26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 001398cbdd29… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 001398cbdd29…. Malware family: Trojan.Generic. Threat score 100/100. 9/28 AV engines flagged this file. 13 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":9,"total":28},"behavioralIndicators":{"malicious":13,"suspicious":28},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T777,"001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "FindResourceA" with parameter "2822776" - (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "FindResourceA" with parameter "2822784" - (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "FindResourceA" with parameter "2822812" - (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "FindResourceA" with parameter "2823024" - (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "FindResourceA" with parameter "2822840" - (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "FindResourceA" with parameter "2822996" - (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "FindResourceA" with parameter "2823008" - (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "FindResourceA" with parameter "13237152" - (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "FindResourceA" with parameter "2822892" - (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "FindResourceA" with parameter "2822988" - (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "FindResourceA" with parameter "13237148" - (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "FindResourceA" with parameter "2822856" - (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "FindResourceA" with parameter "2822864" - (UID: 00000000-00003820)28:Tc14,"001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2869376'}" (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2869232'}" (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2869392'}" (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2869280'}" (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2869248'}" (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2869296'}" (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2869344'}" (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2869216'}" (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2869328'}" (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2869360'}" (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2869312'}" (UID: 00000000-00003820) "ZW0Mx06.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11257984'}" (UID: 00000000-00003840) "ZW0Mx06.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11257840'}" (UID: 00000000-00003840) "ZW0Mx06.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11258000'}" (UID: 00000000-00003840) "ZW0Mx06.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11257888'}" (UID: 00000000-00003840) "ZW0Mx06.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11257856'}" (UID: 00000000-00003840) "ZW0Mx06.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11257904'}" (UID: 00000000-00003840) "ZW0Mx06.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11257952'}" (UID: 00000000-00003840) "ZW0Mx06.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11257824'}" (UID: 00000000-00003840) "ZW0Mx06.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11257936'}" (UID: 00000000-00003840) "ZW0Mx06.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11257968'}" (UID: 00000000-00003840)29:T541,"001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00003820) "ZW0Mx06.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00003840) "ZW0Mx06.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00003840) "ZW0Mx06.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP\ (UID: 00000000-00003840) "su7Pd51.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00003108) "su7Pd51.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00003108) "su7Pd51.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00003108) "su7Pd51.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP\ (UID: 00000000-00003108) "wT5lx74.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007084) "wT5lx74.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007084) "wT5lx74.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00007084) "wT5lx74.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00007084) "wT5lx74.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP\ (UID: 00000000-00007084)2a:T412,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "3Gz76Be.exe.1452090642") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp")2b:T609,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "3Gz76Be.exe.1452090642") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "3Gz76Be.exe.1452090642") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "3Gz76Be.exe.1452090642") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp")2c:T456,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp")2d:T147e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-71-00AB2CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-71-00AB2CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-65-00AB53A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-65-00AB53A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-29-00AB52B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-29-00AB52B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-42-00AB202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00003840-15619-42-00AB202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-42-00AB202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-22-00AB681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-22-00AB681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-40-00AB2267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-40-00AB2267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-43-00AB1AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-43-00AB1AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-77-00AB2773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-77-00AB2773 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-60-00AB597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-60-00AB597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-37-00AB3FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-37-00AB3FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-73-00AB17EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-73-00AB17EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-16-00AB44B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-16-00AB44B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-52-00AB4EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-52-00AB4EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-57-00AB6298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-57-00AB6298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-62-00AB55A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-62-00AB55A0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003840-15619-31-00AB2390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003840-15619-31-00AB2390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-59-00AB621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-59-00AB621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-72-00AB18A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-72-00AB18A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-66-00AB2630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-66-00AB2630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-15-00AB1F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-15-00AB1F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-74-00AB36EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-74-00AB36EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-44-00AB2AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-44-00AB2AAC Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00003840-15619-83-00AB7155 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00003840-15619-83-00AB7155 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00003840-15619-83-00AB7155 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00003840-15619-83-00AB7155 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00003840-15619-83-00AB7155 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-33-00AB2F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-33-00AB2F1D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-15619-26-00AB24E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-15619-26-00AB24E02e:T96e,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=CZphmrmQOivZQLVr7mMDContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=CZphmrmQOivZQLVr7mMDContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=CZphmrmQOivZQLVr7mMDContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=CZphmrmQOivZQLVr7mMDContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=CZphmrmQOivZQLVr7mMDContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=CZphmrmQOivZQLVr7mMDContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=CZphmrmQOivZQLVr7mMDContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=CZphmrmQOivZQLVr7mMDContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache"2f:T453,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: PCAP contains base64 strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to decrypt/decode data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]30:T1b90,"001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003820) "ZW0Mx06.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003840) "ZW0Mx06.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003840) "su7Pd51.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003108) "su7Pd51.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003108) "wT5lx74.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007084) "wT5lx74.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007084) "1Ze70jy1.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000cb6f57372325de71102293007f7e1b46d4ef93003054de7107812446feffffffe4ef9300002add7100009472feffffff5835b2020000947200000000000000000000000078ef9300 (UID: 00000000-00007780) "1Ze70jy1.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007780) "1Ze70jy1.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007780)31:T7ac,"001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "ZW0Mx06.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ZW0Mx06.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "su7Pd51.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "su7Pd51.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "wT5lx74.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "wT5lx74.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1Ze70jy1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Sw9872.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Sw9872.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Gz76Be.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Gz76Be.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "4tw168rt.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4tw168rt.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")32:T522,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "5oY8da3.exe.2628545589") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp")33:T572,"001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\ZW0Mx06.exe" - (UID: 00000000-00003820) "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\5oY8da3.exe" - (UID: 00000000-00003820) "ZW0Mx06.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\su7Pd51.exe" - (UID: 00000000-00003840) "ZW0Mx06.