24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 66:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T467,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 04b84c796631… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 04b84c796631…. Malware family: Malware. Threat score 100/100. 5/29 AV engines flagged this file. 12 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":5,"total":29},"behavioralIndicators":{"malicious":12,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T782,"04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "FindResourceA" with parameter "11866744" - (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "FindResourceA" with parameter "11866752" - (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "FindResourceA" with parameter "11866780" - (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "FindResourceA" with parameter "11866992" - (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "FindResourceA" with parameter "11866808" - (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "FindResourceA" with parameter "11866964" - (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "FindResourceA" with parameter "11866976" - (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "FindResourceA" with parameter "10745492" - (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "FindResourceA" with parameter "11866860" - (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "FindResourceA" with parameter "11866956" - (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "FindResourceA" with parameter "10745488" - (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "FindResourceA" with parameter "11866824" - (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "FindResourceA" with parameter "11866832" - (UID: 00000000-00000396)26:Tcce,"04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11913344'}" (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11913200'}" (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11913360'}" (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11913248'}" (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11913216'}" (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11913264'}" (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11913312'}" (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11913184'}" (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11913296'}" (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11913328'}" (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11913280'}" (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11913232'}" (UID: 00000000-00000396) "zb5lr61.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20564096'}" (UID: 00000000-00007536) "zb5lr61.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20563952'}" (UID: 00000000-00007536) "zb5lr61.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20564112'}" (UID: 00000000-00007536) "zb5lr61.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20564000'}" (UID: 00000000-00007536) "zb5lr61.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20563968'}" (UID: 00000000-00007536) "zb5lr61.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20564016'}" (UID: 00000000-00007536) "zb5lr61.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20564064'}" (UID: 00000000-00007536) "zb5lr61.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20563936'}" (UID: 00000000-00007536) "zb5lr61.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20564048'}" (UID: 00000000-00007536) "zb5lr61.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20564080'}" (UID: 00000000-00007536)27:T6aa,"04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP\ (UID: 00000000-00000396) "zb5lr61.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007536) "zb5lr61.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007536) "zb5lr61.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP\ (UID: 00000000-00007536) "Fp6XX19.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00000272) "Fp6XX19.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00000272) "Fp6XX19.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00000272) "Fp6XX19.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP\ (UID: 00000000-00000272) "vV4ug45.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00006584) "vV4ug45.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00006584) "vV4ug45.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00006584) "vV4ug45.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00006584) "vV4ug45.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP\ (UID: 00000000-00006584) "zSB8Oz6.exe" called "RemoveDirectoryW" with parameter %TEMP%\DB6E.tmp\DB6F.tmp\ (UID: 00000000-00007236) "zSB8Oz6.exe" called "RemoveDirectoryW" with parameter %TEMP%\DB6E.tmp (UID: 00000000-00007236)28:T4c3,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp")29:T456,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp")2a:T1318,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000396-37054-14-00B5681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000396-37054-14-00B5681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000396-37054-18-00B524E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000396-37054-18-00B524E0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00000396-37054-23-00B52390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00000396-37054-23-00B52390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000396-37054-5-00B51F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000396-37054-5-00B51F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000396-37054-21-00B552B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000396-37054-21-00B552B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000396-37054-8-00B544B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000396-37054-8-00B544B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007536-39659-44-01394EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007536-39659-44-01394EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007536-39659-29-01393FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