24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 71:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 040bb4a3060c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 040bb4a3060c…. Malware family: Trojan.Generic. Threat score 100/100. 8/28 AV engines flagged this file. 15 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":8,"total":28},"behavioralIndicators":{"malicious":15,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7b4,"NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "FindResourceA" with parameter "17896056" - (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "FindResourceA" with parameter "17896064" - (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "FindResourceA" with parameter "17896092" - (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "FindResourceA" with parameter "17896304" - (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "FindResourceA" with parameter "17896120" - (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "FindResourceA" with parameter "17896276" - (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "FindResourceA" with parameter "17896288" - (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "FindResourceA" with parameter "5633716" - (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "FindResourceA" with parameter "17896172" - (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "FindResourceA" with parameter "17896268" - (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "FindResourceA" with parameter "5633712" - (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "FindResourceA" with parameter "17896136" - (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "FindResourceA" with parameter "17896144" - (UID: 00000000-00000272)26:Tcfe,"NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17942656'}" (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17942512'}" (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17942672'}" (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17942560'}" (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17942528'}" (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17942576'}" (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17942624'}" (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17942496'}" (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17942608'}" (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17942640'}" (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17942592'}" (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17942544'}" (UID: 00000000-00000272) "Nx1xl66.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18663552'}" (UID: 00000000-00001224) "Nx1xl66.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18663408'}" (UID: 00000000-00001224) "Nx1xl66.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18663568'}" (UID: 00000000-00001224) "Nx1xl66.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18663456'}" (UID: 00000000-00001224) "Nx1xl66.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18663424'}" (UID: 00000000-00001224) "Nx1xl66.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18663472'}" (UID: 00000000-00001224) "Nx1xl66.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18663520'}" (UID: 00000000-00001224) "Nx1xl66.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18663392'}" (UID: 00000000-00001224) "Nx1xl66.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18663504'}" (UID: 00000000-00001224) "Nx1xl66.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18663536'}" (UID: 00000000-00001224)27:T6b2,"NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP\ (UID: 00000000-00000272) "Nx1xl66.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00001224) "Nx1xl66.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00001224) "Nx1xl66.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP\ (UID: 00000000-00001224) "UD5yq11.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00001352) "UD5yq11.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00001352) "UD5yq11.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00001352) "UD5yq11.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP\ (UID: 00000000-00001352) "GX1TQ77.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00001520) "GX1TQ77.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00001520) "GX1TQ77.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00001520) "GX1TQ77.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00001520) "GX1TQ77.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP\ (UID: 00000000-00001520) "5Mn4LS8.exe" called "RemoveDirectoryW" with parameter %TEMP%\6E18.tmp\6E19.tmp\ (UID: 00000000-00002440) "5Mn4LS8.exe" called "RemoveDirectoryW" with parameter %TEMP%\6E18.tmp (UID: 00000000-00002440)28:T505,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "2ZU6518.exe.3341049836") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp")29:T611,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp")2a:T4a5,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "2ZU6518.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "2ZU6518.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "2ZU6518.exe.3341049836") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "2ZU6518.exe.3341049836") Found string "L`R]X QfirequestIdentifierIRRaHXR~}M]R1WR!!WQb10j"%*QcFkRpadding!LQq/@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_Q&a"a" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "6869067474079f11_1") Found string "L`R]X QfirequestIdentifierIRRaHXR~}M]R1WR!!WQb10j"%*QcFkRpadding!LQq/@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_Q&a"a" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "6869067474079f11_1")2b:T6bf,Found PE header "MZ" - Source: "00000000-00000272.00000000.69745.01110000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00000272.00000001.71665.01110000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00000272.00000002.73585.01110000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001224.00000000.69801.011C0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001224.00000001.71718.011C0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001352.00000000.69839.00990000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001352.00000001.71758.00990000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001520.00000000.69875.01140000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001520.00000001.71795.01140000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001628.00000000.69912.00400000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001628.00000000.69912.04ED0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001628.00000000.69912.04F80000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001628.00000000.69912.05130000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001628.00000000.69912.06310000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001628.00000000.69912.70D20000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001628.00000000.69912.70DC0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002440.00000000.73366.00400000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006656.00000000.70348.01300000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006656.00000001.72269.01300000.00000002.mdmp")2c:T80c,"msedge.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma" to "%LOCALAPPDATA%\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-652417F3-1E44.pma" "msedge.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000001.dbtmp" to "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT" "msedge.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp" to "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt" "msedge.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\875813a1-1f88-4e6f-bbe2-6610bed4763c\index-dir\temp-index" to "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\875813a1-1f88-4e6f-bbe2-6610bed4763c\index-dir\the-real-index" "msedge.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9d6a1e9b-11b1-425b-ab62-159627423ef7\index-dir\temp-index" to "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9d6a1e9b-11b1-425b-ab62-159627423ef7\index-dir\the-real-index" "msedge.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp" to "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT" "msedge.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp" to "%LOCALAPPDATA%\Microsoft\Edge\User Data\BrowserMetrics-spare.pma"2d:T12e9,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-34-0111202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00000272-2688-34-0111202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-34-0111202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-8-011144B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-8-011144B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-35-01111AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-35-01111AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-44-01114EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-44-01114EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-25-01112F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-25-01112F1D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-65-011117EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-65-011117EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-66-011136EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-66-011136EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-18-011124E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-18-011124E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-49-01116298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-49-01116298 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00000272-2688-23-01112390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00000272-2688-23-01112390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-69-01112773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-69-01112773 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-51-0111621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-51-0111621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-55-01115467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-55-01115467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-64-011118A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-64-011118A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-29-01113FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-29-01113FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-57-011153A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-57-011153A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-58-01112630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-58-01112630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-54-011155A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-54-011155A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-32-01112267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-32-01112267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-63-01112CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-63-01112CAA Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00000272-2688-28-01113BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00000272-2688-28-01113BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-33-01116495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-33-01116495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-14-0111681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-14-0111681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-21-011152B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-21-011152B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000272-2688-70-01115C9E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000272-2688-70-01115C9E2e:T96e,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ajZjNXut6gErycnTNQ9IContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ajZjNXut6gErycnTNQ9IContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ajZjNXut6gErycnTNQ9IContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ajZjNXut6gErycnTNQ9IContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ajZjNXut6gErycnTNQ9IContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ajZjNXut6gErycnTNQ9IContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ajZjNXut6gErycnTNQ9IContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=ajZjNXut6gErycnTNQ9IContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache"2f:T453,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: PCAP contains base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]30:T1b98,"NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000272) "Nx1xl66.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001224) "Nx1xl66.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001224) "UD5yq11.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001352) "UD5yq11.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001352) "GX1TQ77.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001520) "GX1TQ77.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001520) "1we14Nh5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000007707c8502325cb72c021ef007317eb2284efef003054cb720be8ea22feffffff94efef00002aca720000b872feffffff583500030000b87200000000000000000000000028efef00 (UID: 00000000-00001628) "1we14Nh5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001628) "1we14Nh5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001628)31:T827,"NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Nx1xl66.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Nx1xl66.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "UD5yq11.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "UD5yq11.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "GX1TQ77.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "GX1TQ77.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1we14Nh5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2ZU6518.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3TB05qc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3TB05qc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4zp552KB.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4zp552KB.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "5Mn4LS8.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "5Mn4LS8.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")32:T501,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "5Mn4LS8.exe.3875163261") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp")33:T574,"NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\Nx1xl66.exe" - (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\5Mn4LS8.exe" - (UID: 00000000-00000272) "Nx1xl66.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\UD5yq11.exe" - (UID: 00000000-00001224) "Nx1xl66.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\4zp552KB.exe" - (UID: 00000000-00001224) "UD5yq11.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\GX1TQ77.exe" - (UID: 00000000-00001352) "UD5yq11.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\3TB05qc.exe" - (UID: 00000000-00001352) "GX1TQ77.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\1we14Nh5.exe" - (UID: 00000000-00001520) "GX1TQ77.