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\4tw168rt.exe" - (UID: 00000000-00003840) "su7Pd51.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\wT5lx74.exe" - (UID: 00000000-00003108) "su7Pd51.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\3Gz76Be.exe" - (UID: 00000000-00003108) "wT5lx74.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\1Ze70jy1.exe" - (UID: 00000000-00007084) "wT5lx74.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\2Sw9872.exe" - (UID: 00000000-00007084) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login" - (UID: 00000000-00004712) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/" - (UID: 00000000-00004712)34:T925,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMit" (Indicator: "CreateProcess"; Source: "00000000-00003108.00000000.70834.03330000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003108.00000000.70834.03330000.00000004.mdmp, 00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "MPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "vateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp")35:T464,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp")36:Te13b,Found reference to API (Indicator: "CheckTokenMembership"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "HeapSetInformation"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "DecryptFileA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "SHBrowseForFolder"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetTokenInformation"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "RegDeleteValueA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "RegOpenKeyExA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "FreeSid"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "OpenProcessToken"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "RegSetValueExA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "RegCreateKeyExA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "RegQueryValueExA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "EqualSid"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "RegCloseKey"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetShortPathNameA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetModuleFileNameA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "FindFirstFileA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetCurrentProcess"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "FindNextFileA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "FindClose"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "LocalAlloc"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "lstrcmpA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "CompareStringA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetLastError"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetFileAttributesA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "LoadLibraryA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "DeleteFileA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GlobalAlloc"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GlobalFree"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "CloseHandle"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "SetFileAttributesA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetProcAddress"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GlobalLock"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "LocalFree"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "RemoveDirectoryA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "FreeLibrary"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "CreateDirectoryA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GlobalUnlock"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "ReadFile"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "SizeofResource"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "WriteFile"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetDriveTypeA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "LoadLibraryExA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "SetFileTime"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "SetFilePointer"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "FindResourceA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "CreateMutexA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetVolumeInformationA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "WaitForSingleObject"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "FreeResource"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetVersion"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetTempPathA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "CreateFileA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "SetEvent"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "TerminateThread"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetVersionExA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "LockResource"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetSystemInfo"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "CreateThread"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "ResetEvent"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "LoadResource"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "ExitProcess"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetModuleHandleW"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "CreateProcessA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "FormatMessageA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetTempFileNameA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "CreateEventA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetExitCodeProcess"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetDeviceCaps"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetDesktopWindow"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "CharUpperA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "ExitWindowsEx"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "MessageBeep"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "CharPrevA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "LoadStringA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "CharNextA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "EnableWindow"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "ReleaseDC"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "SetForegroundWindow"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "PeekMessageA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "SendMessageA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "MessageBoxA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "SetWindowTextA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetWindowLongA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "CallWindowProcA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "SetWindowLongA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "ShowWindow"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "SetWindowPos"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetDC"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetWindowRect"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "DispatchMessageA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "VerQueryValueA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "Sleep"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetStartupInfoW"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "TerminateProcess"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetCurrentProcessId"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetCurrentThreadId"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetTickCount"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "MulDiv"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "GetSystemMetrics"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API (Indicator: "FlsAlloc"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "FlsSetValue"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "LCMapStringEx"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "AreFileApisANSI"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "CompareStringEx"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "FlsGetValue"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "LocaleNameToLCID"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetTimeFormatEx"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "LCIDToLocaleName"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "FlsFree"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "IsValidLocaleName"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetDateFormatEx"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "RegDisablePredefinedCacheEx"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "FreeConsole"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "RaiseException"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetExitCodeThread"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "InitializeSRWLock"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "InitializeConditionVariable"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "WakeConditionVariable"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "WideCharToMultiByte"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "MultiByteToWideChar"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetStringTypeW"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "InitOnceBeginInitialize"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "InitOnceComplete"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "CreateThreadpoolWork"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "SubmitThreadpoolWork"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "CloseThreadpoolWork"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetModuleHandleExW"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "EnterCriticalSection"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "LeaveCriticalSection"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "DeleteCriticalSection"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "EncodePointer"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "DecodePointer"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetCPInfo"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "CreateEventW"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "InitializeSListHead"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "IsDebuggerPresent"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "RtlUnwind"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "SetLastError"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "TlsAlloc"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "TlsGetValue"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "TlsSetValue"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "TlsFree"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "LoadLibraryExW"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "ExitThread"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetStdHandle"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetModuleFileNameW"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetCommandLineA"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetCommandLineW"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "HeapFree"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "HeapAlloc"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "CompareStringW"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "LCMapStringW"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetLocaleInfoW"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "IsValidLocale"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetFileType"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetFileSizeEx"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "SetFilePointerEx"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "FlushFileBuffers"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetConsoleMode"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "HeapReAlloc"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "FindFirstFileExW"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "FindNextFileW"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "IsValidCodePage"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetACP"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetOEMCP"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "SetStdHandle"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetProcessHeap"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "ReadConsoleW"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "HeapSize"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "CreateFileW"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "WriteConsoleW"; File: "3Gz76Be.exe.1452090642") Found reference to API (Indicator: "GetActiveWindow"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "GetLastActivePopup"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "GetProcessWindowStation"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "lstrlenA"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "InterlockedDecrement"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "GetModuleHandleA"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "Module32Next"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "Module32First"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "OleInitialize"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "HeapCreate"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "VirtualFree"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "VirtualAlloc"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "GetConsoleCP"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "InterlockedIncrement"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "SetHandleCount"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "GetStartupInfoA"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "WriteConsoleA"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "GetLocaleInfoA"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "LCMapStringA"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "GetStringTypeA"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "SetEndOfFile"; File: "1Ze70jy1.exe.2151656144") Found reference to API (Indicator: "InitOnceExecuteOnce"; File: "5oY8da3.exe.2628545589") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "5oY8da3.exe.2628545589") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "5oY8da3.exe.2628545589") Found reference to API (Indicator: "RtlGetVersion"; File: "5oY8da3.exe.2628545589") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "5oY8da3.exe.2628545589") Found reference to API (Indicator: "GetLongPathNameW"; File: "5oY8da3.exe.2628545589") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "5oY8da3.exe.2628545589") Found reference to API (Indicator: "UnregisterWait"; File: "5oY8da3.exe.2628545589") Found reference to API (Indicator: "GetCurrentThread"; File: "5oY8da3.exe.2628545589") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00003108.00000000.70834.00BC1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00003108.00000000.70834.00BC1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00003108.00000000.70834.00BC1000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00003820.00000000.70741.002B1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00003820.00000000.70741.002B1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00003820.00000000.70741.002B1000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp")37:T80a,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "LockResource" (Indicator: "LockResource"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp")38:T4ef,"001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "ZW0Mx06.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "su7Pd51.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "wT5lx74.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "4tw168rt.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2Sw9872.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "3Gz76Be.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT39:T10d1,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://accounts.google.com" (Indicator: "facebook.com"; File: "8F8.bat") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3i7M54/yn/l/en_US/WW_dM8tCcty.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "33bd99500895911e_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3iqES4/yQ/l/en_US/riV0sq4fGtL.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "f658fdd182550cbb_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yi/r/K1u8FojW_L0.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/8b69TNlXf" (Indicator: "facebook.com"; File: "3b9b063938b2e939_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yO/r/_tJ17sGyxOX.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "7faaeb6d807041bb_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yd/r/D8yA-TXiNuk.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/,T,E" (Indicator: "facebook.com"; File: "42ce332cdbe9fa73_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yh/r/bpW4eEg-2_W.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/bB:9" (Indicator: "facebook.com"; File: "40701b42ebc1cb18_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yt/r/d4QqVJOdC1V.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "49d0896e54e4faca_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yt/r/jIUN0Hn2kpD.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "4b1691c2d8c552f5_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yo/r/j5B70NmINXl.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "2556f6e9598d5fb0_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/ye/r/yUtEQ4ajXZI.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/HyZZ" (Indicator: "facebook.com"; File: "4945a7b4b1e84510_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yf/r/LgvwffuKmeX.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "42f4c516cc7fb026_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yF/r/FLJXkx8ys-6.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "ee9a8283c80e3e52_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yI/r/8iBPf52GdU5.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/_qT9" (Indicator: "facebook.com"; File: "9e35b0c2ae3dcde4_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yn/r/FQIPxzEyFvX.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "7a9bea57b8cf5f41_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yk/r/kg_LcWkMBGy.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/oKhi" (Indicator: "facebook.com"; File: "7b95d65eb18c490e_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/ym/r/R_qswDMOLWA.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/01bt" (Indicator: "facebook.com"; File: "ebcedc747b584a9b_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/ys/r/_f5wO_K1viW.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "ac9537cd8ef7244a_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yF/r/gb_2sOlx922.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/M[YS]f.g" (Indicator: "facebook.com"; File: "22a1dfae96f6cc61_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yr/r/6XlDJXhMTmo.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "8d5e1c410a09c25f_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yi/r/VaHNVNii56Z.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/#/K7^6" (Indicator: "facebook.com"; File: "d4e5d662b01c72f2_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yb/r/X98p6omdveu.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "d3776b2d341e7614_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yA/r/gYsh5OsZKde.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "0fe2e0c1a33ed442_0") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP")3a:T576,Launches browser "msedge.exe" (UID: 00000000-00006824) Launches browser "msedge.exe" (UID: 00000000-00008084) Launches browser "msedge.exe" (UID: 00000000-00002044) Launches browser "msedge.exe" (UID: 00000000-00007068) Launches browser "msedge.exe" (UID: 00000000-00003904) Launches browser "msedge.exe" (UID: 00000000-00007948) Launches browser "msedge.exe" (UID: 00000000-00003696) Launches browser "msedge.exe" (UID: 00000000-00005736) Launches browser "msedge.exe" (UID: 00000000-00003672) Launches browser "msedge.exe" (UID: 00000000-00001760) Launches browser "msedge.exe" (UID: 00000000-00007196) Launches browser "msedge.exe" (UID: 00000000-00006088) Launches browser "msedge.exe" (UID: 00000000-00006080) Launches browser "msedge.exe" (UID: 00000000-00005628) Launches browser "msedge.exe" (UID: 00000000-00007188) Launches browser "msedge.exe" (UID: 00000000-00004996) Launches browser "msedge.exe" (UID: 00000000-00006864) Launches browser "msedge.exe" (UID: 00000000-00002184) Launches browser "msedge.exe" (UID: 00000000-00008104) Launches browser "msedge.exe" (UID: 00000000-00007676) Launches browser "msedge.exe" (UID: 00000000-00007804) Launches browser "msedge.exe" (UID: 00000000-00004056) Launches browser "msedge.exe" (UID: 00000000-00007836) Launches browser "msedge.exe" (UID: 00000000-00003632) Launches browser "msedge.exe" (UID: 00000000-00006832)3b:T6ce,"001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74800000 "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72AA0000 "ZW0Mx06.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74800000 "ZW0Mx06.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72AA0000 "su7Pd51.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74800000 "su7Pd51.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72AA0000 "su7Pd51.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 75B60000 "su7Pd51.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 754B0000 "wT5lx74.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74800000 "wT5lx74.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72AA0000 "1Ze70jy1.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74800000 "1Ze70jy1.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72AA0000 "2Sw9872.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74800000 "2Sw9872.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72AA0000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74800000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72AA0000 "3Gz76Be.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74800000 "3Gz76Be.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72AA0000 "4tw168rt.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74800000 "4tw168rt.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72AA0000 "5oY8da3.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 748000003c:Tf99,"001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad" was detected as "Microsoft Cabinet" and name: "sfx" "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad" was detected as "Microsoft Visual C/C++" and name: "Compiler" "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad" was detected as "Microsoft Cabinet File" and name: "Archive" "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad" was detected as "Microsoft Linker" and name: "Linker" "ZW0Mx06.exe" was detected as "Microsoft Cabinet" and name: "sfx" "ZW0Mx06.