007536-39659-29-01393FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007536-39659-34-0139202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00007536-39659-34-0139202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007536-39659-34-0139202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007536-39659-33-01396495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007536-39659-33-01396495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007536-39659-21-013952B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007536-39659-21-013952B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007536-39659-54-013955A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007536-39659-54-013955A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007536-39659-25-01392F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007536-39659-25-01392F1D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007536-39659-8-013944B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007536-39659-8-013944B9 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00007536-39659-23-01392390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00007536-39659-23-01392390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007536-39659-32-01392267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007536-39659-32-01392267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007536-39659-69-01392773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007536-39659-69-01392773 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007536-39659-49-01396298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007536-39659-49-01396298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007536-39659-70-01395C9E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007536-39659-70-01395C9E Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00007536-39659-28-01393BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00007536-39659-28-01393BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007536-39659-51-0139621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007536-39659-51-0139621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007536-39659-66-013936EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007536-39659-66-013936EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007536-39659-64-013918A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007536-39659-64-013918A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007536-39659-18-013924E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007536-39659-18-013924E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007536-39659-58-01392630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007536-39659-58-013926302b:T96e,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=bWmaZh6zlZa2UIbY5oPuContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=bWmaZh6zlZa2UIbY5oPuContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=bWmaZh6zlZa2UIbY5oPuContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=bWmaZh6zlZa2UIbY5oPuContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=bWmaZh6zlZa2UIbY5oPuContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=bWmaZh6zlZa2UIbY5oPuContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=bWmaZh6zlZa2UIbY5oPuContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=bWmaZh6zlZa2UIbY5oPuContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache"2c:T489,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: PCAP contains base64 strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]2d:T1b8d,"04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000396) "zb5lr61.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007536) "zb5lr61.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007536) "Fp6XX19.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000272) "Fp6XX19.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000272) "vV4ug45.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006584) "vV4ug45.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006584) "2560417.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007216) "2560417.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007216) "8917152.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006748)2e:T7a9,"04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "zb5lr61.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "zb5lr61.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Fp6XX19.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Fp6XX19.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "vV4ug45.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "vV4ug45.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2560417.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2560417.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "8917152.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "pt999MH.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "pt999MH.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "xZ74Qx7.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "xZ74Qx7.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")2f:T522,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "zSB8Oz6.exe.3888419208") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp")30:T60a,"04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\zb5lr61.exe" - (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\zSB8Oz6.exe" - (UID: 00000000-00000396) "zb5lr61.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\Fp6XX19.exe" - (UID: 00000000-00007536) "zb5lr61.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\xZ74Qx7.exe" - (UID: 00000000-00007536) "Fp6XX19.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\vV4ug45.exe" - (UID: 00000000-00000272) "Fp6XX19.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\pt999MH.exe" - (UID: 00000000-00000272) "vV4ug45.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\2560417.exe" - (UID: 00000000-00006584) "vV4ug45.