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\2ZU6518.exe" - (UID: 00000000-00001520) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/" - (UID: 00000000-00004572) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/" - (UID: 00000000-00004572)34:Te0d,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.69745.00580000.00000004.mdmp, 00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00580000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00580000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000000.69745.00AD0000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00AD0000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00AD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "MPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMit" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.69745.00AD0000.00000004.mdmp, 00000000-00000272.00000001.71665.00AD0000.00000004.mdmp, 00000000-00000272.00000002.73585.00AD0000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp")35:T61d,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp")36:T421,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "5Mn4LS8.exe.3875163261") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp")37:Td4d0,Found reference to API (Indicator: "CheckTokenMembership"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "HeapSetInformation"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "DecryptFileA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetTokenInformation"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "FreeSid"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "OpenProcessToken"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "RegSetValueExA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "EqualSid"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "RegCloseKey"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "FindFirstFileA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "FindNextFileA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "FindClose"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "LocalAlloc"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "lstrcmpA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "CompareStringA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetLastError"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "LoadLibraryA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "DeleteFileA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GlobalAlloc"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GlobalFree"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "CloseHandle"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetProcAddress"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GlobalLock"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "LocalFree"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "FreeLibrary"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GlobalUnlock"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "ReadFile"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "SizeofResource"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "WriteFile"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "SetFileTime"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "SetFilePointer"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "FindResourceA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "CreateMutexA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "FreeResource"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetVersion"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetTempPathA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "CreateFileA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "SetEvent"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "TerminateThread"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetVersionExA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "LockResource"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetSystemInfo"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "CreateThread"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "ResetEvent"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "LoadResource"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "ExitProcess"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "CreateProcessA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "FormatMessageA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "CreateEventA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "CharUpperA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "MessageBeep"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "CharPrevA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "LoadStringA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "CharNextA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "EnableWindow"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "ReleaseDC"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "PeekMessageA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "SendMessageA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "MessageBoxA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "SetWindowTextA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetWindowLongA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "CallWindowProcA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "SetWindowLongA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "ShowWindow"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "SetWindowPos"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetDC"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetWindowRect"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "DispatchMessageA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "VerQueryValueA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "Sleep"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "TerminateProcess"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetTickCount"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "MulDiv"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API (Indicator: "FlsAlloc"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "FlsGetValue"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "FlsSetValue"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "FlsFree"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetActiveWindow"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetLastActivePopup"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetProcessWindowStation"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "EncodePointer"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "DecodePointer"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "RaiseException"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "MultiByteToWideChar"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "lstrlenA"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "InterlockedDecrement"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetModuleHandleA"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "Module32Next"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "Module32First"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "OleInitialize"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "HeapFree"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetProcessHeap"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "HeapAlloc"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetCommandLineA"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "HeapCreate"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "VirtualFree"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "DeleteCriticalSection"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "LeaveCriticalSection"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "EnterCriticalSection"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "VirtualAlloc"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "HeapReAlloc"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "HeapSize"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "IsDebuggerPresent"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetStdHandle"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "WideCharToMultiByte"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetConsoleCP"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetConsoleMode"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "TlsGetValue"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "TlsAlloc"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "TlsSetValue"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "TlsFree"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "InterlockedIncrement"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "SetLastError"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "FlushFileBuffers"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "SetHandleCount"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetFileType"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetStartupInfoA"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "RtlUnwind"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetCPInfo"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetACP"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetOEMCP"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "IsValidCodePage"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "CompareStringW"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "WriteConsoleA"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "WriteConsoleW"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "SetStdHandle"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetLocaleInfoA"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "LCMapStringA"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "LCMapStringW"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetStringTypeA"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "GetStringTypeW"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "SetEndOfFile"; File: "1we14Nh5.exe.870265966") Found reference to API (Indicator: "RtlGetVersion"; File: "5Mn4LS8.exe.3875163261") Found reference to API (Indicator: "GetLongPathNameW"; File: "5Mn4LS8.exe.3875163261") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "5Mn4LS8.exe.3875163261") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "5Mn4LS8.exe.3875163261") Found reference to API (Indicator: "InitOnceExecuteOnce"; File: "5Mn4LS8.exe.3875163261") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "5Mn4LS8.exe.3875163261") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "5Mn4LS8.exe.3875163261") Found reference to API (Indicator: "CreateFileW"; File: "5Mn4LS8.exe.3875163261") Found reference to API (Indicator: "UnregisterWait"; File: "5Mn4LS8.exe.3875163261") Found reference to API (Indicator: "GetCurrentThread"; File: "5Mn4LS8.exe.3875163261") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "2ZU6518.exe.3341049836") Found reference to API (Indicator: "AreFileApisANSI"; File: "2ZU6518.exe.3341049836") Found reference to API (Indicator: "LocaleNameToLCID"; File: "2ZU6518.exe.3341049836") Found reference to API (Indicator: "LCMapStringEx"; File: "2ZU6518.exe.3341049836") Found reference to API (Indicator: "InitializeSListHead"; File: "2ZU6518.exe.3341049836") Found reference to API (Indicator: "LoadLibraryExW"; File: "2ZU6518.exe.3341049836") Found reference to API (Indicator: "GetModuleFileNameW"; File: "2ZU6518.exe.3341049836") Found reference to API (Indicator: "GetModuleHandleExW"; File: "2ZU6518.exe.3341049836") Found reference to API (Indicator: "FindFirstFileExW"; File: "2ZU6518.exe.3341049836") Found reference to API (Indicator: "FindNextFileW"; File: "2ZU6518.exe.3341049836") Found reference to API (Indicator: "GetCommandLineW"; File: "2ZU6518.exe.3341049836") Found reference to API (Indicator: "SetFilePointerEx"; File: "2ZU6518.exe.3341049836") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00000272.00000000.69745.01111000.00000020.mdmp, 00000000-00000272.00000001.71665.01111000.00000020.mdmp, 00000000-00000272.00000002.73585.01111000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00000272.00000000.69745.01111000.00000020.mdmp, 00000000-00000272.00000001.71665.01111000.00000020.mdmp, 00000000-00000272.00000002.73585.01111000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00000272.00000000.69745.01111000.00000020.mdmp, 00000000-00000272.00000001.71665.01111000.00000020.mdmp, 00000000-00000272.00000002.73585.01111000.00000020.mdmp") Found reference to API (Indicator: "SHBrowseForFolder"; Source: "00000000-00000272.00000000.69745.01118000.00000004.mdmp, 00000000-00000272.00000001.71665.01118000.00000004.mdmp, 00000000-00000272.00000002.73585.01118000.00000004.mdmp") Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "00000000-00000272.00000000.69745.01118000.00000004.mdmp, 00000000-00000272.00000001.71665.01118000.00000004.mdmp, 00000000-00000272.00000002.73585.01118000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp")38:T7c9,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp")39:T46a,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp")3a:T81f,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe "DSystem\CurrentControlSet\Control\Session Manager" in Source: NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe "System\CurrentControlSet\Control\Session Manager" in Source: 64853-17-0040256D "8355-1207367261-1001\Software\Mi" in Source: 00000000-00000272.00000000.69745.00518000.00000004.mdmp 00000000-00000272.00000001.71665.00518000.00000004.mdmp 00000000-00000272.00000002.73585.00518000.00000004.mdmp "\Registry\MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide" in Source: 00000000-00000272.00000000.69745.005B0000.00000004.mdmp 00000000-00000272.00000001.71665.005B0000.00000004.mdmp 00000000-00000272.00000002.73585.005B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00000272.00000000.69745.01111000.00000020.mdmp 00000000-00000272.00000001.71665.01111000.00000020.mdmp 00000000-00000272.00000002.73585.01111000.00000020.mdmp "3System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00000272.00000000.69745.01118000.00000004.mdmp 00000000-00000272.00000001.71665.01118000.00000004.mdmp 00000000-00000272.00000002.73585.01118000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00000272.00000000.69745.01118000.00000004.mdmp 00000000-00000272.00000001.71665.01118000.00000004.mdmp 00000000-00000272.00000002.73585.01118000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 00000000-00000272.00000000.69745.01118000.00000004.mdmp 00000000-00000272.00000001.71665.01118000.00000004.mdmp 00000000-00000272.00000002.73585.01118000.00000004.mdmp3b:T4f7,"NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Nx1xl66.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "UD5yq11.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "4zp552KB.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "GX1TQ77.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "3TB05qc.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2ZU6518.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT3c:T1024,Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found string "@shift /0start "" https://accounts.google.comstart "" https://www.facebook.com/loginstart "" https://www.youtube.com" (Indicator: "facebook.com"; File: "6E1A.bat") file/memory contains long string with (Indicator: "youtube"; File: "4ec5902ccf5150b7_1") file/memory contains long string with (Indicator: "youtube"; File: "a58c642abc22f9bf_0") file/memory contains long string with (Indicator: "youtube"; File: "c08d6b2d5449a572_0") file/memory contains long string with (Indicator: "youtube"; File: "766415f99b4c6b7d_0") file/memory contains long string with (Indicator: "youtube"; File: "be57e96208f23f53_0") Found string "_keyhttps://www.youtube.com/s/desktop/7c155e84/jsbin/desktop_polymer_enable_wil_icons.vflset/desktop_polymer_enable_wil_icons.js https://youtube.com/djm|" (Indicator: "youtube"; File: "dd56f9b15e16fba4_0") Found string "_keyhttps://www.youtube.com/s/desktop/7c155e84/jsbin/web-animations-next-lite.min.vflset/web-animations-next-lite.min.js https://youtube.com/" (Indicator: "youtube"; File: "5d3d41981bab44b3_0") Found string "_keyhttps://www.youtube.com/s/desktop/7c155e84/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js https://youtube.com/" (Indicator: "youtube"; File: "5b81f2d102f48d06_0") Found string "_keyhttps://www.youtube.com/s/desktop/7c155e84/jsbin/intersection-observer.min.vflset/intersection-observer.min.js https://youtube.com/{ ]f" (Indicator: "youtube"; File: "4d99ca6e9e3c32dd_0") Found string "_keyhttps://www.youtube.com/s/desktop/7c155e84/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.js https://youtube.com/*f;K" (Indicator: "youtube"; File: "19dbb1d9ad4777dd_0") Found string "_keyhttps://www.youtube.com/s/desktop/7c155e84/jsbin/webcomponents-sd.vflset/webcomponents-sd.js https://youtube.com/S4Mv" (Indicator: "youtube"; File: "a5f4762bb9d356b5_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3i7M54/yn/l/en_US/WW_dM8tCcty.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/](;L" (Indicator: "facebook.com"; File: "33bd99500895911e_0") Found string "_keyhttps://www.youtube.com/s/desktop/7c155e84/jsbin/www-tampering.vflset/www-tampering.js https://youtube.com/" (Indicator: "youtube"; File: "5ff39bec08dede32_0") Found string "_keyhttps://www.youtube.com/s/player/4a66ccde/player_ias.vflset/en_US/inline_preview.js https://youtube.com/p7T3" (Indicator: "youtube"; File: "8beb7ca35d16c0dd_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yi/r/K1u8FojW_L0.