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ZW0Mx06.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ZW0Mx06.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "ZW0Mx06.exe" was detected as "Microsoft Linker" and name: "Linker" "su7Pd51.exe" was detected as "Microsoft Cabinet" and name: "sfx" "su7Pd51.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "su7Pd51.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "su7Pd51.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "su7Pd51.exe" was detected as "Microsoft Linker" and name: "Linker" "wT5lx74.exe" was detected as "Microsoft Cabinet" and name: "sfx" "wT5lx74.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "wT5lx74.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "wT5lx74.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "wT5lx74.exe" was detected as "Microsoft Linker" and name: "Linker" "4tw168rt.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4tw168rt.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4tw168rt.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4tw168rt.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4tw168rt.exe" was detected as "Microsoft Linker" and name: "Linker" "2Sw9872.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2Sw9872.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2Sw9872.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2Sw9872.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2Sw9872.exe" was detected as "Microsoft Linker" and name: "Linker" "3Gz76Be.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3Gz76Be.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3Gz76Be.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3Gz76Be.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3Gz76Be.exe" was detected as "Microsoft Linker" and name: "Linker" "1Ze70jy1.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1Ze70jy1.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1Ze70jy1.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1Ze70jy1.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1Ze70jy1.exe" was detected as "Microsoft Linker" and name: "Linker" "5oY8da3.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5oY8da3.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5oY8da3.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5oY8da3.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5oY8da3.exe" was detected as "Microsoft Linker" and name: "Linker" "Part-RU" was detected as "Microsoft Cabinet" and name: "sfx" "Part-RU" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Part-RU" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Part-RU" was detected as "Microsoft Cabinet File" and name: "Archive" "Part-RU" was detected as "Microsoft Linker" and name: "Linker"3d:T6ae,"1Ze70jy1.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "5oY8da3.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "5oY8da3.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "5oY8da3.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "5oY8da3.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "5oY8da3.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "5oY8da3.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "5oY8da3.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "5oY8da3.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "5oY8da3.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "cmd.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "cmd.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\TREATAS") "cmd.exe" touched "Microsoft Url History Service" (Path: "HKCU\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS")3e:T14a4,"001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "ZW0Mx06.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "su7Pd51.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "wT5lx74.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4tw168rt.exe" file has an entrypoint instructions - "call 0x40a916,jmp 0x409ccc,push ebp,mov ebp, esp,jmp 0x409e6a,push dword ptr [ebp + 8],call 0x415ce3,pop ecx,test eax, eax,je 0x409e79,push dword ptr [ebp + 8],call 0x410c52,pop ecx,test eax, eax,je 0x409e5d,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x40ac62,jmp 0x40ac45,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40ac7f,pop ecx,pop ebp,ret ,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28," "2Sw9872.exe" file has an entrypoint instructions - "call 0x40a916,jmp 0x409ccc,push ebp,mov ebp, esp,jmp 0x409e6a,push dword ptr [ebp + 8],call 0x415ce3,pop ecx,test eax, eax,je 0x409e79,push dword ptr [ebp + 8],call 0x410c52,pop ecx,test eax, eax,je 0x409e5d,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x40ac62,jmp 0x40ac45,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40ac7f,pop ecx,pop ebp,ret ,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28," "3Gz76Be.exe" file has an entrypoint instructions - "call 0x40a916,jmp 0x409ccc,push ebp,mov ebp, esp,jmp 0x409e6a,push dword ptr [ebp + 8],call 0x415ce3,pop ecx,test eax, eax,je 0x409e79,push dword ptr [ebp + 8],call 0x410c52,pop ecx,test eax, eax,je 0x409e5d,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x40ac62,jmp 0x40ac45,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40ac7f,pop ecx,pop ebp,ret ,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28," "1Ze70jy1.exe" file has an entrypoint instructions - "call 0x412a15,jmp 0x40cbdd,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x20,mov eax, dword ptr [ebp + 8],push esi,push edi,push 8,pop ecx,mov esi, 0x41f058,lea edi, [ebp - 0x20],rep movsd dword ptr es:[edi], dword ptr [esi],mov dword ptr [ebp - 8], eax,mov eax, dword ptr [ebp + 0xc],pop edi,mov dword ptr [ebp - 4], eax,pop esi,test eax, eax,je 0x40cd6e,test byte ptr [eax], 8,je 0x40cd6e,mov dword ptr [ebp - 0xc], 0x1994000,lea eax, [ebp - 0xc],push eax,push dword ptr [ebp - 0x10],push dword ptr [ebp - 0x1c],push dword ptr [ebp - 0x20],call dword ptr [0x41b000],leave ,ret 8,ret ,mov eax, 0x413563,mov dword ptr [0x4228e4], eax," "5oY8da3.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418010,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x418014], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418010], eax,call 0x405000,mov eax, 0x417088,mov dword ptr [0x418034], eax,call 0x40de30,call 0x40dba1,call 0x40aaa0,call 0x40a329,"3f:Tf4c,Process "ZW0Mx06.exe" (UID: 00000000-00003840) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigation", PROCESSOR_ARCHITEW6432="AMD64"" Process "ZW0Mx06.exe" (UID: 00000000-00003840) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "su7Pd51.exe" (UID: 00000000-00003108) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="21", b2eincfilepath="%TEMP%\IXP000.TMP", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_6824_JEUVWWVHXAGQDGTD", FPS_BROWSER_USER_PROFILE_STRING="Default", EDGE_BROWSER_PID="6824", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", PROMPT="$P$G", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "su7Pd51.exe" (UID: 00000000-00003108) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, Path" Process "wT5lx74.exe" (UID: 00000000-00007084) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, Path" Process "wT5lx74.exe" (UID: 00000000-00007084) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, b2eincfilepath, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, FPS_BROWSER_USER_PROFILE_STRING, EDGE_BROWSER_PID, FPS_BROWSER_APP_PROFILE_STRING, PROMPT, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "cmd.exe" (UID: 00000000-00004712) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "msedge.exe" (UID: 00000000-00006824) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", PROMPT="$P$G", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "msedge.exe" (UID: 00000000-00006824) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00006824) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00008084) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_6824_JEUVWWVHXAGQDGTD", EDGE_BROWSER_PID="6824"" Process "msedge.exe" (UID: 00000000-00002044) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007068) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="20", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_6824_JEUVWWVHXAGQDGTD", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="6824"" Process "msedge.exe" (UID: 00000000-00003904) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00003904) was launched with missing environment variables: "EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00007948) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00007948) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID"40:T6a1,"001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "ZW0Mx06.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "ZW0Mx06.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ZW0Mx06.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "su7Pd51.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "su7Pd51.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "su7Pd51.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "su7Pd51.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "wT5lx74.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "wT5lx74.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "wT5lx74.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1Ze70jy1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "1Ze70jy1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1Ze70jy1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1Ze70jy1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")41:T589,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",12,"System.Windows.Forms Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089",03,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: 1Ze70jy1.exe.log] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: 1Ze70jy1.exe.log] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00003820-00000BC1-55564882] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00003840-00000BC1-56185620] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00003108-00000BC1-56800713] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00007084-00000BC1-57487416] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007780-00000C28-1228493768]42:T90e,Spawned process "ZW0Mx06.exe" (UID: 00000000-00003840) Spawned process "su7Pd51.exe" (UID: 00000000-00003108) Spawned process "wT5lx74.exe" (UID: 00000000-00007084) Spawned process "1Ze70jy1.exe" (UID: 00000000-00007780) Spawned process "2Sw9872.exe" (UID: 00000000-00005500) Spawned process "AppLaunch.exe" (UID: 00000000-00003948) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 5500 -ip 5500" (UID: 00000000-00005448) Spawned process "WerFault.exe" with commandline "-u -p 5500 -s 632" (UID: 00000000-00003848) Spawned process "3Gz76Be.exe" (UID: 00000000-00003792) Spawned process "AppLaunch.exe" (UID: 00000000-00007368) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 3792 -ip 3792" (UID: 00000000-00003208) Spawned process "WerFault.exe" with commandline "-u -p 3792 -s 644" (UID: 00000000-00006744) Spawned process "4tw168rt.exe" (UID: 00000000-00004040) Spawned process "AppLaunch.exe" (UID: 00000000-00002520) Spawned process "WerFault.exe" with commandline "-pss -s 540 -p 4040 -ip 4040" (UID: 00000000-00003944) Spawned process "WerFault.exe" with commandline "-u -p 4040 -s 640" (UID: 00000000-00007104) Spawned