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\8917152.exe" - (UID: 00000000-00006584) "zSB8Oz6.exe" called "CreateProcessW" with parameter ""%WINDIR%\sysnative\cmd" /c "%TEMP%\DB6E.tmp\DB6F.tmp\DB7F.bat %TEMP%\" - (UID: 00000000-00007236), "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login" - (UID: 00000000-00007280), "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/" - (UID: 00000000-00007280)31:T9d4,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.70256.00FF0000.00000004.mdmp, 00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp, 00000000-00000272.00000000.70256.03410000.00000004.mdmp, 00000000-00000272.00000000.70256.03640000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "MPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitz" (Indicator: "CreateProcess"; Source: "00000000-00000272.00000000.70256.03640000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000396.00000000.70161.00A60000.00000004.mdmp, 00000000-00000396.00000000.70161.03140000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp")32:T464,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp")33:Tbb81,Found reference to API (Indicator: "CheckTokenMembership"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "HeapSetInformation"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "DecryptFileA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "SHBrowseForFolder"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetTokenInformation"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "RegDeleteValueA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "RegOpenKeyExA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "FreeSid"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "OpenProcessToken"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "RegSetValueExA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "RegCreateKeyExA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "RegQueryValueExA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "EqualSid"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "RegCloseKey"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetShortPathNameA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetModuleFileNameA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "FindFirstFileA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetCurrentProcess"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "FindNextFileA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "FindClose"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "LocalAlloc"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "lstrcmpA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "CompareStringA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetLastError"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetFileAttributesA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "LoadLibraryA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "DeleteFileA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GlobalAlloc"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GlobalFree"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "CloseHandle"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "SetFileAttributesA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetProcAddress"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GlobalLock"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "LocalFree"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "RemoveDirectoryA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "FreeLibrary"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "CreateDirectoryA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GlobalUnlock"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "ReadFile"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "SizeofResource"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "WriteFile"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetDriveTypeA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "LoadLibraryExA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "SetFileTime"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "SetFilePointer"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "FindResourceA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "CreateMutexA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetVolumeInformationA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "WaitForSingleObject"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "FreeResource"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetVersion"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetTempPathA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "CreateFileA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "SetEvent"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "TerminateThread"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetVersionExA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "LockResource"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetSystemInfo"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "CreateThread"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "ResetEvent"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "LoadResource"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "ExitProcess"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetModuleHandleW"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "CreateProcessA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "FormatMessageA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetTempFileNameA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "CreateEventA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetExitCodeProcess"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetDeviceCaps"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetDesktopWindow"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "CharUpperA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "ExitWindowsEx"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "MessageBeep"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "CharPrevA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "LoadStringA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "CharNextA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "EnableWindow"