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/TNlXf" (Indicator: "facebook.com"; File: "3b9b063938b2e939_0") Found string "_keyhttps://www.youtube.com/s/player/4a66ccde/player_ias.vflset/en_US/endscreen.js https://youtube.com/6>zc" (Indicator: "youtube"; File: "8d51673a512d4063_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yO/r/_tJ17sGyxOX.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "7faaeb6d807041bb_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yd/r/D8yA-TXiNuk.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/,T,E" (Indicator: "facebook.com"; File: "42ce332cdbe9fa73_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yh/r/bpW4eEg-2_W.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "40701b42ebc1cb18_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yt/r/d4QqVJOdC1V.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "49d0896e54e4faca_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yo/r/j5B70NmINXl.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "2556f6e9598d5fb0_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/ye/r/yUtEQ4ajXZI.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/HyZZ" (Indicator: "facebook.com"; File: "4945a7b4b1e84510_0")3d:T576,Launches browser "msedge.exe" (UID: 00000000-00007748) Launches browser "msedge.exe" (UID: 00000000-00008156) Launches browser "msedge.exe" (UID: 00000000-00007732) Launches browser "msedge.exe" (UID: 00000000-00004108) Launches browser "msedge.exe" (UID: 00000000-00004104) Launches browser "msedge.exe" (UID: 00000000-00004240) Launches browser "msedge.exe" (UID: 00000000-00005336) Launches browser "msedge.exe" (UID: 00000000-00006644) Launches browser "msedge.exe" (UID: 00000000-00001724) Launches browser "msedge.exe" (UID: 00000000-00001516) Launches browser "msedge.exe" (UID: 00000000-00006560) Launches browser "msedge.exe" (UID: 00000000-00005760) Launches browser "msedge.exe" (UID: 00000000-00005132) Launches browser "msedge.exe" (UID: 00000000-00005124) Launches browser "msedge.exe" (UID: 00000000-00005960) Launches browser "msedge.exe" (UID: 00000000-00006128) Launches browser "msedge.exe" (UID: 00000000-00007800) Launches browser "msedge.exe" (UID: 00000000-00005452) Launches browser "msedge.exe" (UID: 00000000-00002652) Launches browser "msedge.exe" (UID: 00000000-00002236) Launches browser "msedge.exe" (UID: 00000000-00002152) Launches browser "msedge.exe" (UID: 00000000-00006272) Launches browser "msedge.exe" (UID: 00000000-00005464) Launches browser "msedge.exe" (UID: 00000000-00007452) Launches browser "msedge.exe" (UID: 00000000-00001900)3e:T716,"NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77500000 "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72EA0000 "Nx1xl66.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77500000 "Nx1xl66.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72EA0000 "UD5yq11.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77500000 "UD5yq11.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72EA0000 "GX1TQ77.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77500000 "GX1TQ77.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72EA0000 "1we14Nh5.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77500000 "1we14Nh5.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72EA0000 "2ZU6518.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77500000 "2ZU6518.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72EA0000 "3TB05qc.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77500000 "3TB05qc.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72EA0000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77500000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72EA0000 "4zp552KB.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77500000 "4zp552KB.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72EA0000 "5Mn4LS8.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77500000 "5Mn4LS8.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72EA0000 "cmd.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at C8D60000 "cmd.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at C77600003f:Te5f,"NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" was detected as "Microsoft Cabinet" and name: "sfx" "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" was detected as "Microsoft Cabinet File" and name: "Archive" "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" was detected as "Microsoft Linker" and name: "Linker" "Nx1xl66.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Nx1xl66.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Nx1xl66.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Nx1xl66.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Nx1xl66.exe" was detected as "Microsoft Linker" and name: "Linker" "UD5yq11.exe" was detected as "Microsoft Cabinet" and name: "sfx" "UD5yq11.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "UD5yq11.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "UD5yq11.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "UD5yq11.exe" was detected as "Microsoft Linker" and name: "Linker" "4zp552KB.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4zp552KB.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4zp552KB.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4zp552KB.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4zp552KB.exe" was detected as "Microsoft Linker" and name: "Linker" "GX1TQ77.exe" was detected as "Microsoft Cabinet" and name: "sfx" "GX1TQ77.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GX1TQ77.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GX1TQ77.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "GX1TQ77.exe" was detected as "Microsoft Linker" and name: "Linker" "3TB05qc.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3TB05qc.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3TB05qc.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3TB05qc.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3TB05qc.exe" was detected as "Microsoft Linker" and name: "Linker" "1we14Nh5.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1we14Nh5.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1we14Nh5.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1we14Nh5.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1we14Nh5.exe" was detected as "Microsoft Linker" and name: "Linker" "2ZU6518.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2ZU6518.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2ZU6518.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2ZU6518.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2ZU6518.exe" was detected as "Microsoft Linker" and name: "Linker" "5Mn4LS8.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5Mn4LS8.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5Mn4LS8.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5Mn4LS8.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5Mn4LS8.exe" was detected as "Microsoft Linker" and name: "Linker"40:T6b6,"1we14Nh5.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "5Mn4LS8.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "5Mn4LS8.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "5Mn4LS8.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "5Mn4LS8.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "5Mn4LS8.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "5Mn4LS8.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "5Mn4LS8.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "5Mn4LS8.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "5Mn4LS8.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "cmd.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\TREATAS") "cmd.exe" touched "Microsoft Url History Service" (Path: "HKCU\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS") "cmd.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER")41:T14b8,"NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Nx1xl66.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "UD5yq11.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4zp552KB.exe" file has an entrypoint instructions - "call 0x40a70f,jmp 0x409ce6,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x409bf0,jmp 0x409e72,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x436100],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "GX1TQ77.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "3TB05qc.exe" file has an entrypoint instructions - "call 0x40a71f,jmp 0x409cf6,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x409c00,jmp 0x409e82,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x436100],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "1we14Nh5.exe" file has an entrypoint instructions - "call 0x412a15,jmp 0x40cbdd,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x20,mov eax, dword ptr [ebp + 8],push esi,push edi,push 8,pop ecx,mov esi, 0x41f058,lea edi, [ebp - 0x20],rep movsd dword ptr es:[edi], dword ptr [esi],mov dword ptr [ebp - 8], eax,mov eax, dword ptr [ebp + 0xc],pop edi,mov dword ptr [ebp - 4], eax,pop esi,test eax, eax,je 0x40cd6e,test byte ptr [eax], 8,je 0x40cd6e,mov dword ptr [ebp - 0xc], 0x1994000,lea eax, [ebp - 0xc],push eax,push dword ptr [ebp - 0x10],push dword ptr [ebp - 0x1c],push dword ptr [ebp - 0x20],call dword ptr [0x41b000],leave ,ret 8,ret ,mov eax, 0x413563,mov dword ptr [0x4228e4], eax," "2ZU6518.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42bd74," "5Mn4LS8.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418010,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x418014], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418010], eax,call 0x405000,mov eax, 0x417088,mov dword ptr [0x418034], eax,call 0x40de30,call 0x40dba1,call 0x40aaa0,call 0x40a329,"42:T12b2,Process "Nx1xl66.exe" (UID: 00000000-00001224) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigation", PROCESSOR_ARCHITEW6432="AMD64"" Process "Nx1xl66.exe" (UID: 00000000-00001224) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "cmd.exe" (UID: 00000000-00004572) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "msedge.exe" (UID: 00000000-00007748) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", PROMPT="$P$G", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "msedge.exe" (UID: 00000000-00007748) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00007748) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00008156) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_7748_LMBPJSMHHNZIIHMZ", EDGE_BROWSER_PID="7748"" Process "msedge.exe" (UID: 00000000-00007732) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="20", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00004108) was launched with missing environment variables: "EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00004104) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_7748_LMBPJSMHHNZIIHMZ", EDGE_BROWSER_PID="7748", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00001724) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00001724) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00001516) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00001516) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00005124) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00005960) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_7748_LMBPJSMHHNZIIHMZ", EDGE_BROWSER_PID="7748", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00006128) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00006128) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00007800) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00007800) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID"43:T714,"NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Nx1xl66.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Nx1xl66.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Nx1xl66.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "UD5yq11.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "UD5yq11.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "UD5yq11.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "GX1TQ77.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "GX1TQ77.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "GX1TQ77.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1we14Nh5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "1we14Nh5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1we14Nh5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1we14Nh5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "2ZU6518.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "2ZU6518.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US")44:T589,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",12,"System.Windows.Forms Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089",03,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: 1we14Nh5.exe.log] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00000272-00000BC1-54702879] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00001224-00000BC1-55303185] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00001352-00000BC1-55855696] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00001520-00000BC1-56485971] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001628-00000C28-1049933374] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: 1we14Nh5.exe.log]45:T965,Spawned process "Nx1xl66.exe" (UID: 00000000-00001224) Spawned process "UD5yq11.exe" (UID: 00000000-00001352) Spawned process "GX1TQ77.exe" (UID: 00000000-00001520) Spawned process "1we14Nh5.exe" (UID: 00000000-00001628) Spawned process "2ZU6518.exe" (UID: 00000000-00006656) Spawned process "3TB05qc.exe" (UID: 00000000-00007060) Spawned process "AppLaunch.exe" (UID: 00000000-00007224) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 7060 -ip 7060" (UID: 00000000-00007200) Spawned process "WerFault.exe" with commandline "-u -p 7060 -s 144" (UID: 00000000-00007312) Spawned process "4zp552KB.exe" (UID: 00000000-00004136) Spawned process "AppLaunch.exe" (UID: 00000000-00006728) Spawned process "AppLaunch.exe" (UID: 00000000-00002796) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 4136 -ip 4136" (UID: 00000000-00007476) Spawned process "WerFault.exe" with commandline "-u -p 4136 -s 652" (UID: 00000000-00002376) Spawned process "5Mn4LS8.exe" (UID: 00000000-00002440) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\6E18.tmp\\6E19.tmp\\6E1A.bat %TEMP%\\IXP000.TMP\\5Mn ..." (UID: 00000000-00004572), Spawned process "msedge.exe" with commandline "--single-argument https://accounts.google.com/" (UID: 00000000-00007748), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00008156) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00007732) Spawned process "msedge.exe" with commandline "--single-argument https://www.facebook.com/login" (UID: 00000000-00004108) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00004104) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00004240) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00005336) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00006644) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00001724)46:T965,Spawned process "Nx1xl66.exe" (UID: 00000000-00001224) Spawned process "UD5yq11.exe" (UID: 00000000-00001352) Spawned process "GX1TQ77.exe" (UID: 00000000-00001520) Spawned process "1we14Nh5.exe" (UID: 00000000-00001628) Spawned process "2ZU6518.exe" (UID: 00000000-00006656) Spawned process "3TB05qc.exe" (UID: 00000000-00007060) Spawned process "AppLaunch.exe" (UID: 00000000-00007224) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 7060 -ip 7060" (UID: 00000000-00007200) Spawned process "WerFault.exe" with commandline "-u -p 7060 -s 144" (UID: 00000000-00007312) Spawned process "4zp552KB.exe" (UID: 00000000-00004136) Spawned process "AppLaunch.exe" (UID: 00000000-00006728) Spawned process "AppLaunch.exe" (UID: 00000000-00002796) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 4136 -ip 4136" (UID: 00000000-00007476) Spawned process "WerFault.exe" with commandline "-u -p 4136 -s 652" (UID: 00000000-00002376) Spawned process "5Mn4LS8.exe" (UID: 00000000-00002440) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\6E18.tmp\\6E19.tmp\\6E1A.bat %TEMP%\\IXP000.TMP\\5Mn ..." (UID: 00000000-00004572), Spawned process "msedge.exe" with commandline "--single-argument https://accounts.google.com/" (UID: 00000000-00007748), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00008156) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00007732) Spawned process "msedge.exe" with commandline "--single-argument https://www.facebook.com/login" (UID: 00000000-00004108) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00004104) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00004240) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00005336) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00006644) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00001724)47:T805b,"Nx1xl66.