process "5oY8da3.exe" (UID: 00000000-00008048) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\8F6.tmp\\8F7.tmp\\8F8.bat %TEMP%\\IXP000.TMP\\5oY8da ..." (UID: 00000000-00004712), Spawned process "msedge.exe" with commandline "--single-argument https://www.facebook.com/login" (UID: 00000000-00006824), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00008084) Spawned process "msedge.exe" with commandline "--single-argument https://accounts.google.com/" (UID: 00000000-00002044) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00007068) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00003904), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007948), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003696)43:T90e,Spawned process "ZW0Mx06.exe" (UID: 00000000-00003840) Spawned process "su7Pd51.exe" (UID: 00000000-00003108) Spawned process "wT5lx74.exe" (UID: 00000000-00007084) Spawned process "1Ze70jy1.exe" (UID: 00000000-00007780) Spawned process "2Sw9872.exe" (UID: 00000000-00005500) Spawned process "AppLaunch.exe" (UID: 00000000-00003948) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 5500 -ip 5500" (UID: 00000000-00005448) Spawned process "WerFault.exe" with commandline "-u -p 5500 -s 632" (UID: 00000000-00003848) Spawned process "3Gz76Be.exe" (UID: 00000000-00003792) Spawned process "AppLaunch.exe" (UID: 00000000-00007368) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 3792 -ip 3792" (UID: 00000000-00003208) Spawned process "WerFault.exe" with commandline "-u -p 3792 -s 644" (UID: 00000000-00006744) Spawned process "4tw168rt.exe" (UID: 00000000-00004040) Spawned process "AppLaunch.exe" (UID: 00000000-00002520) Spawned process "WerFault.exe" with commandline "-pss -s 540 -p 4040 -ip 4040" (UID: 00000000-00003944) Spawned process "WerFault.exe" with commandline "-u -p 4040 -s 640" (UID: 00000000-00007104) Spawned process "5oY8da3.exe" (UID: 00000000-00008048) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\8F6.tmp\\8F7.tmp\\8F8.bat %TEMP%\\IXP000.TMP\\5oY8da ..." (UID: 00000000-00004712), Spawned process "msedge.exe" with commandline "--single-argument https://www.facebook.com/login" (UID: 00000000-00006824), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00008084) Spawned process "msedge.exe" with commandline "--single-argument https://accounts.google.com/" (UID: 00000000-00002044) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00007068) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00003904), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007948), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003696)44:T4e1f,"ZW0Mx06.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\ZW0Mx06.exe]- [targetUID: 00000000-00003820] "su7Pd51.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\su7Pd51.exe]- [targetUID: 00000000-00003108] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "wT5lx74.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\wT5lx74.exe]- [targetUID: 00000000-00003108] "4tw168rt.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\4tw168rt.exe]- [targetUID: 00000000-00004040] "2Sw9872.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\2Sw9872.exe]- [targetUID: 00000000-00007084] "3Gz76Be.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\3Gz76Be.exe]- [targetUID: 00000000-00003108] "1Ze70jy1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1Ze70jy1.exe]- [targetUID: 00000000-00007780] "5oY8da3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\5oY8da3.exe]- [targetUID: 00000000-00003820] "1Ze70jy1.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\1Ze70jy1.exe.log]- [targetUID: 00000000-00007780] "8F8.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\8F6.tmp\8F7.tmp\8F8.bat]- [targetUID: 00000000-00004712] "shopping.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\6824_1899073388\shopping.js]- [targetUID: 00000000-00006824] "Ruleset Data" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\35\scoped_dir6824_4117675\Ruleset Data]- [targetUID: 00000000-00006824] "recovery-component-inner.crx" has type "Google Chrome extension version 3"- Location: [%TEMP%\6824_723427234\recovery-component-inner.crx]- [targetUID: 00000000-00006824] "Filtering Rules" has type "data"- Location: [%TEMP%\6824_407189229\Filtering Rules]- [targetUID: 00000000-00003108] "edge_driver.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\6824_1899073388\edge_driver.js]- [targetUID: 00000000-00006824] "auto_open_controller.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\6824_1899073388\auto_open_controller.js]- [targetUID: 00000000-00006824] "edge_confirmation_page_validator.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\6824_1899073388\edge_confirmation_page_validator.js]- [targetUID: 00000000-00006824] "edge_checkout_page_validator.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\6824_1899073388\edge_checkout_page_validator.js]- [targetUID: 00000000-00006824] "product_page.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\6824_1899073388\product_page.js]- [targetUID: 00000000-00006824] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00006088] "Filtering Rules-AA" has type "data"- Location: [%TEMP%\6824_407189229\Filtering Rules-AA]- [targetUID: 00000000-00003108] "shoppingfre.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\6824_1899073388\shoppingfre.js]- [targetUID: 00000000-00006824] "f_0004c7" has type "gzip compressed data original size modulo 2^32 774067"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c7]- [targetUID: 00000000-00007948] "safety_tips.pb" has type "data"- Location: [%TEMP%\6824_429814075\safety_tips.pb]- [targetUID: 00000000-00006824] "780523d8-1753-4a55-bf4d-43be07c8cce5.tmp" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\780523d8-1753-4a55-bf4d-43be07c8cce5.tmp]- [targetUID: 00000000-00006824] "f_0004c8" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c8]- [targetUID: 00000000-00007948] "d5f1a291-c101-4a3b-bf4b-7cac22d02d7a.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\d5f1a291-c101-4a3b-bf4b-7cac22d02d7a.tmp]- [targetUID: 00000000-00006824] "91939b05-0cad-40cb-8d24-77520bd014f9.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\91939b05-0cad-40cb-8d24-77520bd014f9.tmp]- [targetUID: 00000000-00006824] "af24545a-ce28-4f22-b57f-9310a966aed8.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\af24545a-ce28-4f22-b57f-9310a966aed8.tmp]- [targetUID: 00000000-00006824] "dbd9d279-c7e6-4fca-aa7f-c819cb2a5834.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\dbd9d279-c7e6-4fca-aa7f-c819cb2a5834.tmp]- [targetUID: 00000000-00006824] "de22cc9c-c8c6-4b19-822e-b26eacc3c08f.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\de22cc9c-c8c6-4b19-822e-b26eacc3c08f.tmp]- [targetUID: 00000000-00006824] "9e031956-46fa-4c99-b6f1-588a689cbd0e.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\9e031956-46fa-4c99-b6f1-588a689cbd0e.tmp]- [targetUID: 00000000-00006824] "9c958dda-28f6-4ebe-b0b0-1b8af3587cf9.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\9c958dda-28f6-4ebe-b0b0-1b8af3587cf9.tmp]- [targetUID: 00000000-00006824] "0c52859f-f801-4315-8cc8-d7a6363ddee9.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\0c52859f-f801-4315-8cc8-d7a6363ddee9.tmp]- [targetUID: 00000000-00006824] "3d9900fd-02ed-4144-b598-3ef06fee6ba1.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "f_0004c5" has type "gzip compressed data original size modulo 2^32 211431"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c5]- [targetUID: 00000000-00007948] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "edge_tracking_page_validator.js" has type "UTF-8 Unicode text with very long lines with no line terminators"- Location: [%TEMP%\6824_1899073388\edge_tracking_page_validator.js]- [targetUID: 00000000-00006824] "f_0004c6" has type "gzip compressed data original size modulo 2^32 112642"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c6]- [targetUID: 00000000-00007948] "LICENSE" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\6824_407189229\LICENSE]- [targetUID: 00000000-00003108] "e98ff759-8075-42e4-b69e-9175c98f83c2.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\e98ff759-8075-42e4-b69e-9175c98f83c2.tmp]- [targetUID: 00000000-00006824] "5005e9c2-1d70-4f82-937b-9afe4b9c8020.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\5005e9c2-1d70-4f82-937b-9afe4b9c8020.tmp]- [targetUID: 00000000-00006824] "5730c740-f61c-4ef3-bc09-20d349d7edca.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\5730c740-f61c-4ef3-bc09-20d349d7edca.tmp]- [targetUID: 00000000-00006824] "b9a89daa-2e61-4db7-b2f5-8fc2f5d4592e.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\b9a89daa-2e61-4db7-b2f5-8fc2f5d4592e.tmp]- [targetUID: 00000000-00006824] "f3293ee8-4fba-40c7-ab98-e9640506e97a.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\f3293ee8-4fba-40c7-ab98-e9640506e97a.tmp]- [targetUID: 00000000-00006824] "4186329d-0136-46af-8503-9e711c9818f6.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\4186329d-0136-46af-8503-9e711c9818f6.tmp]- [targetUID: 00000000-00006824] "crl-set" has type "data"- Location: [%TEMP%\6824_852937323\crl-set]- [targetUID: 00000000-00006824] "f_0004c4" has type "Web Open Font Format (Version 2) TrueType length 21700 version 1.0"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c4]- [targetUID: 00000000-00007948] "f_0004c3" has type "Web Open Font Format (Version 2) TrueType length 21464 version 1.0"- [targetUID: N/A] "arbitration_service_config.json" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "temp-index" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index]- [targetUID: 00000000-00006824] "shopping_iframe_driver.js" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\6824_1899073388\shopping_iframe_driver.js]- [targetUID: 00000000-00006824] "df92d327-9d7f-4fe8-93b6-3c6244754ba2.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\df92d327-9d7f-4fe8-93b6-3c6244754ba2.tmp]- [targetUID: 00000000-00007948] "8f1f67d7-a47c-40bd-acc1-f1f0f62e3501.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\8f1f67d7-a47c-40bd-acc1-f1f0f62e3501.tmp]- [targetUID: 00000000-00007948] "984816f9-f2fa-4586-be94-da87b58dc0ab.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\984816f9-f2fa-4586-be94-da87b58dc0ab.tmp]- [targetUID: 00000000-00007948] "047674ab-a381-4e1d-bc40-c067061dd829.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\047674ab-a381-4e1d-bc40-c067061dd829.tmp]- [targetUID: 00000000-00007948] "a0f7fded-0858-4fe2-8b21-c913b9dd2bd7.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\a0f7fded-0858-4fe2-8b21-c913b9dd2bd7.tmp]- [targetUID: 00000000-00007948] "08c39235-851a-453b-a2d8-2f33955a9859.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\08c39235-851a-453b-a2d8-2f33955a9859.tmp]- [targetUID: 00000000-00007948] "typosquatting_list.pb" has type "data"- Location: [%TEMP%\6824_429814075\typosquatting_list.pb]- [targetUID: 00000000-00006824] "e424a4e9-8439-43e1-9443-da544fb3a5d3.