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "ReleaseDC"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "SetForegroundWindow"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "PeekMessageA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "SendMessageA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "MessageBoxA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "SetWindowTextA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetWindowLongA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "CallWindowProcA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "SetWindowLongA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "ShowWindow"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "SetWindowPos"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetDC"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetWindowRect"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "DispatchMessageA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "VerQueryValueA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "Sleep"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetStartupInfoW"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "TerminateProcess"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetCurrentProcessId"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetCurrentThreadId"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetTickCount"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "MulDiv"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "GetSystemMetrics"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API (Indicator: "InitOnceExecuteOnce"; File: "zSB8Oz6.exe.3888419208") Found reference to API (Indicator: "RtlGetVersion"; File: "zSB8Oz6.exe.3888419208") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "zSB8Oz6.exe.3888419208") Found reference to API (Indicator: "GetLongPathNameW"; File: "zSB8Oz6.exe.3888419208") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "zSB8Oz6.exe.3888419208") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "zSB8Oz6.exe.3888419208") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "zSB8Oz6.exe.3888419208") Found reference to API (Indicator: "CreateFileW"; File: "zSB8Oz6.exe.3888419208") Found reference to API (Indicator: "TlsGetValue"; File: "zSB8Oz6.exe.3888419208") Found reference to API (Indicator: "TlsSetValue"; File: "zSB8Oz6.exe.3888419208") Found reference to API (Indicator: "SetLastError"; File: "zSB8Oz6.exe.3888419208") Found reference to API (Indicator: "UnregisterWait"; File: "zSB8Oz6.exe.3888419208") Found reference to API (Indicator: "GetCurrentThread"; File: "zSB8Oz6.exe.3888419208") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00000272.00000000.70256.00BF1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00000272.00000000.70256.00BF1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00000272.00000000.70256.00BF1000.00000020.mdmp") Found reference to API (Indicator: "SHBrowseForFolder"; Source: "00000000-00000272.00000000.70256.00BF8000.00000004.mdmp") Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "00000000-00000272.00000000.70256.00BF8000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00000272.00000000.70256.7F290000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00000396.00000000.70161.00B51000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00000396.00000000.70161.00B51000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00000396.00000000.70161.00B51000.00000020.mdmp") Found reference to API (Indicator: "SHBrowseForFolder"; Source: "00000000-00000396.00000000.70161.00B58000.00000004.mdmp") Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "00000000-00000396.00000000.70161.00B58000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp")34:T80a,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "LockResource" (Indicator: "LockResource"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp")35:Td54,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89 "DSystem\CurrentControlSet\Control\Session Manager" in Source: 04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89 "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89 "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89 "System\CurrentControlSet\Control\Session Manager" in Source: 33695-17-0040256D "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00000272.00000000.70256.00BF1000.00000020.mdmp "System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00000272.00000000.70256.00BF8000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00000272.00000000.70256.00BF8000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 00000000-00000272.00000000.70256.00BF8000.00000004.mdmp "8355-1207367261-1001\Software\Mi" in Source: 00000000-00000272.00000000.70256.01238000.00000004.mdmp "\Registry\MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide" in Source: 00000000-00000272.00000000.70256.03410000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00000272.00000000.70256.7F290000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00000272.00000000.70256.7F290000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00000272.00000000.70256.7F290000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00000272.00000000.70256.7F290000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00000272.00000000.70256.7F290000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00000272.00000000.70256.7F290000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00000272.00000000.70256.7F290000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00000272.00000000.70256.7F290000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00000272.00000000.70256.7F290000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00000272.00000000.70256.7F290000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00000272.00000000.70256.7F290000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00000272.00000000.70256.7F290000.00000002.mdmp "8355-1207367261-1001\Software\Mi" in Source: 00000000-00000396.00000000.70161.009F8000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00000396.00000000.70161.00B51000.00000020.mdmp "\jCSystem\CurrentControlSet\Control\Session Manager" in Source: 00000000-00000396.00000000.70161.00B58000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00000396.00000000.70161.00B58000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 00000000-00000396.00000000.70161.00B58000.00000004.mdmp36:T5a8,"04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "zb5lr61.