C; see report for more information) The input sample is signed with a certificate issued by "CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 06:B2:59:27:C4:2A:72:16:31:C1:EF:D9:43:1E:64:8F:A6:2E:1E:39; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: 7E:9B:0B:64:0F:E9:7B:DD:92:F4:5A:F3:DF:89:50:51:E2:3F:3C:30; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 90:0D:86:82:25:58:2B:45:67:12:54:6E:F6:96:68:8D:D1:1C:B0:2D; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GoDaddy TLS Intermediate CA DV - R1v1, O=GoDaddy.com, C=US" (SHA1: 3F:4E:6F:58:48:32:CE:18:D2:DF:9D:C1:87:01:18:EF:E2:6F:74:68; see report for more information) The input sample is signed with a certificate issued by "CN=GoDaddy TLS Root CA - R1, O=GoDaddy.com, C=US" (SHA1: 34:61:29:CF:D9:D9:41:2A:8F:26:80:7E:6E:EE:40:74:44:61:4D:5E; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 97:08:54:2D:76:3B:1A:AF:C1:2C:D5:B6:5B:3B:C9:E1:82:F7:1F:C4; see report for more information)4e:T47a,"StartupProfileData-NonInteractive" has type "data"- [targetUID: N/A] "ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00005644] "__PSScriptPolicyTest_pptwhp15.h5p.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_pptwhp15.h5p.psm1]- [targetUID: 00000000-00005644] "__PSScriptPolicyTest_s3tgv0s3.4vj.ps1" has type "ASCII text with no line terminators"- [targetUID: N/A] "__PSScriptPolicyTest_q21o1re1.eo3.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_q21o1re1.eo3.ps1]- [targetUID: 00000000-00005644] "__PSScriptPolicyTest_q3mjm3vn.4fq.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_q3mjm3vn.4fq.ps1]- [targetUID: 00000000-00001068] "__PSScriptPolicyTest_yauium5x.1sq.psm1" has type "ASCII text with no line terminators"- [targetUID: N/A] "__PSScriptPolicyTest_21ngamv2.ssl.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_21ngamv2.ssl.psm1]- [targetUID: 00000000-00001068]4f:T6ea,"d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\APPLICATIONS\D060036BF0A5275D798388BB267893149C2A105CDEB6832A00A8B0D09447D827.EXE"; Key: ""; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKCU\DELEGATEFOLDERS"; Key: ""; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\DELEGATEFOLDERS"; Key: ""; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "")50:T150b,"d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "32980F26-C8F5-5767-6B26-635B3FA83C61"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "703FCC13-B66F-5868-DDD9-E2DB7F381FFB"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: "STORAGEDELEGATESUPPRESSIONPOLICY"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: "STORAGEDELEGATE"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "")51:T7af,"d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll.aux" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.windows.forms\061200dcb8937e1b9eb2641f2ce9d2ec\system.windows.forms.ni.dll.aux" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\808887ebadf1a37835b907c866cede3c\system.ni.dll.aux" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\fe3c9cf707273488c6c658d52d624640\system.ni.dll.aux" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.drawing\908b5c1debcfb784bc25157a8ebcdfbe\system.drawing.ni.dll.aux" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.configuration\24206316825bb75ebfbdd31895df2f1f\system.configuration.ni.dll.aux" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\11723c46cea53a98c07435785eae2ca8\system.core.ni.dll.aux" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\21ff4ba4607b18a9b179ab90fd3b0bc1\system.core.ni.dll.aux" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xml\76ff225c5a523f0be2364b0fc02bf7f9\system.xml.ni.dll.aux"52:T587,"d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to touch file "C:\Windows\System32\mscoree.dll" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to touch file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to touch file "C:\WINDOWS\SYSTEM32\apphelp.dll" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to touch file "C:\d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to touch file "C:\windows\temp\VxSSL64.dll" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to touch file "C:\FLTLIB.DLL"53:T841,"d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\FLTLIB.DLL" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\MSVCP140.dll" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll"54:T842,"d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.local" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe.config" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\uTmH" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.INI" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PublisherPolicy.tme" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.INI" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.INI" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Design" "d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Design.INI"55:T5638,Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e;" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc120531151137z0/^g(o-cejy" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigicert" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0?5erissymantec" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mn" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00001068.00000001.135121.CCDEB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00001068.00000001.135121.CCE70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00001068.00000001.135121.CCE70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00001068.00000001.135121.CCE70000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00001068.00000001.135121.CCE70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00001068.00000001.135121.CCE70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt00_1t?lvbp)r" - Source: "00000000-00001068.00000001.135121.CCE70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00001068.00000001.135121.CCE70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0a08." - Source: "00000000-00001068.00000001.135121.CCE70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0::vm4" - Source: "00000000-00001068.00000001.135121.CCE70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00001068.00000001.135121.CCED9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" - Source: "00000000-00001068.00000001.135121.CCED9000.00000004.mdmp") Found URL "http://crl.microsjpy2egt3blcmf0aw9uczenmc7b7b" - Source: "00000000-00001068.00000001.135121.CCED9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0]bbae" - Source: "00000000-00001068.00000001.135121.CCED9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0'.b!" - Source: "00000000-00001068.00000001.135121.CCED9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0qhwbs-ztxnw,xzz" - Source: "00000000-00001068.00000001.135121.CCED9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0:'l$zmsnc" - Source: "00000000-00001068.00000001.135121.CCED9000.00000004.mdmp") Found URL "http://om/pki/c%rooceraut_2010-06-23.crt0>ngdxfg:smxsu$wica" - Source: "00000000-00001068.00000001.135121.CCED9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0ahq.a)d$g5" - Source: "00000000-00001068.00000001.135121.CCED9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%200_1t?lvbp)r" - Source: "00000000-00001068.00000001.135121.CD070000.00000004.mdmp") Found URL "http://www.mi" - Source: "00000000-00001068.00000001.135121.CD070000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/v20production%20pca%202023.crt0a08." - Source: "00000000-00001068.00000001.135121.CD070000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json11/05" - Source: "00000000-00005024.00000001.132795.AE3B0000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,011/05" - Source: "00000000-00005024.00000001.132795.AE3B0000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00005644.00000001.135009.6A4C0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005644.00000001.135009.6A4C0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005644.00000001.135009.6A4C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0washington1redmond1microsoft" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ep8uj@dzj@dzj@gzj@dzj" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,4http" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0mpfa=" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00005644.00000001.135009.6A53D000.00000004.mdmp") Found URL "https://go.microsoft.cobsjbv4.0.30319" - Source: "00000000-00005644.00000001.135009.6A5C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005644.00000001.135009.6A5C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00005644.00000001.135009.6A5C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0vd!7i6u4$i<-o_-!dq" - Source: "00000000-00005644.00000001.135009.6A746000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005644.00000001.135009.6A746000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" - Source: "00000000-00005644.00000001.135009.6A746000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0qhwbs-ztxnw,xzz" - Source: "00000000-00005644.00000001.135009.6A746000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0!2es