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Nx1xl66.exe]- [targetUID: 00000000-00001224] "urlref_httpswww.youtube.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "UD5yq11.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\UD5yq11.exe]- [targetUID: 00000000-00001224] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "4zp552KB.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\4zp552KB.exe]- [targetUID: 00000000-00001224] "GX1TQ77.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\GX1TQ77.exe]- [targetUID: 00000000-00001520] "3TB05qc.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\3TB05qc.exe]- [targetUID: 00000000-00007060] "1we14Nh5.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1we14Nh5.exe]- [targetUID: 00000000-00001628] "2ZU6518.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\2ZU6518.exe]- [targetUID: 00000000-00006656] "5Mn4LS8.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\5Mn4LS8.exe]- [targetUID: 00000000-00000272] "1we14Nh5.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\1we14Nh5.exe.log]- [targetUID: 00000000-00001628] "6E1A.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\6E18.tmp\6E19.tmp\6E1A.bat]- [targetUID: 00000000-00002440] "f80aad59a8bf244e_1" has type "data"- [targetUID: N/A] "f80aad59a8bf244e_0" has type "data"- [targetUID: N/A] "0" has type "ASCII text with very long lines"- [targetUID: N/A] "6050473529706327_1" has type "data"- [targetUID: N/A] "6050473529706327_0" has type "data"- [targetUID: N/A] "f_0004c7" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c7]- [targetUID: 00000000-00004104] "f_0004ce" has type "gzip compressed data max compression original size modulo 2^32 2571716"- [targetUID: N/A] "6869067474079f11_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\6869067474079f11_1]- [targetUID: 00000000-00007748] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00007748] "7b3285302c204756_0" has type "data"- [targetUID: N/A] "0ae129c33e7a30bd_1" has type "data"- [targetUID: N/A] "0a41c5226f4ea45c_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\0a41c5226f4ea45c_0]- [targetUID: 00000000-00007748] "6869067474079f11_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\6869067474079f11_0]- [targetUID: 00000000-00007748] "042558f185977c37_1" has type "data"- [targetUID: N/A] "21ae8dee7b304990_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\21ae8dee7b304990_1]- [targetUID: 00000000-00007748] "f_0004d7" has type "gzip compressed data original size modulo 2^32 769711"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004d7]- [targetUID: 00000000-00004104] "0ae129c33e7a30bd_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\0ae129c33e7a30bd_0]- [targetUID: 00000000-00007748] "a2b1c9606675bc61_0" has type "data"- [targetUID: N/A] "b39c6594c0e13bdc_1" has type "data"- [targetUID: N/A] "042558f185977c37_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\042558f185977c37_0]- [targetUID: 00000000-00007748] "7cb798dc066a740f_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\7cb798dc066a740f_1]- [targetUID: 00000000-00007748] "f_0004cc" has type "RIFF (little-endian) data Web/P image VP8 encoding 720x404 Scaling: [none]x[none] YUV color decoders should clamp"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cc]- [targetUID: 00000000-00004104] "21ae8dee7b304990_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\21ae8dee7b304990_0]- [targetUID: 00000000-00007748] "f_0004d0" has type "data"- [targetUID: N/A] "79faff66e6e23f2b_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\79faff66e6e23f2b_1]- [targetUID: 00000000-00007748] "0c223dc7-565e-42b1-8be9-3210e5ec1b5d.tmp" has type "JSON data"- [targetUID: N/A] "604fd825a3b68faa_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\604fd825a3b68faa_1]- [targetUID: 00000000-00007748] "f_0004c3" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c3]- [targetUID: 00000000-00004104] "9fe81b27-50de-487e-a281-3878ccf6a361.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\9fe81b27-50de-487e-a281-3878ccf6a361.tmp]- [targetUID: 00000000-00007748] "04acc2fd-a054-49ea-be6c-dc7828bf25e7.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\04acc2fd-a054-49ea-be6c-dc7828bf25e7.tmp]- [targetUID: 00000000-00007748] "35b04f8d-44d5-419e-9765-0a17af979ada.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\35b04f8d-44d5-419e-9765-0a17af979ada.tmp]- [targetUID: 00000000-00007748] "14c64dcb-59a9-4eb6-bd30-694d45888540.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "b39c6594c0e13bdc_0" has type "data"- [targetUID: N/A] "3" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.blob\2\00\3]- [targetUID: 00000000-00007748] "2" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.blob\2\00\2]- [targetUID: 00000000-00007748] "7cb798dc066a740f_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\7cb798dc066a740f_0]- [targetUID: 00000000-00007748] "f_0004c6" has type "gzip compressed data original size modulo 2^32 210893"- [targetUID: N/A] "f_0004c8" has type "RIFF (little-endian) data Web/P image VP8 encoding 720x404 Scaling: [none]x[none] YUV color decoders should clamp"- [targetUID: N/A] "a2748f42-1ea3-4e37-a375-7f233e96e9f1.tmp" has type "UTF-8 Unicode text with very long lines with no line terminators"- [targetUID: N/A] "f_0004dc" has type "RIFF (little-endian) data Web/P image VP8 encoding 800x450 Scaling: [none]x[none] YUV color decoders should clamp"- [targetUID: N/A] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "92e76512301e570b_1" has type "data"- [targetUID: N/A] "f_0004d9" has type "RIFF (little-endian) data Web/P image VP8 encoding 1280x720 Scaling: [none]x[none] YUV color decoders should clamp"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004d9]- [targetUID: 00000000-00004104] "f_0004c9" has type "data"- [targetUID: N/A] "79faff66e6e23f2b_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\79faff66e6e23f2b_0]- [targetUID: 00000000-00007748] "f_0004cd" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cd]- [targetUID: 00000000-00004104] "f_0004dd" has type "RIFF (little-endian) data Web/P image VP8 encoding 800x450 Scaling: [none]x[none] YUV color decoders should clamp"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004dd]- [targetUID: 00000000-00004104] "604fd825a3b68faa_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\604fd825a3b68faa_0]- [targetUID: 00000000-00007748] "5e3dcaa51f3c18a7_1" has type "data"- [targetUID: N/A] "f_0004d6" has type "gzip compressed data original size modulo 2^32 112544"- [targetUID: N/A] "92e76512301e570b_0" has type "data"- [targetUID: N/A] "f_0004d8" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004d8]- [targetUID: 00000000-00004104] "f_0004ca" has type "RIFF (little-endian) data Web/P image VP8 encoding 720x404 Scaling: [none]x[none] YUV color decoders should clamp"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004ca]- [targetUID: 00000000-00004104] "f_0004d5" has type "data"- [targetUID: N/A] "f_0004cb" has type "Web Open Font Format (Version 2) TrueType length 28684 version 1.0"- [targetUID: N/A] "f_0004cf" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cf]- [targetUID: 00000000-00004104] "8528cbc25da7cebc_1" has type "data"- [targetUID: N/A] "9a10f1a3-9e0a-4d38-9112-e32f974fd49f.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\9a10f1a3-9e0a-4d38-9112-e32f974fd49f.tmp]- [targetUID: 00000000-00007748] "a61200ee-17c3-4e76-83d1-f9d4410a7e96.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\a61200ee-17c3-4e76-83d1-f9d4410a7e96.tmp]- [targetUID: 00000000-00007748] "9c2e74df-1755-4405-bf5e-50046768fe9c.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\9c2e74df-1755-4405-bf5e-50046768fe9c.tmp]- [targetUID: 00000000-00007748] "bb28473a-1c6c-4406-8da3-fda3c2ddbaa7.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "49c7d8f5-4cd4-4f75-bea0-56dfb41e1de0.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "f_0004c4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c4]- [targetUID: 00000000-00004104] "f_0004d4" has type "Web Open Font Format (Version 2) TrueType length 21700 version 1.0"- [targetUID: N/A] "f_0004d2" has type "Web Open Font Format (Version 2) TrueType length 21464 version 1.0"- [targetUID: N/A] "9c3f2925ce078858_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\9c3f2925ce078858_1]- [targetUID: 00000000-00007748] "f_0004de" has type "gzip compressed data max compression original size modulo 2^32 108677"- [targetUID: N/A] "arbitration_service_config.json" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\arbitration_service_config.json]- [targetUID: 00000000-00007748] "f_0004c5" has type "data"- [targetUID: N/A] "5e3dcaa51f3c18a7_0" has type "data"- [targetUID: N/A] "2a0afd649b00527b_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2a0afd649b00527b_0]- [targetUID: 00000000-00007748] "1bd6aa3fb8d76d33_1" has type "data"- [targetUID: N/A] "2797e5e3f37a6737_0" has type "data"- [targetUID: N/A] "fd1459acad70c515_0" has type "data"- [targetUID: N/A] "3761f940ae901389_0" has type "data"- [targetUID: N/A] "temp-index" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index]- [targetUID: 00000000-00007748] "8528cbc25da7cebc_0" has type "data"- [targetUID: N/A] "164e3c425b24a8e7_1" has type "data"- [targetUID: N/A] "9c3f2925ce078858_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\9c3f2925ce078858_0]- [targetUID: 00000000-00007748] "2a0afd649b00527b_1" has type "data"- [targetUID: N/A] "9d1a57b5069eedc4_1" has type "data"- [targetUID: N/A] "7a5c2de1-1fce-4b94-9c76-e1ccd11667e3.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\7a5c2de1-1fce-4b94-9c76-e1ccd11667e3.tmp]- [targetUID: 00000000-00004104] "1bd6aa3fb8d76d33_0" has type "data"- [targetUID: N/A] "9d1a57b5069eedc4_0" has type "data"- [targetUID: N/A] "b5adca99b81aec6c_0" has type "data"- [targetUID: N/A] "164e3c425b24a8e7_0" has type "data"- [targetUID: N/A] "e0fd59de-a367-4af3-99cb-5a7a075c22a2.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "3827c71d-6d5d-4860-886e-66d2150606ff.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\3827c71d-6d5d-4860-886e-66d2150606ff.tmp]- [targetUID: 00000000-00004104] "7162e1d2493ab2a1_0" has type "data"- [targetUID: N/A] "5df9ba06-271d-4328-ad02-981e925db7fa.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\5df9ba06-271d-4328-ad02-981e925db7fa.tmp]- [targetUID: 00000000-00004104] "663d45b8-a874-461c-9386-52be4c45dea5.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\663d45b8-a874-461c-9386-52be4c45dea5.tmp]- [targetUID: 00000000-00004104] "72e755bd-62a1-498d-a226-dd888095b35c.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\72e755bd-62a1-498d-a226-dd888095b35c.tmp]- [targetUID: 00000000-00004104] "4ec5902ccf5150b7_0" has type "data"- [targetUID: N/A] "1aca1f18437ce2af_0" has type "data"- [targetUID: N/A] "4ada58cf-e088-43e9-9ac8-d33f707bbd32.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\4ada58cf-e088-43e9-9ac8-d33f707bbd32.tmp]- [targetUID: 00000000-00004104] "2c1a7e64-2db0-45ab-a84d-21c1558165e0.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "117457e9-45c9-484a-8ed1-bbdb78292363.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\117457e9-45c9-484a-8ed1-bbdb78292363.tmp]- [targetUID: 00000000-00004104] "4ec5902ccf5150b7_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\4ec5902ccf5150b7_1]- [targetUID: 00000000-00007748] "f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\TokenBroker\Cache\f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres]- [targetUID: 00000000-00007748] "temp-index" has type "zlib compressed data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\875813a1-1f88-4e6f-bbe2-6610bed4763c\index-dir\temp-index]- [targetUID: 00000000-00007748] "bf7a8649fa9dbeb9_0" has type "data"- [targetUID: N/A] "a58c642abc22f9bf_0" has type "data"- [targetUID: N/A] "848f191cf3fbeb2f_0" has type "data"- [targetUID: N/A] "a99747c743014393_0" has type "data"- [targetUID: N/A] "e7890cf39e18cf26_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\875813a1-1f88-4e6f-bbe2-6610bed4763c\e7890cf39e18cf26_0]- [targetUID: 00000000-00007748] "d0b40ffeb2fe39a6_0" has type "data"- [targetUID: N/A] "8798af3c84594e1b_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\875813a1-1f88-4e6f-bbe2-6610bed4763c\8798af3c84594e1b_0]- [targetUID: 00000000-00007748] "c85d3865b8a09bbd_0" has type "data"- [targetUID: N/A] "f835a9c68ede7223_0" has type "data"- [targetUID: N/A] "b39bb45419b60405_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\875813a1-1f88-4e6f-bbe2-6610bed4763c\b39bb45419b60405_0]- [targetUID: 00000000-00007748] "ea620276acec5737_0" has type "data"- [targetUID: N/A] "1767a8b348839f1c_0" has type "data"- [targetUID: N/A] "0bef2a0adb368490_0" has type "data"- [targetUID: N/A] "ae7557eee904f6ed_0" has type "data"- [targetUID: N/A] "b25b3aae265ef44d_0" has type "data"- [targetUID: N/A] "2bcfe390dba90335_0" has type "data"- [targetUID: N/A] "2ee660419e7bb481_0" has type "data"- [targetUID: N/A] "2bf260df9eec0de3_0" has type "data"- [targetUID: N/A] "3e7834d4964b8805_0" has type "data"- [targetUID: N/A] "b262aeaa780b5937_0" has type "data"- [targetUID: N/A] "ef92fbea0aff4515_0" has type "data"- [targetUID: N/A] "8bcd9e8b0b746dec_0" has type "data"- [targetUID: N/A] "b9faf49cd63f59a6_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\875813a1-1f88-4e6f-bbe2-6610bed4763c\b9faf49cd63f59a6_0]- [targetUID: 00000000-00007748] "fc496558f77f6d37_0" has type "data"- [targetUID: N/A] "11ca329ff4409162_0" has type "data"- [targetUID: N/A] "d5b24d864da153a2_0" has type "data"- [targetUID: N/A] "1e109dc9985e23e3_0" has type "data"- [targetUID: N/A] "e4cb571d59fd7eb7_0" has type "data"- [targetUID: N/A] "8ef2564ddabd1ac9_0" has type "data"- [targetUID: N/A] "57c63dee16688cf9_0" has type "data"- [targetUID: N/A] "296a61baf34a477b_0" has type "data"- [targetUID: N/A] "c5c34262898c6925_0" has type "data"- [targetUID: N/A] "a6b2e6529740b47c_0" has type "data"- [targetUID: N/A] "232e8ce34b8361a8_0" has type "data"- [targetUID: N/A] "90f13fe0332b1ec3_0" has type "data"- [targetUID: N/A] "cccb4af9a32d559a_0" has type "data"- [targetUID: N/A] "5da2fb196c265036_0" has type "data"- [targetUID: N/A] "4815725c8ce7cac2_0" has type "data"- [targetUID: N/A] "b3f0e35eea4b0f24_0" has type "data"- [targetUID: N/A] "c22e1f4f0fd215b9_0" has type "data"- [targetUID: N/A] "c9e3e9d320c9c18e_0" has type "data"- [targetUID: N/A] "f0bf847b72e9be52_0" has type "data"- [targetUID: N/A] "9f0570cf70573c01_0" has type "data"- [targetUID: N/A] "047389f836a23469_0" has type "data"- [targetUID: N/A] "df6fcc25dfcae313_0" has type "data"- [targetUID: N/A] "d109b9b7172fb490_0" has type "data"- [targetUID: N/A] "8d439ccb90934736_0" has type "data"- [targetUID: N/A] "45abe68dd5c5eef9_0" has type "data"- [targetUID: N/A] "99fcc45af9bdb7c3_0" has type "data"- [targetUID: N/A] "ab833005514b90ae_0" has type "data"- [targetUID: N/A] "b00e230b1666101f_0" has type "data"- [targetUID: N/A] "85ade39e4df78f89_0" has type "data"- [targetUID: N/A] "bf28156a9f893413_0" has type "data"- [targetUID: N/A] "6ded268f137f0645_0" has type "data"- [targetUID: N/A] "05dcb51db89022db_0" has type "data"- [targetUID: N/A] "9ab8f143aeb5e79f_0" has type "data"- [targetUID: N/A] "bafbe6dce172daf5_0" has type "data"- [targetUID: N/A] "73c023c4157dee87_0" has type "data"- [targetUID: N/A] "f40a64cbc66a4451_0" has type "data"- [targetUID: N/A] "f5c01eb9c70a0925_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\875813a1-1f88-4e6f-bbe2-6610bed4763c\f5c01eb9c70a0925_0]- [targetUID: 00000000-00007748] "1557b7fdc2795560_0" has type "data"- [targetUID: N/A] "676309ebc9bee713_0" has type "data"- [targetUID: N/A] "3941d9264340cece_0" has type "data"- [targetUID: N/A] "ffa88d64780492eb_0" has type "data"- [targetUID: N/A] "69efd29ffe7f5db8_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\875813a1-1f88-4e6f-bbe2-6610bed4763c\69efd29ffe7f5db8_0]- [targetUID: 00000000-00007748] "d2555b74a1131c9d_0" has type "data"- [targetUID: N/A] "bf3ff48678c82259_0" has type "data"- [targetUID: N/A] "51db86437fbde823_0" has type "data"- [targetUID: N/A] "bd90de8af9374096_0" has