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Fp6XX19.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "pt999MH.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "xZ74Qx7.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "vV4ug45.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2560417.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "8917152.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT37:T101e,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://accounts.google.com" (Indicator: "facebook.com"; File: "DB7F.bat") file/memory contains long string with (Indicator: "facebook.com"; File: "7faaeb6d807041bb_0") file/memory contains long string with (Indicator: "facebook.com"; File: "22a1dfae96f6cc61_0") file/memory contains long string with (Indicator: "facebook.com"; File: "8d5e1c410a09c25f_0") file/memory contains long string with (Indicator: "facebook.com"; File: "4945a7b4b1e84510_0") file/memory contains long string with (Indicator: "facebook.com"; File: "7b95d65eb18c490e_0") file/memory contains long string with (Indicator: "facebook.com"; File: "40701b42ebc1cb18_0") file/memory contains long string with (Indicator: "facebook.com"; File: "Social") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3i7M54/yM/l/en_US/LKOC0D0Ap0H.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/BEEE543BB8929876E886223DDDBF1A501648850F3D1D5F9FB85CCADC233E15F4" (Indicator: "facebook.com"; File: "ec69a14ae449823e_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3iqES4/yB/l/en_US/xWVLjJ40HKK.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/1E5580244BFA38EC8F1511A3A469B8100559BEB794C40347597681B94BB83BE5" (Indicator: "facebook.com"; File: "34a8c9e3ef19de93_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yo/r/j5B70NmINXl.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/C30AC59AB8639F206487278E10C20E96E29B98116D88D69B24F3462CF66F7670T8u" (Indicator: "facebook.com"; File: "2556f6e9598d5fb0_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yf/r/LgvwffuKmeX.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/DACBB518BCFA2D266452B3C9C67F95D247E33D43A4197EE4F0E905A8782049AA8:1!L" (Indicator: "facebook.com"; File: "42f4c516cc7fb026_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yI/r/8iBPf52GdU5.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/0C220CBBBB53FA6E134AE5094F80CF55EC9F7E06B5AD07D842D7B105ACC6B5B4" (Indicator: "facebook.com"; File: "9e35b0c2ae3dcde4_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yn/r/FQIPxzEyFvX.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/0262D10E907E696BE3924A035331E35B6D962E1191A455DFF75373DE1D178773" (Indicator: "facebook.com"; File: "7a9bea57b8cf5f41_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/ym/r/R_qswDMOLWA.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/1C4AB5E61C61F1DFB9AF28F423C5306104CD51E7314595C45003ADE15CA71C1B01bt" (Indicator: "facebook.com"; File: "ebcedc747b584a9b_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/y_/r/c4cu0aEjco-.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/ECC702F472547BBC6B6B5D22BBC9E86BD234E4923B59A07DF0BDDB78820E9369" (Indicator: "facebook.com"; File: "f4408fe22e3a4f75_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yi/r/VaHNVNii56Z.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/8CB2A2B1634479ADAB61890D01F890CB53FA5E5A12F3B4C687289F3467F6BDF5*#/K7^6" (Indicator: "facebook.com"; File: "d4e5d662b01c72f2_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yb/r/X98p6omdveu.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/AA0067FF23E347CD960608B1DA40B795B26F519A579A915574F496777EE3300F" (Indicator: "facebook.com"; File: "d3776b2d341e7614_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yA/r/gYsh5OsZKde.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/98A844C1A63339B1BA922D154613A70BE7321D66EED39258609E302EF18C43AD" (Indicator: "facebook.com"; File: "0fe2e0c1a33ed442_0") Found string "zadn.vn/ansira.com/fcmatch.google.com/origo.hu/fcmatch.youtube.com/refersion.com/flocktory.com/vtex.com.br/rqtrk.eu/vocento.com/fingerprinter.msedgedemo.example/" (Indicator: "youtube"; File: "Fingerprinting") Found string "fcmatch.youtube.com/fcmatch.google.com/other-tracker.msedgedemo.example/" (Indicator: "youtube"; File: "Other") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP")38:T576,Launches browser "msedge.exe" (UID: 00000000-00004300) Launches browser "msedge.exe" (UID: 00000000-00006500) Launches browser "msedge.exe" (UID: 00000000-00006900) Launches browser "msedge.exe" (UID: 00000000-00005332) Launches browser "msedge.exe" (UID: 00000000-00006768) Launches browser "msedge.exe" (UID: 00000000-00002164) Launches browser "msedge.exe" (UID: 00000000-00007540) Launches browser "msedge.exe" (UID: 00000000-00007704) Launches browser "msedge.exe" (UID: 00000000-00006796) Launches browser "msedge.exe" (UID: 00000000-00007712) Launches browser "msedge.exe" (UID: 00000000-00007204) Launches browser "msedge.exe" (UID: 00000000-00007776) Launches browser "msedge.exe" (UID: 00000000-00006420) Launches browser "msedge.exe" (UID: 00000000-00008184) Launches browser "msedge.exe" (UID: 00000000-00008068) Launches browser "msedge.exe" (UID: 00000000-00002936) Launches browser "msedge.exe" (UID: 00000000-00004064) Launches browser "msedge.exe" (UID: 00000000-00003404) Launches browser "msedge.exe" (UID: 00000000-00002912) Launches browser "msedge.exe" (UID: 00000000-00007468) Launches browser "msedge.exe" (UID: 00000000-00008136) Launches browser "msedge.exe" (UID: 00000000-00005844) Launches browser "msedge.exe" (UID: 00000000-00006648) Launches browser "msedge.exe" (UID: 00000000-00000148) Launches browser "msedge.exe" (UID: 00000000-00004500)39:T6c6,"04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 770E0000 "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 726E0000 "zb5lr61.