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres" has type "data"- [targetUID: N/A] "adblock_snippet.js" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\6824_407189229\adblock_snippet.js]- [targetUID: 00000000-00003108] "verified_contents.json" has type "JSON data"- Location: [%TEMP%\6824_429814075\_metadata\verified_contents.json]- [targetUID: 00000000-00006824] "09848eadaf5fc42c_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\09848eadaf5fc42c_0]- [targetUID: 00000000-00006824] "d3a28419f48b088e_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\d3a28419f48b088e_0]- [targetUID: 00000000-00006824] "5522250218c31b73_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\5522250218c31b73_0]- [targetUID: 00000000-00006824] "e06b7b59b91fb666_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\e06b7b59b91fb666_0]- [targetUID: 00000000-00006824] "77e0e4c85008a81c_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\77e0e4c85008a81c_0]- [targetUID: 00000000-00006824] "8f2f7c252af3edef_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\8f2f7c252af3edef_0]- [targetUID: 00000000-00006824] "4822b851c007f150_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\4822b851c007f150_0]- [targetUID: 00000000-00006824] "e78f48f2da0e177c_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\e78f48f2da0e177c_0]- [targetUID: 00000000-00006824] "shopping.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\6824_1899073388\shopping.html]- [targetUID: 00000000-00006824] "24a92b983040f201_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\24a92b983040f201_0]- [targetUID: 00000000-00006824] "shopping_fre.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\6824_1899073388\shopping_fre.html]- [targetUID: 00000000-00006824] "4b4248b410f3ad35_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\4b4248b410f3ad35_0]- [targetUID: 00000000-00006824] "28b02a37f3225d39_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\28b02a37f3225d39_0]- [targetUID: 00000000-00006824] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG]- [targetUID: 00000000-00006088] "settings.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\settings.dat]- [targetUID: 00000000-00006824] "33bd99500895911e_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\33bd99500895911e_0]- [targetUID: 00000000-00006824] "f658fdd182550cbb_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\f658fdd182550cbb_0]- [targetUID: 00000000-00006824] "3b9b063938b2e939_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\3b9b063938b2e939_0]- [targetUID: 00000000-00006824] "7faaeb6d807041bb_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\7faaeb6d807041bb_0]- [targetUID: 00000000-00006824] "42ce332cdbe9fa73_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\42ce332cdbe9fa73_0]- [targetUID: 00000000-00006824] "40701b42ebc1cb18_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\40701b42ebc1cb18_0]- [targetUID: 00000000-00006824] "49d0896e54e4faca_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\49d0896e54e4faca_0]- [targetUID: 00000000-00006824] "4b1691c2d8c552f5_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\4b1691c2d8c552f5_0]- [targetUID: 00000000-00006824] "2556f6e9598d5fb0_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\2556f6e9598d5fb0_0]- [targetUID: 00000000-00006824] "4945a7b4b1e84510_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\4945a7b4b1e84510_0]- [targetUID: 00000000-00006824] "42f4c516cc7fb026_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\42f4c516cc7fb026_0]- [targetUID: 00000000-00006824] "ee9a8283c80e3e52_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\ee9a8283c80e3e52_0]- [targetUID: 00000000-00006824] "9e35b0c2ae3dcde4_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\9e35b0c2ae3dcde4_0]- [targetUID: 00000000-00006824] "7a9bea57b8cf5f41_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\7a9bea57b8cf5f41_0]- [targetUID: 00000000-00006824] "7b95d65eb18c490e_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\7b95d65eb18c490e_0]- [targetUID: 00000000-00006824] "ebcedc747b584a9b_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\ebcedc747b584a9b_0]- [targetUID: 00000000-00006824] "ac9537cd8ef7244a_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\ac9537cd8ef7244a_0]- [targetUID: 00000000-00006824] "22a1dfae96f6cc61_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\22a1dfae96f6cc61_0]- [targetUID: 00000000-00006824] "8d5e1c410a09c25f_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\8d5e1c410a09c25f_0]- [targetUID: 00000000-00006824] "d4e5d662b01c72f2_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\d4e5d662b01c72f2_0]- [targetUID: 00000000-00006824] "d3776b2d341e7614_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\d3776b2d341e7614_0]- [targetUID: 00000000-00006824] "0fe2e0c1a33ed442_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\0fe2e0c1a33ed442_0]- [targetUID: 00000000-00006824] "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%TEMP%\6824_723427234\manifest.json]- [targetUID: 00000000-00003108] "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%TEMP%\6824_1899073388\manifest.json]- [targetUID: 00000000-00003108] "Last Browser" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Last Browser]- [targetUID: 00000000-00006824] "manifest.json" has type "JSON data"- Location: [%TEMP%\6824_407189229\manifest.json]- [targetUID: 00000000-00003108] "manifest.json" has type "JSON data"- Location: [%TEMP%\6824_852937323\manifest.json]- [targetUID: 00000000-00003108] "Variations" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Variations]- [targetUID: 00000000-00006824] "manifest.json" has type "JSON data"- Location: [%TEMP%\6824_429814075\manifest.json]- [targetUID: 00000000-00003108] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\6824_407189229\manifest.fingerprint]- [targetUID: 00000000-00006824] "manifest.fingerprint" has type "ASCII text with no line terminators"- [targetUID: 00000000-00006824] ".ses" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "MANIFEST-000001" has type "PGP Secret Key -"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001]- [targetUID: 00000000-00006824] "000001.dbtmp" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp]- [targetUID: 00000000-00006824] "Last Version" has type "ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Last Version]- [targetUID: 00000000-00006824] "0a3342e3-e38b-4dc5-a996-dc8dc3541cd1.tmp" has type "very short file (no magic)"- [targetUID: N/A] "LICENSE" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\35\scoped_dir6824_4117675\LICENSE]- [targetUID: 00000000-00003108]45:T1298,"780523d8-1753-4a55-bf4d-43be07c8cce5.tmp" has type "JSON data" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\780523d8-1753-4a55-bf4d-43be07c8cce5.tmp] "d5f1a291-c101-4a3b-bf4b-7cac22d02d7a.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\d5f1a291-c101-4a3b-bf4b-7cac22d02d7a.tmp] "91939b05-0cad-40cb-8d24-77520bd014f9.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\91939b05-0cad-40cb-8d24-77520bd014f9.tmp] "af24545a-ce28-4f22-b57f-9310a966aed8.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\af24545a-ce28-4f22-b57f-9310a966aed8.tmp] "dbd9d279-c7e6-4fca-aa7f-c819cb2a5834.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\dbd9d279-c7e6-4fca-aa7f-c819cb2a5834.tmp] "de22cc9c-c8c6-4b19-822e-b26eacc3c08f.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\de22cc9c-c8c6-4b19-822e-b26eacc3c08f.tmp] "9e031956-46fa-4c99-b6f1-588a689cbd0e.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\9e031956-46fa-4c99-b6f1-588a689cbd0e.tmp] "9c958dda-28f6-4ebe-b0b0-1b8af3587cf9.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\9c958dda-28f6-4ebe-b0b0-1b8af3587cf9.tmp] "0c52859f-f801-4315-8cc8-d7a6363ddee9.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\0c52859f-f801-4315-8cc8-d7a6363ddee9.tmp] "3d9900fd-02ed-4144-b598-3ef06fee6ba1.tmp" has type "ASCII text with very long lines with no line terminators" "e98ff759-8075-42e4-b69e-9175c98f83c2.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\e98ff759-8075-42e4-b69e-9175c98f83c2.tmp] "5005e9c2-1d70-4f82-937b-9afe4b9c8020.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\5005e9c2-1d70-4f82-937b-9afe4b9c8020.tmp] "5730c740-f61c-4ef3-bc09-20d349d7edca.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\5730c740-f61c-4ef3-bc09-20d349d7edca.tmp] "b9a89daa-2e61-4db7-b2f5-8fc2f5d4592e.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\b9a89daa-2e61-4db7-b2f5-8fc2f5d4592e.tmp] "f3293ee8-4fba-40c7-ab98-e9640506e97a.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\f3293ee8-4fba-40c7-ab98-e9640506e97a.tmp] "4186329d-0136-46af-8503-9e711c9818f6.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\4186329d-0136-46af-8503-9e711c9818f6.tmp] "df92d327-9d7f-4fe8-93b6-3c6244754ba2.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\df92d327-9d7f-4fe8-93b6-3c6244754ba2.tmp] "8f1f67d7-a47c-40bd-acc1-f1f0f62e3501.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\8f1f67d7-a47c-40bd-acc1-f1f0f62e3501.tmp] "984816f9-f2fa-4586-be94-da87b58dc0ab.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\984816f9-f2fa-4586-be94-da87b58dc0ab.tmp] "047674ab-a381-4e1d-bc40-c067061dd829.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\047674ab-a381-4e1d-bc40-c067061dd829.tmp] "a0f7fded-0858-4fe2-8b21-c913b9dd2bd7.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\a0f7fded-0858-4fe2-8b21-c913b9dd2bd7.tmp] "08c39235-851a-453b-a2d8-2f33955a9859.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\08c39235-851a-453b-a2d8-2f33955a9859.tmp] "e424a4e9-8439-43e1-9443-da544fb3a5d3.tmp" has type "ASCII text with very long lines with no line terminators" "0a3342e3-e38b-4dc5-a996-dc8dc3541cd1.tmp" has type "very short file (no magic)"46:T7aa,"001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")47:Tf15,"001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "001398CBDD296809A52BE3CBD8E7BBD306ADDB30F70EC9811D47DDFBDA81D9AD.EXE"; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")48:T52d,"001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" trying to touch file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" trying to touch file "C:\001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" trying to touch file "C:\Windows\SysWOW64\AcLayers.dll" "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" trying to touch file "C:\Windows\SysWOW64\mpr.dll" "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" trying to touch file "C:\Windows\SysWOW64\sfc.dll"49:T4f4,"AppLaunch.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "AppLaunch.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "AppLaunch.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "AppLaunch.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "AppLaunch.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "AppLaunch.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "5oY8da3.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "5oY8da3.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History"4a:Tda2,"001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ZW0MX06.EXE" "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5OY8DA3.EXE" "ZW0Mx06.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "ZW0Mx06.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "ZW0Mx06.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "ZW0Mx06.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "ZW0Mx06.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\SU7PD51.EXE" "ZW0Mx06.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4TW168RT.EXE" "su7Pd51.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "su7Pd51.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "su7Pd51.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "su7Pd51.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "su7Pd51.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\WT5LX74.EXE" "su7Pd51.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3GZ76BE.EXE" "su7Pd51.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\CRYPTBASE.DLL" "su7Pd51.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\WINMM.DLL" "su7Pd51.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\WINMMBASE.DLL" "su7Pd51.