type "data"- [targetUID: N/A] "2aefc90dcd923e21_0" has type "data"- [targetUID: N/A] "2a3a5eeb2614d0f8_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\875813a1-1f88-4e6f-bbe2-6610bed4763c\2a3a5eeb2614d0f8_0]- [targetUID: 00000000-00007748] "e5c07661ec64c5fe_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\875813a1-1f88-4e6f-bbe2-6610bed4763c\e5c07661ec64c5fe_0]- [targetUID: 00000000-00007748] "d8d9cdb8ccf2edca_0" has type "data"- [targetUID: N/A] "fcd77c4e5365feb9_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\875813a1-1f88-4e6f-bbe2-6610bed4763c\fcd77c4e5365feb9_0]- [targetUID: 00000000-00007748] "50e90a0afa1981bf_0" has type "data"- [targetUID: N/A] "f2683fabe64bae2f_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\875813a1-1f88-4e6f-bbe2-6610bed4763c\f2683fabe64bae2f_0]- [targetUID: 00000000-00007748] "e4e447ee380a509e_0" has type "data"- [targetUID: N/A] "e2aa79afcd69da46_0" has type "data"- [targetUID: N/A] "181921b9c261bfa8_0" has type "data"- [targetUID: N/A] "cc128d1b3dedff96_0" has type "data"- [targetUID: N/A] "1094d8464a878fe5_0" has type "data"- [targetUID: N/A] "880927cc8e6e9765_0" has type "data"- [targetUID: N/A] "b5360af0b77ffc5b_0" has type "data"- [targetUID: N/A] "9ddda9536225ca22_0" has type "data"- [targetUID: N/A] "d0ae18162ad8eb6b_0" has type "data"- [targetUID: N/A] "e979d1cda74c68a9_0" has type "data"- [targetUID: N/A] "7adef1711f65fa38_0" has type "data"- [targetUID: N/A] "a4bb93aff597cdd5_0" has type "data"- [targetUID: N/A] "0993e4fd7514ce03_0" has type "data"- [targetUID: N/A] "9c60a0453baf11bf_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\875813a1-1f88-4e6f-bbe2-6610bed4763c\9c60a0453baf11bf_0]- [targetUID: 00000000-00007748] "c539d577bdedde3b_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\875813a1-1f88-4e6f-bbe2-6610bed4763c\c539d577bdedde3b_0]- [targetUID: 00000000-00007748] "7272decba30800cf_0" has type "data"- [targetUID: N/A] "bf2ab0d73a66faa4_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\875813a1-1f88-4e6f-bbe2-6610bed4763c\bf2ab0d73a66faa4_0]- [targetUID: 00000000-00007748] "4ea02909a5d84a9b_0" has type "data"- [targetUID: N/A] "4bfc653db9edfcdc_0" has type "data"- [targetUID: N/A] "e025c39cbd947b46_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\875813a1-1f88-4e6f-bbe2-6610bed4763c\e025c39cbd947b46_0]- [targetUID: 00000000-00007748] "80eba78637633e1d_0" has type "data"- [targetUID: N/A] "135f15e6b6aa3240_0" has type "data"- [targetUID: N/A] "8052d137354c78a6_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\875813a1-1f88-4e6f-bbe2-6610bed4763c\8052d137354c78a6_0]- [targetUID: 00000000-00007748] "ab0423415fc0f8de_0" has type "data"- [targetUID: N/A] "c08d6b2d5449a572_0" has type "data"- [targetUID: N/A] "766415f99b4c6b7d_0" has type "data"- [targetUID: N/A] "be57e96208f23f53_0" has type "data"- [targetUID: N/A] "c69025f7ccf55c6a_0" has type "data"- [targetUID: N/A] "temp-index" has type "MS Windows COFF Motorola 68000 object file"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\index-dir\temp-index]- [targetUID: 00000000-00007748] "554b64473fcc6c6c_0" has type "data"- [targetUID: N/A] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG]- [targetUID: 00000000-00007748] "dd56f9b15e16fba4_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\dd56f9b15e16fba4_0]- [targetUID: 00000000-00007748] "settings.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\settings.dat]- [targetUID: 00000000-00008156] "5d3d41981bab44b3_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\5d3d41981bab44b3_0]- [targetUID: 00000000-00007748] "5b81f2d102f48d06_0" has type "data"- [targetUID: N/A] "4d99ca6e9e3c32dd_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\4d99ca6e9e3c32dd_0]- [targetUID: 00000000-00007748] "19dbb1d9ad4777dd_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\19dbb1d9ad4777dd_0]- [targetUID: 00000000-00007748] "a5f4762bb9d356b5_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\a5f4762bb9d356b5_0]- [targetUID: 00000000-00007748] "33bd99500895911e_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\33bd99500895911e_0]- [targetUID: 00000000-00007748] "5ff39bec08dede32_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\5ff39bec08dede32_0]- [targetUID: 00000000-00007748] "8beb7ca35d16c0dd_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\8beb7ca35d16c0dd_0]- [targetUID: 00000000-00007748] "3b9b063938b2e939_0" has type "data"- [targetUID: N/A] "8d51673a512d4063_0" has type "data"- [targetUID: N/A] "7faaeb6d807041bb_0" has type "data"- [targetUID: N/A] "42ce332cdbe9fa73_0" has type "data"- [targetUID: N/A] "40701b42ebc1cb18_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\40701b42ebc1cb18_0]- [targetUID: 00000000-00007748] "49d0896e54e4faca_0" has type "data"- [targetUID: N/A] "2556f6e9598d5fb0_0" has type "data"- [targetUID: N/A] "4945a7b4b1e84510_0" has type "data"- [targetUID: N/A] "42f4c516cc7fb026_0" has type "data"- [targetUID: N/A] "ee9a8283c80e3e52_0" has type "data"- [targetUID: N/A] "9e35b0c2ae3dcde4_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\9e35b0c2ae3dcde4_0]- [targetUID: 00000000-00007748] "7a9bea57b8cf5f41_0" has type "data"- [targetUID: N/A] "7b95d65eb18c490e_0" has type "data"- [targetUID: N/A] "ac9537cd8ef7244a_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\ac9537cd8ef7244a_0]- [targetUID: 00000000-00007748] "22a1dfae96f6cc61_0" has type "data"- [targetUID: N/A] "8d5e1c410a09c25f_0" has type "data"- [targetUID: N/A] "d4e5d662b01c72f2_0" has type "data"- [targetUID: N/A] "d3776b2d341e7614_0" has type "data"- [targetUID: N/A] "541b5671107e5be4_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\541b5671107e5be4_0]- [targetUID: 00000000-00007748] "e5594fa5ff0a3fa4_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\e5594fa5ff0a3fa4_0]- [targetUID: 00000000-00007748] "0fe2e0c1a33ed442_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\0fe2e0c1a33ed442_0]- [targetUID: 00000000-00007748] "5ccfbcf13612fe1e_0" has type "data"- [targetUID: N/A] "631abe1476e81891_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\631abe1476e81891_0]- [targetUID: 00000000-00007748] "ee7cbe503ed88301_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\ee7cbe503ed88301_0]- [targetUID: 00000000-00007748] "a8fd0984b9c3ec79_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\a8fd0984b9c3ec79_0]- [targetUID: 00000000-00007748] "66d4e4e90ccdae2c_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\66d4e4e90ccdae2c_0]- [targetUID: 00000000-00007748] "6b55a95a8461dae9_0" has type "data"- [targetUID: N/A] "335e69ddec2b9ac6_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\335e69ddec2b9ac6_0]- [targetUID: 00000000-00007748] "index.txt.tmp" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp]- [targetUID: 00000000-00007748] "temp-index" has type "data"- [targetUID: 00000000-00007748] "Last Browser" has type "data"- [targetUID: N/A] "Variations" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Variations]- [targetUID: 00000000-00007748] "temp-index" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9d6a1e9b-11b1-425b-ab62-159627423ef7\index-dir\temp-index]- [targetUID: 00000000-00007748] "MANIFEST-000001" has type "PGP Secret Key -"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001]- [targetUID: 00000000-00007748] "index" has type "data"- [targetUID: 00000000-00007748] "MANIFEST-000001" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001]- [targetUID: 00000000-00007748] "000001.dbtmp" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000001.dbtmp]- [targetUID: 00000000-00007748] "Last Version" has type "ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Last Version]- [targetUID: 00000000-00007748] "9c54150f-ff1a-475f-a558-8f679d94bcc4.tmp" has type "very short file (no magic)"- [targetUID: N/A] "f_0004da" has type "gzip compressed data max compression original size modulo 2^32 108677"- [targetUID: N/A] "f_0004d1" has type "gzip compressed data max compression original size modulo 2^32 108677"- [targetUID: N/A] "f_0004d3" has type "gzip compressed data max compression original size modulo 2^32 108677"- [targetUID: N/A] "f_0004db" has type "gzip compressed data max compression original size modulo 2^32 108677"- [targetUID: N/A] "index" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\875813a1-1f88-4e6f-bbe2-6610bed4763c\index]- [targetUID: 00000000-00007748] "index" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9d6a1e9b-11b1-425b-ab62-159627423ef7\index]- [targetUID: 00000000-00007748] "000001.dbtmp" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp]- [targetUID: 00000000-00007748]48:Tef6,"0c223dc7-565e-42b1-8be9-3210e5ec1b5d.tmp" has type "JSON data" "9fe81b27-50de-487e-a281-3878ccf6a361.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\9fe81b27-50de-487e-a281-3878ccf6a361.tmp] "04acc2fd-a054-49ea-be6c-dc7828bf25e7.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\04acc2fd-a054-49ea-be6c-dc7828bf25e7.tmp] "35b04f8d-44d5-419e-9765-0a17af979ada.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\35b04f8d-44d5-419e-9765-0a17af979ada.tmp] "14c64dcb-59a9-4eb6-bd30-694d45888540.tmp" has type "ASCII text with very long lines with no line terminators" "a2748f42-1ea3-4e37-a375-7f233e96e9f1.tmp" has type "UTF-8 Unicode text with very long lines with no line terminators" "9a10f1a3-9e0a-4d38-9112-e32f974fd49f.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\9a10f1a3-9e0a-4d38-9112-e32f974fd49f.tmp] "a61200ee-17c3-4e76-83d1-f9d4410a7e96.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\a61200ee-17c3-4e76-83d1-f9d4410a7e96.tmp] "9c2e74df-1755-4405-bf5e-50046768fe9c.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\9c2e74df-1755-4405-bf5e-50046768fe9c.tmp] "bb28473a-1c6c-4406-8da3-fda3c2ddbaa7.tmp" has type "ASCII text with very long lines with no line terminators" "49c7d8f5-4cd4-4f75-bea0-56dfb41e1de0.tmp" has type "ASCII text with very long lines with no line terminators" "7a5c2de1-1fce-4b94-9c76-e1ccd11667e3.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\7a5c2de1-1fce-4b94-9c76-e1ccd11667e3.tmp] "e0fd59de-a367-4af3-99cb-5a7a075c22a2.tmp" has type "ASCII text with very long lines with no line terminators" "3827c71d-6d5d-4860-886e-66d2150606ff.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\3827c71d-6d5d-4860-886e-66d2150606ff.tmp] "5df9ba06-271d-4328-ad02-981e925db7fa.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\5df9ba06-271d-4328-ad02-981e925db7fa.tmp] "663d45b8-a874-461c-9386-52be4c45dea5.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\663d45b8-a874-461c-9386-52be4c45dea5.tmp] "72e755bd-62a1-498d-a226-dd888095b35c.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\72e755bd-62a1-498d-a226-dd888095b35c.tmp] "4ada58cf-e088-43e9-9ac8-d33f707bbd32.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\4ada58cf-e088-43e9-9ac8-d33f707bbd32.tmp] "2c1a7e64-2db0-45ab-a84d-21c1558165e0.tmp" has type "ASCII text with very long lines with no line terminators" "117457e9-45c9-484a-8ed1-bbdb78292363.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\117457e9-45c9-484a-8ed1-bbdb78292363.tmp] "index.txt.tmp" has type "data" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp] "9c54150f-ff1a-475f-a558-8f679d94bcc4.tmp" has type "very short file (no magic)"49:T7d6,"NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")4a:Tf69,"NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "NEAS.040BB4A3060C84F340FC23F76B0F2CF49A706A4CE0317BD2242CD998C04D6116EXE"; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")4b:T559,"NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" trying to touch file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" trying to touch file "C:\NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" trying to touch file "C:\Windows\SysWOW64\AcLayers.dll" "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" trying to touch file "C:\Windows\SysWOW64\mpr.dll" "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" trying to touch file "C:\Windows\SysWOW64\sfc.dll"4c:T4e8,"2ZU6518.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "2ZU6518.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "2ZU6518.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "2ZU6518.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "2ZU6518.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "2ZU6518.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "5Mn4LS8.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "5Mn4LS8.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History"4d:Td5a,"NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\NX1XL66.EXE" "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5MN4LS8.EXE" "Nx1xl66.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "Nx1xl66.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "Nx1xl66.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "Nx1xl66.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "Nx1xl66.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\UD5YQ11.EXE" "Nx1xl66.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4ZP552KB.EXE" "UD5yq11.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "UD5yq11.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "UD5yq11.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "UD5yq11.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "UD5yq11.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\GX1TQ77.EXE" "UD5yq11.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3TB05QC.EXE" "GX1TQ77.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "GX1TQ77.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\CABINET.DLL" "GX1TQ77.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\VERSION.DLL" "GX1TQ77.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\FLTLIB.DLL" "GX1TQ77.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1WE14NH5.EXE" "GX1TQ77.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2ZU6518.EXE" "1we14Nh5.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL"4e:T8f0,"NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" trying to access non-existent file "\Device\HarddiskVolume2\NEAS.040BB4A3060C84F340FC23F76B0F2CF49A706A4CE0317BD2242CD998C04D6116EXE.LOCAL" "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "Nx1xl66.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\NX1XL66.EXE.LOCAL" "Nx1xl66.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "UD5yq11.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\UD5YQ11.EXE.LOCAL" "UD5yq11.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "GX1TQ77.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\GX1TQ77.EXE.LOCAL" "GX1TQ77.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "1we14Nh5.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "1we14Nh5.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1WE14NH5.EXE.CONFIG" "1we14Nh5.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "1we14Nh5.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1WE14NH5.EXE.LOG" "1we14Nh5.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "1we14Nh5.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "1we14Nh5.