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 770E0000 "zb5lr61.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 726E0000 "Fp6XX19.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 770E0000 "Fp6XX19.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 726E0000 "vV4ug45.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 770E0000 "vV4ug45.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 726E0000 "2560417.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 770E0000 "2560417.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 726E0000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 770E0000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 726E0000 "8917152.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 42E70000 "8917152.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 41F60000 "pt999MH.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 770E0000 "pt999MH.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 726E0000 "xZ74Qx7.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 770E0000 "xZ74Qx7.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 726E0000 "zSB8Oz6.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 770E0000 "zSB8Oz6.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 726E0000 "cmd.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 42E700003a:Te2d,"04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89" was detected as "Microsoft Cabinet" and name: "sfx" "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89" was detected as "Microsoft Visual C/C++" and name: "Compiler" "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89" was detected as "Microsoft Cabinet File" and name: "Archive" "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89" was detected as "Microsoft Linker" and name: "Linker" "zb5lr61.exe" was detected as "Microsoft Cabinet" and name: "sfx" "zb5lr61.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "zb5lr61.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "zb5lr61.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "zb5lr61.exe" was detected as "Microsoft Linker" and name: "Linker" "Fp6XX19.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Fp6XX19.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Fp6XX19.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Fp6XX19.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Fp6XX19.exe" was detected as "Microsoft Linker" and name: "Linker" "pt999MH.exe" was detected as "Microsoft Cabinet" and name: "sfx" "pt999MH.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "pt999MH.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "pt999MH.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "pt999MH.exe" was detected as "Microsoft Linker" and name: "Linker" "xZ74Qx7.exe" was detected as "Microsoft Cabinet" and name: "sfx" "xZ74Qx7.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "xZ74Qx7.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "xZ74Qx7.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "xZ74Qx7.exe" was detected as "Microsoft Linker" and name: "Linker" "vV4ug45.exe" was detected as "Microsoft Cabinet" and name: "sfx" "vV4ug45.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "vV4ug45.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "vV4ug45.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "vV4ug45.exe" was detected as "Microsoft Linker" and name: "Linker" "2560417.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2560417.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2560417.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2560417.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2560417.exe" was detected as "Microsoft Linker" and name: "Linker" "zSB8Oz6.exe" was detected as "Microsoft Cabinet" and name: "sfx" "zSB8Oz6.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "zSB8Oz6.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "zSB8Oz6.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "zSB8Oz6.exe" was detected as "Microsoft Linker" and name: "Linker" "8917152.exe" was detected as "Microsoft Cabinet" and name: "sfx" "8917152.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "8917152.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "8917152.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "8917152.exe" was detected as "Microsoft Linker" and name: "Linker"3b:T162d,"04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "zb5lr61.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Fp6XX19.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "pt999MH.exe" file has an entrypoint instructions - "call 0x408fd7,jmp 0x4086e1,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x408177,jmp 0x40886d,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x4250e0],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "xZ74Qx7.exe" file has an entrypoint instructions - "call 0x408fd7,jmp 0x4086e1,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x408177,jmp 0x40886d,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x4250e0],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "vV4ug45.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "2560417.exe" file has an entrypoint instructions - "call 0x408fd7,jmp 0x4086e1,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x408177,jmp 0x40886d,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x4250e0],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "zSB8Oz6.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418068,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x41806c], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418068], eax,call 0x405000,mov eax, 0x41707c,mov dword ptr [0x41808c], eax,call 0x40e4d0,call 0x40e23d,call 0x40b120,call 0x40a9a9," "8917152.