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\DBGHELP.DLL" "su7Pd51.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\DHCPCSVC.DLL" "su7Pd51.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\NCRYPT.DLL" "su7Pd51.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\NTASN1.DLL"4b:T8e4,"001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" trying to access non-existent file "\Device\HarddiskVolume2\001398CBDD296809A52BE3CBD8E7BBD306ADDB30F70EC9811D47DDFBDA81D9AD.EXE.LOCAL" "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "ZW0Mx06.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ZW0MX06.EXE.LOCAL" "ZW0Mx06.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "su7Pd51.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\SU7PD51.EXE.LOCAL" "su7Pd51.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "wT5lx74.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\WT5LX74.EXE.LOCAL" "wT5lx74.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "1Ze70jy1.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "1Ze70jy1.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1ZE70JY1.EXE.CONFIG" "1Ze70jy1.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "1Ze70jy1.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1ZE70JY1.EXE.LOG" "1Ze70jy1.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "1Ze70jy1.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "1Ze70jy1.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL"4c:T26e5,Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com/" Heuristic match: "LG.BA" Heuristic match: "x^.Bm" Heuristic match: "K[.Kp" Heuristic match: "%/.Mq" Heuristic match: "yTdz.mL" Pattern match: "PjVW-PjWW.PjRW/PjSWHPjPWLPjQW" Pattern match: "xc.p3s.xj/k#8b[-YB![P;l" Pattern match: "https://www.facebook.com/loginstart" Pattern match: "Emed.HYm/zcIE$2{`2All;ji[n~;_ID?S!x!PM283S4w5XDX0\Scs%Ut[g?~QCM" Pattern match: "https://github.com/easylist" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53r3l?ver=5412,PORTRAIT:https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53bta?ver=2bf3,update_period:86400},creativeId:128000000003595" Pattern match: "https://www.bestbuy.com/site/help-topics/price-match-guarantee/pcmcat290300050002.c?id=pcmcat290300050002},costco.com:{policyDays:30,supportPageUrl:https://customerservice.costco.com/app/answers/detail/a_id/628/~/price-adjustment---costco.com-orders,u" Pattern match: "https://www.clarity.ms,supports_spdy:true},{anonymization:[],server:https://microsoftedgewelcome.microsoft.com,supports_spdy:true},{anonymization:[],server:https://edgefrecdn.azureedge.net,supports_spdy:true},{anonymization:[],server" Pattern match: "1123movies.la/123moviess.la/3dmmgame.com/4playstation.com/aashingtonpost.com/adultdfriendfinder.com/aircananda.com/aks.ms/alaskaaair.com/alibabaa.com/alibbaba.com/alrecipes.com/ameritraade.com/answwers.com/arketwatch.com/ashshleyfurniture.com/ationalgeogra" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.W2TcMaC5utg.es5.O/ck=boq-identity.AccountsSignInUi.OHZxafzVA3M.L.W.O/am=jmBFTDw2AIL_RxPn7xknhwEAAAAAAAAAANZAdg/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63," Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.W2TcMaC5utg.es5.O/ck=boq-identity.AccountsSignInUi.OHZxafzVA3M.L.W.O/am=jmBFTDw2AIL_RxPn7xknhwEAAAAAAAAAANZAdg/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.W2TcMaC5utg.es5.O/ck=boq-identity.AccountsSignInUi.OHZxafzVA3M.L.W.O/am=jmBFTDw2AIL_RxPn7xknhwEAAAAAAAAAANZAdg/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAk" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.W2TcMaC5utg.es5.O/ck=boq-identity.AccountsSignInUi.OHZxafzVA3M.L.W.O/am=jmBFTDw2AIL_RxPn7xknhwEAAAAAAAAAANZAdg/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.W2TcMaC5utg.es5.O/ck=boq-identity.AccountsSignInUi.OHZxafzVA3M.L.W.O/am=jmBFTDw2AIL_RxPn7xknhwEAAAAAAAAAANZAdg/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEml" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.W2TcMaC5utg.es5.O/am=jmBFTDw2AIL_RxPn7xknhwEAAAAAAAAAANZAdg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEAO-ISt0gox4x8lM0B2HUhGjxGBA/m=_b,_tp" Pattern match: "assets.db/MANIFEST-0000012023/10/10-10:22:32.064" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3i7M54/yn/l/en_US/WW_dM8tCcty.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3iqES4/yQ/l/en_US/riV0sq4fGtL.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yi/r/K1u8FojW_L0.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yO/r/_tJ17sGyxOX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yd/r/D8yA-TXiNuk.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yh/r/bpW4eEg-2_W.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yt/r/d4QqVJOdC1V.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yt/r/jIUN0Hn2kpD.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yo/r/j5B70NmINXl.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/ye/r/yUtEQ4ajXZI.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yf/r/LgvwffuKmeX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yF/r/FLJXkx8ys-6.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yI/r/8iBPf52GdU5.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yn/r/FQIPxzEyFvX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yk/r/kg_LcWkMBGy.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/ym/r/R_qswDMOLWA.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/ys/r/_f5wO_K1viW.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yF/r/gb_2sOlx922.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yr/r/6XlDJXhMTmo.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yi/r/VaHNVNii56Z.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yb/r/X98p6omdveu.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yA/r/gYsh5OsZKde.js?_nc_x=Ij3Wp8lg5Kz" Heuristic match: "accounts.google.com" Heuristic match: "arc.msn.com" Heuristic match: "connect.facebook.net" Heuristic match: "facebook.com" Heuristic match: "fbcdn.net" Heuristic match: "fbsbx.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "play.google.com" Heuristic match: "static.xx.fbcdn.net" Pattern match: "www.bing.com" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi._5ZOqXBkwmw.L.B1.O/am=jmBFTDw2AIL_RxPn7xknhwEAAAAAAAAAANZAdg/d=1/ed=1/rs=AOaEmlHEJqYnT5Y11IMXRRIlC6oZJkqWMw/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.W2TcMaC5utg.es5.O/am=jmBFTDw2AIL_RxPn7xknhwEAAAAAAAAAANZAdg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEAO-ISt0gox4x8lM0B2HUhGjxGBA/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Pattern match: "https://accounts.google.com" Pattern match: "https://easylist.to/" Pattern match: "https://creativecommons.org/compatiblelicenses" Pattern match: "https://creativecommons.org/" Pattern match: "assets.db/MANIFEST-000001" Pattern match: "assets.db/000003.log" Pattern match: "https://www.bing.com/api/shopping/v1/ux/images/autoApply/Shopping_Finished_Dark_01.mp4:https://www.bing.com/api/shopping/v1/ux/images/autoApply/Shopping_Finished_01.mp4}function" Pattern match: "https://support.goodrx.com/hc/en-us/articles/115005225563-Terms-of-Use" Pattern match: "https://www.bing.com/api/shopping/v1/savings/goodrx/getCouponFromKey,s" Pattern match: "https://www.bing.com/api/shopping/v1/ux/images/instantATC/inprogress_Cart.svg,C.style.marginLeft=auto,C.style.marginRight=auto,C.style.marginTop=20px;const" Pattern match: "https://www.coupons.com===e.origin" Pattern match: "https://privacy.microsoft.com/en-us/privacystatement,l.textContent=s,r.textContent=o,r.appendChild(l),r.className=txtMedium,r.style.textAlign=start;const" Pattern match: "https://account.microsoft.com/rewards/rebates/details/+o.merchantName,n.target=_blank,n.textContent=this.platformInstance.GetResourceString(EC.noCouponsCashbackActivatedOfferDetails),n.style.color=this.utilities.IsDarkTheme()?#63ADE5:#036AC4,n.style" Pattern match: "https://account.microsoft.com/rewards/rebates/details/+t" Pattern match: "https://account.microsoft.com/rewards/rebates/details/+r.merchantName" Pattern match: "https://www.${A}`;window.open(e)" Pattern match: "Math.PI/180,grad:Math.PI/200,rad:1,turn:2*Math.PI},turn:{deg:1/360,grad:1/400,rad:.5/Math.PI,turn:1},s:{s:1,ms:.001},ms:{s:1e3,ms:1},Hz:{Hz:1,kHz:1e3},kHz:{Hz:.001,kHz:1},dpi:{dpi:1,dpcm:1/2.54,dppx:1/96},dpcm:{dpi:2.54,dpcm:1,dppx:2.54/96},dppx:{dpi:96,dp" Pattern match: "https://github.com/microsoft/fast/issues/5848" Pattern match: "https://choice.microsoft.com" Pattern match: "https://www.bing.com/api/shopping/v1/ux/images/priceComparison/adSlug.png/" Pattern match: "https://bing.com/th?id=${this.cheapestFlight.Logo.ThumbnailId}&w=60&h=60`||}getDataString(t){var" Pattern match: "https://www.${e}${i.RetailerCartPage}`:`https://www.${e}`,a=new" Pattern match: "https://microsoft.com/en-us/edge/launch/59?form=ML2F1I" Pattern match: "https://startapp.microsoft.com/start?adjust=10bdvh2b_102v7fda" Pattern match: "http://www.w3.org/2000/svg},t" Pattern match: "https://privacy.microsoft.com/privacystatement,target:_blank,onClick:s},n.strings.commonMicrosoftPolicy" Pattern match: "https://aka.ms/inbox-coupons-feedback,target:_blank},t.strings.feedbackForm" Pattern match: "https://aka.ms/inboxcoupons,metadata:{isExpanded:p}};return" Pattern match: "https://www.bing.com/api/shopping/v1/savings/goodrx/getCouponFromKey,r=await" Pattern match: "https://{hostName}/{localeCode}/shopping/deals,backgroundStyles:--shopping-stripe-heading-color" Pattern match: "http://www.w3.org/2000/svg};return" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=518021,target:_blank,appearance:hypertext,rel:noopener" Pattern match: "https://+e" Pattern match: "https://www.microsoft.com/" Heuristic match: "% .np" Pattern match: "http://www.w3.org/2001/XMLSchema-instance"4d:Tbb5,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003820.00000000.70741.02E50000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003840.00000000.70795.03130000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007084.00000000.70874.02C60000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportwin" - Source: "00000000-00007780.00000000.70914.02B10000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007780.00000000.70914.02B20000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00007780.00000000.70914.71EF1000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00007780.00000000.70914.71EF1000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00007780.00000000.70914.71EF1000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007780.00000000.70914.71F91000.00000020.mdmp")4e:T811,"ZW0Mx06.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00003840) "ZW0Mx06.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003840) "su7Pd51.exe" called "FindFirstFileA" with parameter %TEMP%\IXP002.TMP\* (UID: 00000000-00003108) "su7Pd51.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003108) "wT5lx74.exe" called "FindFirstFileA" with parameter %TEMP%\IXP003.TMP\* (UID: 00000000-00007084) "wT5lx74.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00007084) "1Ze70jy1.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007780) "1Ze70jy1.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007780) "1Ze70jy1.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007780) "1Ze70jy1.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007780) "1Ze70jy1.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007780) "1Ze70jy1.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007780) "1Ze70jy1.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007780) "1Ze70jy1.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007780) "1Ze70jy1.