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL"4f:Te23,Observed email domain:"var mx=lx=kcc;lx.prototype.onytmastheadhidden=lx.prototype.onytmastheadhidden;lx.prototype.onytnavigate=lx.prototype.onytnavigate;lx.prototype.onyttogglebutton=lx.prototype.onyttogglebutton;lx.prototype.datachanged=lx.prototype.datachanged;mx.jsc$14346_playback_cue_range="playback";u([n(mo.ytrendererstamperbehavior),v("design:type",object)],mx.prototype,"ytrendererstamperbehavior",void 0);u([n(v.ytrendererbehavior),v("design:type",object)],mx.prototype,"ytrendererbehavior",void 0);" [Source: 0] Observed email domain:"u([n(cc.ytactionhandlerbehavior),v("design:type",object)],mx.prototype,"ytactionhandlerbehavior",void 0);u([q(),v("design:type",object)],mx.prototype,"data",void 0);u([q(),v("design:type",object)],mx.prototype,"useytdplayer",void 0);u([qb("ytd-toggle-button-renderer"),v("design:type",object)],mx.prototype,"mutebutton",void 0);u([q(),v("design:type",object)],mx.prototype,"buttonoverrides",void 0);" [Source: 0] Observed email domain:"u([o("data.accessibilitydata.label"),v("design:type",string),v("design:paramtypes",[])],mx.prototype,"titlearialabel",null);u([qb("#replay-button"),v("design:type",object)],mx.prototype,"replaybutton",void 0);u([qb("#player-container"),v("design:type",object)],mx.prototype,"playercontainer",void 0);u([qb("#player"),v("design:type",object)],mx.prototype,"embeddedplayer",void 0);u([qb("#ytd-player"),v("design:type",object)],mx.prototype,"ytdplayer",void 0);" [Source: 0] Observed email domain:"u([q({reflecttoattribute:!0,value:g("web_rounded_thumbnails")}),v("design:type",boolean)],mx.prototype,"rounded",void 0);u([pb("data"),v("design:type",function),v("design:paramtypes",[]),v("design:returntype")],mx.prototype,"datachanged",null);u([p("yt-toggle-button"),v("design:type",function),v("design:paramtypes",[customevent]),v("design:returntype")],mx.prototype,"onyttogglebutton",null);" [Source: 0] Observed email domain:"u([p("yt-navigate"),v("design:type",function),v("design:paramtypes",[customevent]),v("design:returntype")],mx.prototype,"onytnavigate",null);u([p("yt-masthead-hidden"),v("design:type",function),v("design:paramtypes",[]),v("design:returntype")],mx.prototype,"onytmastheadhidden",null);mx=lx=u([s({is:"ytd-video-masthead-ad-primary-video-renderer",disableelementregistration:!0})],mx);" [Source: 0] Observed email domain:"var mx=gdc;mx.prototype.updaterightsquigglystyle=mx.prototype.updaterightsquigglystyle;mx.prototype.updateleftsquigglystyle=mx.prototype.updateleftsquigglystyle;u([q(),v("design:type",object)],mx.prototype,"data",void 0);u([q({value:!1}),v("design:type",boolean)],mx.prototype,"isdarktheme",void 0);u([q(),v("design:type",string)],mx.prototype,"leftsquiggly",void 0);u([q(),v("design:type",string)],mx.prototype,"rightsquiggly",void 0);" [Source: 0] Observed email domain:"u([pb("leftsquiggly"),v("design:type",function),v("design:paramtypes",[]),v("design:returntype")],mx.prototype,"updateleftsquigglystyle",null);u([pb("rightsquiggly"),v("design:type",function),v("design:paramtypes",[]),v("design:returntype")],mx.prototype,"updaterightsquigglystyle",null);u([n(v.ytrendererbehavior),v("design:type",object)],mx.prototype,"ytrendererbehavior",void 0);u([n(mo.ytrendererstamperbehavior),v("design:type",object)],mx.prototype,"ytrendererstamperbehavior",void 0);" [Source: 0] Observed email domain:"u([n(cc.ytactionhandlerbehavior),v("design:type",object)],mx.prototype,"ytactionhandlerbehavior",void 0);u([q(),v("design:type",object)],mx.prototype,"actionbuttonoverride",void 0);mx=u([s({is:"ytd-handles-claiming-header-renderer",disableelementregistration:!0})],mx);" [Source: 0]50:T74fb,Pattern match: "https://www.youtube.com/" Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com/" Heuristic match: "{0.tv" Heuristic match: "[2.kh" Heuristic match: "*#.kr" Heuristic match: "RG.Jp" Pattern match: "PjVW-PjWW.PjRW/PjSWHPjPWLPjQW" Pattern match: "xc.p3s.xj/k#8b[-YB![P;l" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0vj0h0?3http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%http://ocsp.usertrust.com0G4JaF^@F-J@H#jYhRB_mt^Ju~@Mc5" Pattern match: "https://accounts.google.comstart" Pattern match: "https://www.youtube.com/s/player/4a66ccde/player_ias.vflset/en_US/offline.jsQb:xBQbBhQb^HQbR" Pattern match: "https://www.youtube.com/s/player/4a66ccde/player_ias.vflset/en_US/remote.jsQb6PQbB@(Qbj@&Qbnp+ZQbvPQbzPKQb:qQbZAFQbBQbz2I-QbJCQbNS'Qb^S/6Qbb#TQbfSQbR4Qb.5@Qb2%QbR5mQbb%QbrEQbrusQb~5I3Qb2&Qb6&QbzFUQbR'^~QbZgQbf7XSQbzGeZQb:8Qb2)QbNy&QbbY#QbjwindowQbFZgQbV:C" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/jsbin/webcomponents-sd.vflset/webcomponents-sd.jsQbJ0vQb^0?KQbfxQbj" Pattern match: "https://www.youtube.com/s/player/4a66ccde/player_ias.vflset/en_US/captions.jsQbNXQb^HQbjtQb2yQbFVQbB}QbVQbju" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/jsbin/web-animations-next-lite.min.vflset/web-animations-next-lite.min.jsDaN_delayQd.C_endDelay_fillQe*#_iterationStart_iterations_durationQe6^_playbackRate_direction_easingQeRs_easingFunctionhttps://www.youtube.c" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/jsbin/spf.vflset/spf.jsQbJ0vQb^0?KQbfxQbj" Pattern match: "https://www.youtube.com/s/player/4a66ccde/player_ias.vflset/en_US/endscreen.jswindowQb&" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/jsbin/network.vflset/network.jsQbB^QbJ0vQbj4Qb*UQbR{?cQbrwQbr" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/jsbin/www-tampering.vflset/www-tampering.jsQbR{?chttps://www.youtube.com/s/desktop/7c155e84/jsbin/www-tampering.vflset/www-tampering.jswindowselfMathCannot" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53r3l?ver=5412,PORTRAIT:https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53bta?ver=2bf3,update_period:86400},creativeId:128000000003595" Pattern match: "nl.aYq/FlV]cA" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/jsbin/scheduler.vflset/scheduler.jsQb*Uhttps://www.youtube.com/s/desktop/7c155e84/jsbin/scheduler.vflset/scheduler.jswindowselfMathCannot" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/jsbin/network.vflset/network.js" Pattern match: "www.youtube.com\/s\/desktop\/7c155e84\/jsbin\/serviceworker-kevlar-appshell.vflset\/serviceworker-kevlar-appshell.js" Pattern match: "https://www.youtube.com/s/player/4a66ccde/player_ias.vflset/en_US/miniplayer.jsPL`$callbutton4Qk" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/cssbin/www-main-desktop-watch-page-skeleton.css:root{--blob-a-x:55%;--blob-a-y:15%;--blob-b-x:101%;--blob-b-y:3%;--blob-c-x:94%;--blob-c-y:113%;--blob-d-x:10%;--blob-d-y:70%;--blob-e-x:0%;--blob-e-y:0%}@property" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/cssbin/www-main-desktop-home-page-skeleton.css:root{--blob-a-x:55%;--blob-a-y:15%;--blob-b-x:101%;--blob-b-y:3%;--blob-c-x:94%;--blob-c-y:113%;--blob-d-x:10%;--blob-d-y:70%;--blob-e-x:0%;--blob-e-y:0%}@property" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/offline_no_content/v1/192px.svg" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/jsbin/www-tampering.vflset/www-tampering.js" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/jsbin/intersection-observer.min.vflset/intersection-observer.min.jstimeQd*#rootBoundsboundingClientRectQe6!intersectionRectisIntersectingwidthQc^1heightintersectionRatiox^-ohttps://www.youtube.com/s/desktop/7c155e" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/jsbin/scheduler.vflset/scheduler.js" Pattern match: "www.youtube.com/sw.jshttps://www.youtube.com/s/desktop/7c155e84/jsbin/serviceworker-kevlar-appshell.vflset/serviceworker-kevlar-appshell.jscreateScriptURLDaR9DI]DcQe~P0EXPERIMENT_FLAGSH5_enable_full_pacf_loggingH5_use_async_loggingGab_det_fet_wr_enGaction_" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.jssplitexecScriptvar" Pattern match: "https://www.clarity.ms,supports_spdy:true},{anonymization:[],server:https://microsoftedgewelcome.microsoft.com,supports_spdy:true},{anonymization:[],server:https://edgefrecdn.azureedge.net,supports_spdy:true},{anonymization:[],server" Pattern match: "https://www.youtube.com/s/player/4a66ccde/player_ias.vflset/en_US/miniplayer.js" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.js" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/yt-logo-updated/v2/24px.svg" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/jsbin/intersection-observer.min.vflset/intersection-observer.min.js/*" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/youtube_round/v1/24px.svg" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js'use" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/youtube_kids_round/v1/24px.svg" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js|L`:windowcustomElementsHTMLElementdefinecallhttps://www.youtube.com/s/desktop/7c155e84/jsbin/custom-elements-es5-adapter.vflset/custom-elemen" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/gear/v6/24px.svg" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/img/favicon.icoaccept-rangesbytes441919alt-svc.h3=:443" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/cssbin/www-onepick.css.picker-frame{width:100%;height:100%;border:0;overflow:hidden}.picker.modal-dialog-bg{position:absolute;top:0;left:0;background-color:#fff}.picker.modal-dialog{position:absolute;top:0;left:0;" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/creator_studio_red_logo/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/youtube_shorts/v8/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/shorts-dislike/v2/32px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/radar_live/v6/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/radar_live/v6/24px.svg" Pattern match: "fonts.gstatic.com/s/i/youtube_outline/volume_off/v4/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/shorts-like/v2/32px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/question_circle/v5/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/broadcast/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/radar_live/v6/16px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/broadcast/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/person_circle/v8/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/fire/v8/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/thumb_up/v17/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/shorts-share/v2/32px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/gear/v6/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/gaming/v1/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/shorts-comment/v2/32px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/arrow_time/v8/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/bell/v8/24px.svg" Pattern match: "www.gstatic.com/youtube/img/icons/web/youtube_outline/waveform/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/youtube_shorts/v8/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/volume_on/v3/24px.svg" Pattern match: "fonts.gstatic.com/s/i/youtube_outline/lightbulb/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/overflow_vertical/v10/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/location_point/v5/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/gaming/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/fashion/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/fire/v8/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/bag/v4/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/overflow_horizontal/v4/24px.svg" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5Bikz2SRVqI.es5.O/ck=boq-identity.AccountsSignInUi.h054YajHleE.L.W.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63," Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/fashion/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/bag/v4/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/volume-off/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/trophy/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/search/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/search/v7/24px.svg" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5Bikz2SRVqI.es5.O/ck=boq-identity.AccountsSignInUi.h054YajHleE.L.W.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/mic/v8/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/arrow_time/v8/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/thumb_up/v17/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/bell/v8/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/mic/v8/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/youtube_shorts_brand_24/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/audio/v5/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/lightbulb/v1/24px.svg" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5Bikz2SRVqI.es5.O/ck=boq-identity.AccountsSignInUi.h054YajHleE.L.W.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAk" Pattern match: "fonts.gstatic.com/s/i/youtube_outline/clock/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/video_camera_add/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/news/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/add_circle/v3/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/youtube_music/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/trophy/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/x_mark/v4/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/message_bubble_alert/v6/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_outline/refresh/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/news/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/subscriptions/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/flag/v6/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/check_circle/v8/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/clapperboard/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/clapperboard/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/home/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/trash_can/v5/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/unplugged_logo/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/audio/v5/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/library/v6/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/clock/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/message_bubble_alert/v6/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/subscriptions/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/arrow_down/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/play_arrow/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/arrow_up/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/arrow_down/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/my_videos/v6/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/arrow_up/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/library/v6/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/list_play_arrow/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/download/v9/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/download/v9/24px.svg" Pattern match: "fonts.gstatic.com/s/i/youtube_fill/list_play_arrow/v7/24px.svg" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5Bikz2SRVqI.es5.O/ck=boq-identity.AccountsSignInUi.h054YajHleE.L.W.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/home/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/chevron_left/v8/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/flag/v6/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/chevron_down/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/chevron_right/v4/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/volume-up/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/chevron_up/v6/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/copy/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/bars_3/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/bars_3/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/pause/v6/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/offline_download/v1/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_outline/keyboard-arrow-up/v1/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/play-arrow/v1/24px.svg" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5Bikz2SRVqI.es5.O/ck=boq-identity.AccountsSignInUi.h054YajHleE.L.W.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEml" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5Bikz2SRVqI.es5.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEWxJh2X2eTkMcHjarL7EJ8Tp6etA/m=_b,_tp" Pattern match: "assets.db/MANIFEST-0000012023/10/09-08:13:04.702" Pattern match: "www.youtube.com/s/desktop/7c155e84/jsbin/desktop_polymer_enable_wil_icons.vflset/desktop_polymer_enable_wil_icons.js" Pattern match: "www.youtube.com/s/desktop/7c155e84/jsbin/web-animations-next-lite.min.vflset/web-animations-next-lite.min.js" Pattern match: "www.youtube.com/s/desktop/7c155e84/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js" Pattern match: "www.youtube.com/s/desktop/7c155e84/jsbin/intersection-observer.min.vflset/intersection-observer.min.js" Pattern match: "www.youtube.com/s/desktop/7c155e84/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.js" Pattern match: "www.youtube.com/s/desktop/7c155e84/jsbin/webcomponents-sd.vflset/webcomponents-sd.js" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3i7M54/yn/l/en_US/WW_dM8tCcty.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "www.youtube.com/s/desktop/7c155e84/jsbin/www-tampering.vflset/www-tampering.js" Pattern match: "www.youtube.com/s/player/4a66ccde/player_ias.vflset/en_US/inline_preview.js" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yi/r/K1u8FojW_L0.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "www.youtube.com/s/player/4a66ccde/player_ias.vflset/en_US/endscreen.js" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yO/r/_tJ17sGyxOX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yd/r/D8yA-TXiNuk.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yh/r/bpW4eEg-2_W.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yt/r/d4QqVJOdC1V.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yo/r/j5B70NmINXl.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/ye/r/yUtEQ4ajXZI.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yf/r/LgvwffuKmeX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yF/r/FLJXkx8ys-6.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yI/r/8iBPf52GdU5.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yn/r/FQIPxzEyFvX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yk/r/kg_LcWkMBGy.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/ys/r/_f5wO_K1viW.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yF/r/gb_2sOlx922.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yr/r/6XlDJXhMTmo.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yi/r/VaHNVNii56Z.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yb/r/X98p6omdveu.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "www.youtube.com/s/player/4a66ccde/player_ias.vflset/en_US/heartbeat.js" Pattern match: "www.youtube.com/s/desktop/7c155e84/jsbin/scheduler.vflset/scheduler.js" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yA/r/gYsh5OsZKde.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "www.youtube.com/s/player/4a66ccde/player_ias.vflset/en_US/captions.js" Pattern match: "www.google.com/js/th/SV9xGv9l369-yJpDSQfn452IpcldLTWssACyMs72qKc.js" Pattern match: "www.youtube.com/s/desktop/7c155e84/jsbin/network.vflset/network.js" Pattern match: "www.youtube.com/s/player/4a66ccde/player_ias.vflset/en_US/base.js" Pattern match: "www.youtube.com/s/desktop/7c155e84/jsbin/spf.vflset/spf.js" Pattern match: "www.gstatic.com/eureka/clank/107/cast_sender.js" Pattern match: "www.gstatic.com/cv/js/sender/v1/cast_sender.js" Pattern match: "www.youtube.com/https://www.youtube.com/" Heuristic match: "accounts.google.com" Heuristic match: "arc.msn.com" Heuristic match: "connect.facebook.net" Heuristic match: "facebook.com" Heuristic match: "fbcdn.net" Heuristic match: "fbsbx.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "googleads.g.doubleclick.net" Heuristic match: "i.ytimg.com" Heuristic match: "i2.ytimg.com" Heuristic match: "jnn-pa.googleapis.com" Heuristic match: "play.google.com" Heuristic match: "r3---sn-ab5l6nrr.googlevideo.com" Heuristic match: "rr1---sn-nx5s7nel.googlevideo.com" Heuristic match: "rr5---sn-o097znsr.googlevideo.com" Heuristic match: "rr5---sn-o097znss.googlevideo.com" Heuristic match: "rr5---sn-o097znzd.googlevideo.com" Heuristic match: "static.doubleclick.net" Heuristic match: "static.xx.fbcdn.net" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Pattern match: "www.youtube.com" Heuristic match: "youtube.com" Heuristic match: "yt3.ggpht.com" Heuristic match: "*=.BT" Pattern match: "https://accounts.google.com" Pattern match: "https://www.youtube.com" Pattern match: "http://www.w3.org/2000/svg\" Pattern match: "Math.PI/180" Pattern match: "https://www.gstatic.com/youtube/img/creator/posts/Lottie_QuizCorrect_LightTheme_01a.json,renderer:svg},FXb,{rendererSettings:{viewBoxOnly:!0,viewBoxSize:12" Pattern match: "https://www.gstatic.com/youtube/img/creator/posts/Lottie_QuizCorrect_DarkTheme_01a.json,this.baseIncorrectLottiePlayerAnimationConfig.path=https://www.gstatic.com/youtube/img/creator/posts/Lottie_QuizIncorrect_DarkTheme_01a.json" Pattern match: "https://www.gstatic.com/youtube/img/lottie/subscribe_action/subscribe_action_container_+" Pattern match: "https://www.gstatic.com/youtube/img/lottie/subscribe_action/subscribe_action_sparkle_+" Pattern match: "https://www.google.com/recaptcha/api.js?trustedtypes=true" Pattern match: "www.ads.eventcache.getLastCompanionData" Pattern match: "https://www.gstatic.com/youtube/img/handles/handles_squiggle_1_dark_v1.svg;a.rightSquigglyLight=https://www.gstatic.com/youtube/img/handles/handles_squiggle_1_light_v1.svg;a.leftSquigglyDark=https://www.gstatic.com/youtube/img/handles/handles_squiggle_" Pattern match: "https://www.gstatic.com/youtube/img/handles/handles_squiggle_4_dark.svg;a.image0LightSquigglyBackground=https://www.gstatic.com/youtube/img/handles/handles_squiggle_4_light.svg;a.image1DarkSquigglyBackground=https://www.gstatic.com/youtube/img/handles/" Pattern match: "https://www.gstatic.com/youtube/img/handles/handles_squiggle_5_dark.svg;a.image3LightSquigglyBackground=https://www.gstatic.com/youtube/img/handles/handles_squiggle_5_light_v2.svg;a.image0SquigglyBackground=a.image0LightSquigglyBackground;a.image1Squigg" Pattern match: "https://+lA" Pattern match: "https://www.gstatic.com/youtube/img/handles/handles_curl_section_illustration_dark_v1.svg;a.JSC$14462_squigglyBackgroundLight=https://www.gstatic.com/youtube/img/handles/handles_curl_section_illustration_light_v1.svg;a.actionMap={yt-dark-mode-toggled-a" Pattern match: "https://www.gstatic.com/youtube/img/handles/handles_squiggle_3_dark.svg;a.JSC$14465_squigglyBackgroundLight=https://www.gstatic.com/youtube/img/handles/handles_squiggle_3_light.svg;a.squigglyBackground=a.JSC$14465_squigglyBackgroundLight;a.actionMap={y" Pattern match: "http://i1.ytimg.com/vi/+b+/maxresdefault.jpg;a.playerElement.loadVideoWithPlayerVars({video_id:b,iurlhq:c});fa(d)" Pattern match: "http://www.w3.org/2000/svg},J(line,{x1:22,y1:2,x2:11,y2:13}),J" Pattern match: "https://b.corp.google.com/issues/new?component=1382089&template=1853465" Pattern match: "www.ads.eventcache.getLastUpdateEngagementPanelAction" Pattern match: "https://www.gstatic.com/youtube/img/useredu/smart_downloads_optin_banner.svg" Pattern match: "https://www.youtube.com/howyoutubeworks/product-features/search/" Pattern match: "www.ads&&ua.yt.www.ads.eventcache&&ua.yt.www.ads.eventcache.getLastCompanionData?ua.yt.www.ads.eventcache.getLastCompanionData():null" Pattern match: "https://schema.org,@type:VideoObject,description:lA(a.description),duration:PT+(a.lengthSeconds||0)+S,embedUrl:a.embed?a.embed.iframeUrl:,interactionCount:a.viewCount,name:lA(a.title),thumbnailUrl" Pattern match: "static.doubleclick.net/instream/ad_status.js,b" Pattern match: "https://i.ytimg.com/vi/+a+/frame0.jpg" Pattern match: "https://www.gstatic.com/youtube/img/labs/early_access_web_background_expanded_2x.png;a.headerBackgroundDark=https://www.gstatic.com/youtube/img/labs/early_access_web_background_expanded_dark_2x.png;a.actionMap={yt-dark-mode-toggled-action:onDarkModeT" Pattern match: "https://www.gstatic.com/images/icons/material/system/1x/local_shipping_grey600_48dp.png;a.shippingAddressIcon=https://www.gstatic.com/images/icons/material/system/1x/location_on_grey600_48dp.png;a.googleGuaranteeIcon=https://www.gstatic.com/images/icon" Pattern match: "https://www.google-analytics.com/analytics.js" Pattern match: "http://www.w3.org/2000/svg,use" Pattern match: "www.gstatic.com/eureka/clank/+a+/cast_sender.js" Pattern match: "www.gstatic.com/cast/sdk/libs/sender/1.0/cast_framework.js,NMc,c" Pattern match: "www.gstatic.com/eureka/clank/cast_sender.js" Pattern match: "https://myaccount.google.com,https://myaccount-dev.corp.google.com,https://myaccount-daily-0.corp.google.com,https://myaccount-daily-1.corp.google.com,https://myaccount-autopush.corp.google.com" Pattern match: "https://oauth-redirect.googleusercontent.com,https://oauth-redirect-sandbox.googleusercontent.com,https://oauth-redirect-test.googleusercontent.com" Pattern match: "https://apis.google.com/js/api.js" Pattern match: "https://+a+/signedin+" Pattern match: "https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_36dp.png:https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_36dp.png;e.style.height=72px;e.style.width=" Pattern match: "https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_24dp.png:https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_24dp.png;b.style.display=block;b.style.heigh" Pattern match: "http://+this.original_.substring(this.originalPrefix_.length)" Pattern match: "www.google.com/images/cleardot.gif" Pattern match: "https://www.gstatic.com/cv/js/sender/v1/cast_sender.js" Pattern match: "https://embeddedassistant-webchannel.googleapis.com/google.assistant.embedded.v1.EmbeddedAssistant/YTAssist/channel===b||https://embeddedassistant-clients6.youtube.com/google.assistant.embedded.v1.EmbeddedAssistant/YTAssist/channel===" Pattern match: "https://embeddedassistant-frontend-webchannel.googleapis.com/google.assistant.embedded.v1.EmbeddedAssistant/YTAssist/channel===b||https://embeddedassistant-frontend-clients6.youtube.com/google.assistant.embedded.v1.EmbeddedAssistant/YTAssist/channel===b" Pattern match: "https://embeddedassistant-webchannel.googleapis.com/google.assistant.embedded.v1.EmbeddedAssistant/YTAssist/channel;G(kevlar_voice_search_auth_enabled)||G(kevlar_voice_search_use_yt_endpoint)?a=https://embeddedassistant-frontend-clients6.youtube.com/" Pattern match: "https://www.googletagmanager.com/ns.html?id=GTM-5KBDVVN\" Pattern match: "https://www.googletagmanager.com/ns.html?id=GTM-TGBSZFB\" Pattern match: "www.masthead.searchbox.initPolymer" Pattern match: "https://+(e?www.youtube-nocookie.com:this.embedHost_)+/embed/+h;a.clipId&&(m.push(clip=+a.clipId),m.push(clipt=+a.clipTiming));m=0" Pattern match: "www.youtube.com;expires=Thu" Pattern match: "http://go/join-youtube-web" Pattern match: "http://www.w3.org/2000/svg,svg" Pattern match: "http://www.w3.org/2000/svg,defs" Pattern match: "assets.db/MANIFEST-000001" Pattern match: "assets.db/000003.log" Pattern match: "www.youtube.com\//g" Pattern match: "https://www.youtube.com/error_204?t=jserror&level=ERROR" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/img/favicon.ico" Pattern match: "https://i.ytimg.com/generate_204" Pattern match: "https://www.youtube.com/s/desktop/7c155e84/cssbin/www-main-desktop-watch-page-skeleton.css" Pattern match: "www.youtube.com/s/desktop/7c155e84/jsbin/www-searchbox.vflset/www-searchbox.jsÅÃPÞÀ2-#Ôñ$S8¨`*L`$Sy`¬L`Ò½RbÄáÊ@àc" Pattern match: "www.youtube.com/s/desktop/7c155e84/jsbin/www-searchbox.vflset/www-searchbox.jsP2-#$S8`*L`$Sy`L`Rb@c" Pattern match: "www.youtube.com/s/desktop/7c155e84/jsbin/www-searchbox.vflset/www-searchbox.jsaD`D`D`-A`IY$SL`PL`iDm" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "http://www.w3.org/1999/xhtml" Pattern match: "www.google.com/support/websearch/bin/answer.py?hl=E" Pattern match: "www.google.com/textinputassistantI=`H" Pattern match: "www.gstatic.com/inputtools/imagesiQcmfixed" Heuristic match: "H`PP@uc@>$S`@L`8Rba`Da0XDQo3 6debug_handle_relative_url_for_query_forward_killswitchU% Qf6g4|youtube-nocookie.com" Pattern match: "www.youtube-nocookie.comQeJ" Pattern match: "www.google.com/textinputassistant/RQcR" Pattern match: "www.masthead.searchbox.init4QkT%yt.www.masthead.searchbox.initPolymer8Kl`!!IiUeme+i&1AiDee%%%%%" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.itxXp8cph_Q.L.B1.O/am=DoCfiJnHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/ed=1/rs=AOaEmlHWGNRLnwyFXvV3t6JmKckErWLe_Q/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5Bikz2SRVqI.es5.O/am=DoCfiJnHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlGz13KoY8w4veCAVSzCDSLSfnEmvA/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Heuristic match: "ht;_s_/:/nnm.y0utube.com" Heuristic match: "1t;_s_;.nnm.y0utubg.com" Pattern match: "http://www.w3.org/2001/XMLSchema-instance"51:T1373,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000272.00000001.71665.00940000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001224.00000000.69801.00FC0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001224.00000001.71718.00FC0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001352.00000000.69839.02A90000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001352.00000001.71758.02A90000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001520.00000000.69875.03320000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001520.00000001.71795.03320000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportackup.0.0.0.0.0.0nmerngac:\programdata\microsoft\windows" - Source: "00000000-00001628.00000000.69912.02F70000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001628.00000000.69912.03000000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00001628.00000000.69912.70D21000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00001628.00000000.69912.70D21000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00001628.00000000.69912.70D21000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00001628.00000000.69912.70DC1000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002440.00000000.73366.02A50000.00000004.mdmp") Found URL "https://accountsle.comstart" - Source: "00000000-00002440.00000000.73366.04880000.00000004.mdmp") Found URL "https://www.fak.com/loginstart" - Source: "00000000-00002440.00000000.73366.04880000.00000004.mdmp") Found URL "https://wutube.com" - Source: "00000000-00002440.00000000.73366.04880000.00000004.mdmp") Found URL "https://accounts.google.comstart" - Source: "00000000-00002440.00000000.73366.048C0000.00000004.mdmp") Found URL "https://www.facebook.com/loginstart" - Source: "00000000-00002440.00000000.73366.048C0000.00000004.mdmp") Found URL "https://www.youtube.com" - Source: "00000000-00002440.00000000.73366.048C0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006656.00000000.70348.009B0000.00000004.mdmp") Found URL "http://5.42.92.211/loghub/masterf0c5370e816e2397711946" - Source: "00000000-00006656.00000000.70348.0132B000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006656.00000001.72269.009B0000.00000004.mdmp") Found URL "http://5.42.92.211/loghub/masterf0c5370e816e2397711946" - Source: "00000000-00006656.00000001.72269.0132B000.00000004.mdmp")52:T1506,Found HTTPS GET request to https://api.edgeoffer.microsoft.com/edgeoffer/experiments?appId=edge-extensions&country=US Found HTTPS GET request to https://api.edgeoffer.microsoft.com/edgeoffer/paths/facebook.com?appId=edge-extensions&country=US Found HTTPS POST request to https://rr5---sn-o097znsr.googlevideo.com/videoplayback?expire=1696885855&ei=_xckZfiBJfCQsfIPlZen-AI&ip=67.218.111.202&id=o-AHGjDxYQSSAjVzO49QWlava0KCcxCEZG3FjX_W9xwt2g&itag=243&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278%2C394%2C395%2C396%2C397%2C398%2C399&source=youtube&requiressl=yes&mh=Qr&mm=31%2C26&mn=sn-o097znsr%2Csn-nx5s7nel&ms=au%2Conr&mv=m&mvi=5&pl=19&initcwndbps=1082500&spc=UWF9f9kuloWg9sEf4AjtaoTT1tREnjI&vprv=1&svpuc=1&mime=video%2Fwebm&ns=945YE94x6lV-l60biw9R49MP&gir=yes&clen=774770&dur=30.030&lmt=1649277802123995&mt=1696863920&fvip=1&keepalive=yes&fexp=24007246&beids=24350018&c=WEB&txp=4535434&n=WpXY81jxVqV5bA&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AGM4YrMwRgIhAJwXctPVSSDG7wXTbmcAcsOEaMuC1HREkUCsedCjUfhoAiEA7KQ4AabMdicNkO5vAnQhus5-nQvhTOUP-WPjK7h-M5o%3D&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AK1ks_kwRgIhAPdS1ehfqZ6UEInb1U5I83JCLotYfHhgX8jQLexEVuaWAiEAujBPPhY8K8VznU1LbwBVR9Q3kKfvc6QVg3QZo0kweBo%3D&alr=yes&cpn=E1QJU7_BiXW5AObf&cver=2.20231003.02.02&range=0-78921&rn=5&rbuf=0&pot=IjJwkXCQFbVoTDP2BKMlxBTpPfwI-iTFJuc_0hrhAqQz4TL7Odgz9jrHJek50jf2MbRD1Q==&ump=1&srfvp=1 Found HTTPS POST request to https://rr5---sn-o097znsr.googlevideo.com/videoplayback?expire=1696885855&ei=_xckZfiBJfCQsfIPlZen-AI&ip=67.218.111.202&id=o-AHGjDxYQSSAjVzO49QWlava0KCcxCEZG3FjX_W9xwt2g&itag=251&source=youtube&requiressl=yes&mh=Qr&mm=31%2C26&mn=sn-o097znsr%2Csn-nx5s7nel&ms=au%2Conr&mv=m&mvi=5&pl=19&initcwndbps=1082500&spc=UWF9f9kuloWg9sEf4AjtaoTT1tREnjI&vprv=1&svpuc=1&mime=audio%2Fwebm&ns=945YE94x6lV-l60biw9R49MP&gir=yes&clen=505837&dur=30.061&lmt=1649274070641120&mt=1696863920&fvip=1&keepalive=yes&fexp=24007246&beids=24350018&c=WEB&txp=4532434&n=WpXY81jxVqV5bA&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AGM4YrMwRQIhAKmq3wGRwFYWRYIqoQsZbj2q8jNomce-TfYYLkpAQgpsAiAMIKtubwK5lkeh4WROcAVSlAaKaD6iV905tAltaDXxqA%3D%3D&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AK1ks_kwRgIhAPdS1ehfqZ6UEInb1U5I83JCLotYfHhgX8jQLexEVuaWAiEAujBPPhY8K8VznU1LbwBVR9Q3kKfvc6QVg3QZo0kweBo%3D&alr=yes&cpn=E1QJU7_BiXW5AObf&cver=2.20231003.02.02&range=0-65868&rn=6&rbuf=0&pot=IjIfIR8gegUH_FxGaxNKdHtZUkxnSkt1SVdQYnVRbRRcUV1LVmhcRlV3SllWYlhGXgQsZQ==&ump=1&srfvp=1 Found HTTPS POST request to https://rr5---sn-o097znss.googlevideo.com/videoplayback?expire=1696885857&ei=ARgkZaSxENWlsfIP2fGn0A8&ip=67.218.111.202&id=o-ANgYvw-tOlNlzJOKBm_YhMsqCVDN9QLaksfEFAR9vvNE&itag=243&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278%2C394%2C395%2C396%2C397%2C398%2C399&source=youtube&requiressl=yes&mh=T_&mm=31%2C26&mn=sn-o097znss%2Csn-nx5s7n76&ms=au%2Conr&mv=m&mvi=5&pl=19&initcwndbps=1082500&spc=UWF9f20zD0Yde1V82XCLSyDmtTV68YtP4jGM_EwDNw&vprv=1&svpuc=1&mime=video%2Fwebm&ns=JU2kCry4ba4e9VmGnl9zL5oP&gir=yes&clen=39675523&dur=1309.957&lmt=1696554016752314&mt=1696863920&fvip=2&keepalive=yes&fexp=24007246&beids=24350018&c=WEB&txp=4535434&n=vKiuE1jciy2fLQ&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AGM4YrMwRAIgZTeZM29OztWoGnC4_JGiVW8giMjzD7C9QQFA9TxA7WYCIGpXAvwatThp7VBrc5mcQnqbN914NJMRJsKXyRi9klD9&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AK1ks_kwRQIgbWUGM8iwWTPNE-wGjs_k2E5dNWrzZNUMX2tQ9bp_ltACIQDdQtGbX6KwcA8RaKWwx4ujprWiFL2pVcLSmsuZvwWTWw%3D%3D&alr=yes&cpn=j-JZbWAx1ewlz3OF&cver=2.20231003.02.02&range=0-108418&rn=51&rbuf=0&pot=Mm5Zwg6HJWBSGVn6f4692gR0Nyzj81dMoRZI1PkBPZFkTPcUsTxpakiGbvXyl-49JVyu14KraFcNLlQT_iYHP-MQJsa4uRko5DIoQSmn9JC1NkZlmFr9A-W3G1aKYx2BjDBcCp66Mk1vwYytqVjhgw==&ump=1&srfvp=1&altitags=242%2C278 Found HTTPS POST request to https://rr5---sn-o097znsr.googlevideo.com/videoplayback?expire=1696885855&ei=_xckZfiBJfCQsfIPlZen-AI&ip=67.218.111.202&id=o-AHGjDxYQSSAjVzO49QWlava0KCcxCEZG3FjX_W9xwt2g&itag=243&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278%2C394%2C395%2C396%2C397%2C398%2C399&source=youtube&requiressl=yes&mh=Qr&mm=31%2C26&mn=sn-o097znsr%2Csn-nx5s7nel&ms=au%2Conr&mv=m&mvi=5&pl=19&initcwndbps=1082500&spc=UWF9f9kuloWg9sEf4AjtaoTT1tREnjI&vprv=1&svpuc=1&mime=video%2Fwebm&ns=945YE94x6lV-l60biw9R49MP&gir=yes&clen=774770&dur=30.030&lmt=1649277802123995&mt=1696863920&fvip=1&keepalive=yes&fexp=24007246&beids=24350018&c=WEB&txp=4535434&n=WpXY81jxVqV5bA&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AGM4YrMwRgIhAJwXctPVSSDG7wXTbmcAcsOEaMuC1HREkUCsedCjUfhoAiEA7KQ4AabMdicNkO5vAnQhus5-nQvhTOUP-WPjK7h-M5o%3D&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AK1ks_kwRgIhAPdS1ehfqZ6UEInb1U5I83JCLotYfHhgX8jQLexEVuaWAiEAujBPPhY8K8VznU1LbwBVR9Q3kKfvc6QVg3QZo0kweBo%3D&alr=yes&cpn=GP-sEvJUdY0T1x8Q&cver=2.20231003.02.02&range=0-78921&rn=56&rbuf=0&pot=Mm5Zwg6HJWBSGVn6f4692gR0Nyzj81dMoRZI1PkBPZFkTPcUsTxpakiGbvXyl-49JVyu14KraFcNLlQT_iYHP-MQJsa4uRko5DIoQSmn9JC1NkZlmFr9A-W3G1aKYx2BjDBcCp66Mk1vwYytqVjhgw==&ump=1&srfvp=1&altitags=242%2C27853:T820,"NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00000272) "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" called "FindNextFileA" with parameter .. (UID: 00000000-00000272) "Nx1xl66.