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007780) "1Ze70jy1.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007780) "1Ze70jy1.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007780) "1Ze70jy1.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007780) "1Ze70jy1.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007780) "1Ze70jy1.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007780) "1Ze70jy1.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007780)4f:T5f3,file/memory contains long string with (Indicator: "aes"; File: "df92d327-9d7f-4fe8-93b6-3c6244754ba2.tmp") file/memory contains long string with (Indicator: "aes"; File: "8f1f67d7-a47c-40bd-acc1-f1f0f62e3501.tmp") file/memory contains long string with (Indicator: "aes"; File: "09848eadaf5fc42c_0") file/memory contains long string with (Indicator: "aes"; File: "d3a28419f48b088e_0") file/memory contains long string with (Indicator: "aes"; File: "5522250218c31b73_0") file/memory contains long string with (Indicator: "aes"; File: "e06b7b59b91fb666_0") file/memory contains long string with (Indicator: "aes"; File: "77e0e4c85008a81c_0") file/memory contains long string with (Indicator: "aes"; File: "8f2f7c252af3edef_0") file/memory contains long string with (Indicator: "aes"; File: "4822b851c007f150_0") file/memory contains long string with (Indicator: "aes"; File: "e78f48f2da0e177c_0") file/memory contains long string with (Indicator: "aes"; File: "24a92b983040f201_0") file/memory contains long string with (Indicator: "aes"; File: "4b4248b410f3ad35_0") file/memory contains long string with (Indicator: "base64"; File: "edge_confirmation_page_validator.js") file/memory contains long string with (Indicator: "base64"; File: "auto_open_controller.js") file/memory contains long string with (Indicator: "base64"; File: "edge_driver.js") file/memory contains long string with (Indicator: "aes"; File: "edge_driver.js") file/memory contains long string with (Indicator: "base64"; File: "shopping.js")50:T408,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "3Gz76Be.exe.1452090642") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "3Gz76Be.exe.1452090642") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp")51:T829,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "3Gz76Be.exe.1452090642") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "3Gz76Be.exe.1452090642") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "1Ze70jy1.exe.2151656144") Found reference to API "Module32Next" (Indicator: "Module32Next"; File: "1Ze70jy1.exe.2151656144") Found reference to API "Module32First" (Indicator: "Module32First"; File: "1Ze70jy1.exe.2151656144") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "1Ze70jy1.exe.2151656144") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "1Ze70jy1.exe.2151656144") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp")52:T646,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp")53:T519,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp")54:Teac,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "3Gz76Be.exe.1452090642") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "3Gz76Be.exe.1452090642") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp")55:T60e,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "1Ze70jy1.exe.2151656144") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "1Ze70jy1.exe.2151656144") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp")56:T494,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp")57:T8d9,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003108.00000000.70834.00BC1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003108.00000000.70834.00BC1000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003820.00000000.70741.002B1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003820.00000000.70741.002B1000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp")58:T9c2,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00003108.00000000.70834.00BCA000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00003108.00000000.70834.033E0000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00003820.00000000.70741.002BA000.00000002.mdmp")59:Tc1b,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: 001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: ZW0Mx06.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: ZW0Mx06.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: ZW0Mx06.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: ZW0Mx06.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: ZW0Mx06.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: su7Pd51.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: su7Pd51.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: su7Pd51.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: su7Pd51.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: su7Pd51.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: wT5lx74.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: wT5lx74.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: wT5lx74.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: wT5lx74.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: wT5lx74.exe]5a:Tf90,"001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\ZW0MX06.EXE"; Value: "") "001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\5OY8DA3.EXE"; Value: "") "ZW0Mx06.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\SU7PD51.EXE"; Value: "") "ZW0Mx06.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\4TW168RT.EXE"; Value: "") "su7Pd51.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\WT5LX74.EXE"; Value: "") "su7Pd51.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\3GZ76BE.EXE"; Value: "") "wT5lx74.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\1ZE70JY1.EXE"; Value: "") "wT5lx74.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\2SW9872.EXE"; Value: "") "2Sw9872.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINHTTPAUTOPROXYSVC\PARAMETERS"; Key: "PROXYDLLFILE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "")5b:T4b2,"ZW0Mx06.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\ZW0Mx06.exe]- [targetUID: 00000000-00003820] "su7Pd51.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\su7Pd51.exe]- [targetUID: 00000000-00003108] "wT5lx74.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\wT5lx74.exe]- [targetUID: 00000000-00003108] "4tw168rt.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\4tw168rt.exe]- [targetUID: 00000000-00004040] "2Sw9872.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\2Sw9872.exe]- [targetUID: 00000000-00007084] "3Gz76Be.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\3Gz76Be.exe]- [targetUID: 00000000-00003108] "1Ze70jy1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1Ze70jy1.exe]- [targetUID: 00000000-00007780] "5oY8da3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\5oY8da3.exe]- [targetUID: 00000000-00003820]5c:T1151,Dropped file: "1Ze70jy1.exe.log" - Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\1Ze70jy1.exe.log]- [targetUID: 00000000-00007780] Dropped file: "Ruleset Data" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\35\scoped_dir6824_4117675\Ruleset Data]- [targetUID: 00000000-00006824] Dropped file: "000003.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00006088] Dropped file: "f_0004c7" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c7]- [targetUID: 00000000-00007948] Dropped file: "780523d8-1753-4a55-bf4d-43be07c8cce5.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\780523d8-1753-4a55-bf4d-43be07c8cce5.tmp]- [targetUID: 00000000-00006824] Dropped file: "f_0004c8" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c8]- [targetUID: 00000000-00007948] Dropped file: "d5f1a291-c101-4a3b-bf4b-7cac22d02d7a.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\d5f1a291-c101-4a3b-bf4b-7cac22d02d7a.tmp]- [targetUID: 00000000-00006824] Dropped file: "91939b05-0cad-40cb-8d24-77520bd014f9.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\91939b05-0cad-40cb-8d24-77520bd014f9.tmp]- [targetUID: 00000000-00006824] Dropped file: "af24545a-ce28-4f22-b57f-9310a966aed8.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\af24545a-ce28-4f22-b57f-9310a966aed8.tmp]- [targetUID: 00000000-00006824] Dropped file: "dbd9d279-c7e6-4fca-aa7f-c819cb2a5834.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\dbd9d279-c7e6-4fca-aa7f-c819cb2a5834.tmp]- [targetUID: 00000000-00006824] Dropped file: "de22cc9c-c8c6-4b19-822e-b26eacc3c08f.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\de22cc9c-c8c6-4b19-822e-b26eacc3c08f.tmp]- [targetUID: 00000000-00006824] Dropped file: "9e031956-46fa-4c99-b6f1-588a689cbd0e.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\9e031956-46fa-4c99-b6f1-588a689cbd0e.tmp]- [targetUID: 00000000-00006824] Dropped file: "9c958dda-28f6-4ebe-b0b0-1b8af3587cf9.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\9c958dda-28f6-4ebe-b0b0-1b8af3587cf9.tmp]- [targetUID: 00000000-00006824] Dropped file: "0c52859f-f801-4315-8cc8-d7a6363ddee9.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\0c52859f-f801-4315-8cc8-d7a6363ddee9.tmp]- [targetUID: 00000000-00006824] Dropped file: "f_0004c5" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c5]- [targetUID: 00000000-00007948] Dropped file: "f_0004c6" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c6]- [targetUID: 00000000-00007948] Dropped file: "e98ff759-8075-42e4-b69e-9175c98f83c2.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\e98ff759-8075-42e4-b69e-9175c98f83c2.tmp]- [targetUID: 00000000-00006824] Dropped file: "5005e9c2-1d70-4f82-937b-9afe4b9c8020.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\5005e9c2-1d70-4f82-937b-9afe4b9c8020.tmp]- [targetUID: 00000000-00006824] Dropped file: "5730c740-f61c-4ef3-bc09-20d349d7edca.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\5730c740-f61c-4ef3-bc09-20d349d7edca.tmp]- [targetUID: 00000000-00006824] Dropped file: "b9a89daa-2e61-4db7-b2f5-8fc2f5d4592e.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\b9a89daa-2e61-4db7-b2f5-8fc2f5d4592e.tmp]- [targetUID: 00000000-00006824] Dropped file: "f3293ee8-4fba-40c7-ab98-e9640506e97a.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\f3293ee8-4fba-40c7-ab98-e9640506e97a.tmp]- [targetUID: 00000000-00006824] Dropped file: "4186329d-0136-46af-8503-9e711c9818f6.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\4186329d-0136-46af-8503-9e711c9818f6.tmp]- [targetUID: 00000000-00006824] Dropped file: "f_0004c4" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c4]- [targetUID: 00000000-00007948] Dropped file: "temp-index" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index]- [targetUID: 00000000-00006824] Dropped file: "df92d327-9d7f-4fe8-93b6-3c6244754ba2.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\df92d327-9d7f-4fe8-93b6-3c6244754ba2.tmp]- [targetUID: 00000000-00007948]5d:T555,"001398cbdd296809a52be3cbd8e7bbd306addb30f70ec9811d47ddfbda81d9ad.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "ZW0Mx06.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "su7Pd51.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "wT5lx74.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1Ze70jy1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1Ze70jy1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "2Sw9872.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "3Gz76Be.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "4tw168rt.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "5oY8da3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1")5e:T4001,"initAft()