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00001224) "Nx1xl66.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00001224) "UD5yq11.exe" called "FindFirstFileA" with parameter %TEMP%\IXP002.TMP\* (UID: 00000000-00001352) "UD5yq11.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00001352) "GX1TQ77.exe" called "FindFirstFileA" with parameter %TEMP%\IXP003.TMP\* (UID: 00000000-00001520) "GX1TQ77.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00001520) "1we14Nh5.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001628) "1we14Nh5.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00001628) "1we14Nh5.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001628) "1we14Nh5.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00001628) "1we14Nh5.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00001628) "1we14Nh5.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001628) "1we14Nh5.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001628) "1we14Nh5.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001628) "1we14Nh5.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00001628) "1we14Nh5.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00001628) "1we14Nh5.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00001628) "1we14Nh5.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00001628)54:T9f7,Found string "aeS6\~S" (Indicator: "aes"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") file/memory contains long string with (Indicator: "aes"; File: "042558f185977c37_1") file/memory contains long string with (Indicator: "chacha"; File: "7cb798dc066a740f_1") file/memory contains long string with (Indicator: "aes"; File: "7a5c2de1-1fce-4b94-9c76-e1ccd11667e3.tmp") file/memory contains long string with (Indicator: "aes"; File: "90f13fe0332b1ec3_0") file/memory contains long string with (Indicator: "aes"; File: "f0bf847b72e9be52_0") file/memory contains long string with (Indicator: "aes"; File: "99fcc45af9bdb7c3_0") file/memory contains long string with (Indicator: "aes"; File: "ab833005514b90ae_0") file/memory contains long string with (Indicator: "aes"; File: "bf28156a9f893413_0") file/memory contains long string with (Indicator: "aes"; File: "6ded268f137f0645_0") file/memory contains long string with (Indicator: "aes"; File: "0993e4fd7514ce03_0") file/memory contains long string with (Indicator: "aes"; File: "c69025f7ccf55c6a_0") file/memory contains long string with (Indicator: "base64"; File: "0") Found string "f.isImageAvailable=function(a){return!(!a.src||"data:image/gif;base64 R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7"===a.src||120===a.naturalWidth)};" (Indicator: "base64"; File: "0") Found string "e?(e=JSON.parse(e).encryptedBlobId,b.encryptedBlobId=e,c(b)):d("upload failed")});" (Indicator: ".encrypt"; File: "0") file/memory contains long string with (Indicator: ".encrypt"; File: "0") Found string "isValidPrefilledImage_:function(a,b,c){return"BACKSTAGE_POST_DIALOG_PURPOSE_CREATE"===a&&void 0!==b&&null!==b.encryptedBlobId&&null!==b.sourceExternalVideoId&&void 0!==c&&null!==c.backstageImageRenderer}," (Indicator: ".encrypt"; File: "0") Found string "this.hostElement.addEventListener("yt-action",function(b){if("yt-service-request"===b.detail.actionName){var c=b.detail.args[1];c.videoMastheadAdMuteCommand&&(a.collapseAd(c.videoMastheadAdMuteCommand.encryptedMastheadId),b.stopPropagation())}})};" (Indicator: ".encrypt"; File: "0") Found string "f.parseAndSetUint64Base64Option_=function(a,b,c,d,e){if(""==b)return 0;TRc(a,b,c,d,e,function(h){return h?1:0});" (Indicator: "base64"; File: "0") Found string "f.handleImageUpdatedAction=function(a,b){this.hideContainer=!1;this.previewDataUrl=a;this.encryptedBlobId=b};" (Indicator: ".encrypt"; File: "0") file/memory contains long string with (Indicator: "base64"; File: "6869067474079f11_1")55:T7e3,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "1we14Nh5.exe.870265966") Found reference to API "Module32Next" (Indicator: "Module32Next"; File: "1we14Nh5.exe.870265966") Found reference to API "Module32First" (Indicator: "Module32First"; File: "1we14Nh5.exe.870265966") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "1we14Nh5.exe.870265966") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "1we14Nh5.exe.870265966") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "1we14Nh5.exe.870265966") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "2ZU6518.exe.3341049836") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp")56:T6fb,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp")57:T45e,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp")58:Td26,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp")59:T5ce,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "1we14Nh5.exe.870265966") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "1we14Nh5.exe.870265966") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp")5a:T445,Found string "\Device\HarddiskVolume2\" (Indicator: "\Device\"; Source: "00000000-00000272.00000000.69745.00518000.00000004.mdmp, 00000000-00000272.00000001.71665.00518000.00000004.mdmp, 00000000-00000272.00000002.73585.00518000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found string "\Device\HarddiskVolume2\NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Indicator: "\Device\"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp")5b:T55c,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp")5c:T853,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000272.00000000.69745.01111000.00000020.mdmp, 00000000-00000272.00000001.71665.01111000.00000020.mdmp, 00000000-00000272.00000002.73585.01111000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000272.00000000.69745.01111000.00000020.mdmp, 00000000-00000272.00000001.71665.01111000.00000020.mdmp, 00000000-00000272.00000002.73585.01111000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp")5d:Ta49,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00000272.00000000.69745.00940000.00000004.mdmp, 00000000-00000272.00000001.71665.00940000.00000004.mdmp, 00000000-00000272.00000002.73585.00940000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00000272.00000000.69745.0111A000.00000002.mdmp, 00000000-00000272.00000001.71665.0111A000.00000002.mdmp, 00000000-00000272.00000002.73585.0111A000.00000002.mdmp")5e:T46d,"5Mn4LS8.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "CA72ADB2C2FAD90100000000000000000000000002000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "B8BD46DEC2FAD90100000000000000000000000002000000"), "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "89F6A4B6C2FAD90100000000000000000000000002000000"), "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "9499281FC3FAD90100000000000000000000000002000000")5f:Tc43,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Nx1xl66.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Nx1xl66.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Nx1xl66.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Nx1xl66.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Nx1xl66.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: UD5yq11.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: UD5yq11.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: UD5yq11.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: UD5yq11.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: UD5yq11.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: GX1TQ77.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: GX1TQ77.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: GX1TQ77.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: GX1TQ77.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: GX1TQ77.exe]60:Te8a,"NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\NX1XL66.EXE"; Value: "") "NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\5MN4LS8.EXE"; Value: "") "Nx1xl66.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\UD5YQ11.EXE"; Value: "") "Nx1xl66.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\4ZP552KB.EXE"; Value: "") "UD5yq11.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\GX1TQ77.EXE"; Value: "") "UD5yq11.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\3TB05QC.EXE"; Value: "") "GX1TQ77.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\1WE14NH5.EXE"; Value: "") "GX1TQ77.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\2ZU6518.EXE"; Value: "") "2ZU6518.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINHTTPAUTOPROXYSVC\PARAMETERS"; Key: "PROXYDLLFILE"; Value: "") "2ZU6518.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "2ZU6518.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "2ZU6518.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "2ZU6518.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "2ZU6518.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "2ZU6518.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "2ZU6518.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "2ZU6518.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "2ZU6518.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "2ZU6518.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "")61:T4ba,"Nx1xl66.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Nx1xl66.exe]- [targetUID: 00000000-00001224] "UD5yq11.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\UD5yq11.exe]- [targetUID: 00000000-00001224] "4zp552KB.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\4zp552KB.exe]- [targetUID: 00000000-00001224] "GX1TQ77.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\GX1TQ77.exe]- [targetUID: 00000000-00001520] "3TB05qc.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\3TB05qc.exe]- [targetUID: 00000000-00007060] "1we14Nh5.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1we14Nh5.exe]- [targetUID: 00000000-00001628] "2ZU6518.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\2ZU6518.exe]- [targetUID: 00000000-00006656] "5Mn4LS8.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\5Mn4LS8.exe]- [targetUID: 00000000-00000272]62:T13d0,Dropped file: "1we14Nh5.exe.log" - Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\1we14Nh5.exe.log]- [targetUID: 00000000-00001628] Dropped file: "f_0004c7" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c7]- [targetUID: 00000000-00004104] Dropped file: "6869067474079f11_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\6869067474079f11_1]- [targetUID: 00000000-00007748] Dropped file: "000003.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00007748] Dropped file: "0a41c5226f4ea45c_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\0a41c5226f4ea45c_0]- [targetUID: 00000000-00007748] Dropped file: "6869067474079f11_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\6869067474079f11_0]- [targetUID: 00000000-00007748] Dropped file: "21ae8dee7b304990_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\21ae8dee7b304990_1]- [targetUID: 00000000-00007748] Dropped file: "f_0004d7" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004d7]- [targetUID: 00000000-00004104] Dropped file: "0ae129c33e7a30bd_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\0ae129c33e7a30bd_0]- [targetUID: 00000000-00007748] Dropped file: "042558f185977c37_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\042558f185977c37_0]- [targetUID: 00000000-00007748] Dropped file: "7cb798dc066a740f_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\7cb798dc066a740f_1]- [targetUID: 00000000-00007748] Dropped file: "f_0004cc" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cc]- [targetUID: 00000000-00004104] Dropped file: "21ae8dee7b304990_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\21ae8dee7b304990_0]- [targetUID: 00000000-00007748] Dropped file: "79faff66e6e23f2b_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\79faff66e6e23f2b_1]- [targetUID: 00000000-00007748] Dropped file: "604fd825a3b68faa_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\604fd825a3b68faa_1]- [targetUID: 00000000-00007748] Dropped file: "f_0004c3" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c3]- [targetUID: 00000000-00004104] Dropped file: "9fe81b27-50de-487e-a281-3878ccf6a361.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\9fe81b27-50de-487e-a281-3878ccf6a361.tmp]- [targetUID: 00000000-00007748] Dropped file: "04acc2fd-a054-49ea-be6c-dc7828bf25e7.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\04acc2fd-a054-49ea-be6c-dc7828bf25e7.tmp]- [targetUID: 00000000-00007748] Dropped file: "35b04f8d-44d5-419e-9765-0a17af979ada.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\35b04f8d-44d5-419e-9765-0a17af979ada.tmp]- [targetUID: 00000000-00007748] Dropped file: "3" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.blob\2\00\3]- [targetUID: 00000000-00007748] Dropped file: "2" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.blob\2\00\2]- [targetUID: 00000000-00007748] Dropped file: "7cb798dc066a740f_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\7cb798dc066a740f_0]- [targetUID: 00000000-00007748] Dropped file: "f_0004d9" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004d9]- [targetUID: 00000000-00004104] Dropped file: "79faff66e6e23f2b_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5a6313ff-ad2d-4f0b-9f63-79b79c0580cb\79faff66e6e23f2b_0]- [targetUID: 00000000-00007748] Dropped file: "f_0004cd" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cd]- [targetUID: 00000000-00004104]63:T559,"NEAS.040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "Nx1xl66.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "UD5yq11.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "GX1TQ77.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1we14Nh5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1we14Nh5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "2ZU6518.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "3TB05qc.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "4zp552KB.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "5Mn4LS8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1")64:T4001,"initAft()