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3c:Tb20,Process "zb5lr61.exe" (UID: 00000000-00007536) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigation", PROCESSOR_ARCHITEW6432="AMD64"" Process "zb5lr61.exe" (UID: 00000000-00007536) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "cmd.exe" (UID: 00000000-00007280) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "msedge.exe" (UID: 00000000-00004300) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", PROMPT="$P$G", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "msedge.exe" (UID: 00000000-00004300) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00004300) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00006500) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_4300_QZYQZHMCBEXRKIMF", EDGE_BROWSER_PID="4300"" Process "msedge.exe" (UID: 00000000-00006900) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00005332) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_6900_XQVSMTWDNPEPNNMX", EDGE_BROWSER_PID="6900"" Process "msedge.exe" (UID: 00000000-00006768) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00002164) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007540) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT"" Process "msedge.exe" (UID: 00000000-00007540) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007704) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007704) was launched with missing environment variables: "CHROME_RESTART" Process "msedge.exe" (UID: 00000000-00006796) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT"" Process "msedge.exe" (UID: 00000000-00006796) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID"3d:T6f9,"04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "zb5lr61.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "zb5lr61.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "zb5lr61.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Fp6XX19.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Fp6XX19.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Fp6XX19.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "vV4ug45.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "vV4ug45.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "vV4ug45.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "2560417.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "8917152.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "8917152.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "8917152.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "8917152.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")3e:T5b9,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll",0" [Source: 8917152.exe.log] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll",0" [Source: 8917152.exe.log] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00000396-00000BC1-54995929] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00007536-00000BC1-55628135] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00000272-00000BC1-56314863] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00006584-00000BC1-56884541] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006748-00000C28-1597808597] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001120-00000C28-906502819]3f:T8b4,Spawned process "zb5lr61.exe" (UID: 00000000-00007536) Spawned process "Fp6XX19.exe" (UID: 00000000-00000272) Spawned process "vV4ug45.exe" (UID: 00000000-00006584) Spawned process "2560417.exe" (UID: 00000000-00007216) Spawned process "AppLaunch.exe" (UID: 00000000-00007400) Spawned process "AppLaunch.exe" (UID: 00000000-00000820) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 7216 -ip 7216" (UID: 00000000-00007784) Spawned process "WerFault.exe" with commandline "-u -p 7216 -s 660" (UID: 00000000-00006556) Spawned process "8917152.exe" (UID: 00000000-00006748) Spawned process "pt999MH.exe" (UID: 00000000-00007012) Spawned process "AppLaunch.exe" (UID: 00000000-00001120) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 7012 -ip 7012" (UID: 00000000-00001892) Spawned process "WerFault.exe" with commandline "-u -p 7012 -s 664" (UID: 00000000-00000644) Spawned process "xZ74Qx7.exe" (UID: 00000000-00000884) Spawned process "AppLaunch.exe" (UID: 00000000-00004692) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 884 -ip 884" (UID: 00000000-00001232) Spawned process "WerFault.exe" with commandline "-u -p 884 -s 144" (UID: 00000000-00003500) Spawned process "zSB8Oz6.exe" (UID: 00000000-00007236) Spawned process "cmd.exe" with commandline ""%WINDIR%\\sysnative\\cmd" /c "%TEMP%\\DB6E.tmp\\DB6F.tmp\\DB7F. ..." (UID: 00000000-00007280), Spawned process "msedge.exe" with commandline "--single-argument https://www.facebook.com/login" (UID: 00000000-00004300), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00006500) Spawned process "msedge.exe" with commandline "--single-argument https://accounts.google.com/" (UID: 00000000-00006900) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00005332), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00006768), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00002164)40:T8b4,Spawned process "zb5lr61.exe" (UID: 00000000-00007536) Spawned process "Fp6XX19.exe" (UID: 00000000-00000272) Spawned process "vV4ug45.exe" (UID: 00000000-00006584) Spawned process "2560417.exe" (UID: 00000000-00007216) Spawned process "AppLaunch.exe" (UID: 00000000-00007400) Spawned process "AppLaunch.exe" (UID: 00000000-00000820) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 7216 -ip 7216" (UID: 00000000-00007784) Spawned process "WerFault.exe" with commandline "-u -p 7216 -s 660" (UID: 00000000-00006556) Spawned process "8917152.exe" (UID: 00000000-00006748) Spawned process "pt999MH.exe" (UID: 00000000-00007012) Spawned process "AppLaunch.exe" (UID: 00000000-00001120) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 7012 -ip 7012" (UID: 00000000-00001892) Spawned process "WerFault.exe" with commandline "-u -p 7012 -s 664" (UID: 00000000-00000644) Spawned process "xZ74Qx7.exe" (UID: 00000000-00000884) Spawned process "AppLaunch.exe" (UID: 00000000-00004692) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 884 -ip 884" (UID: 00000000-00001232) Spawned process "WerFault.exe" with commandline "-u -p 884 -s 144" (UID: 00000000-00003500) Spawned process "zSB8Oz6.exe" (UID: 00000000-00007236) Spawned process "cmd.exe" with commandline ""%WINDIR%\\sysnative\\cmd" /c "%TEMP%\\DB6E.tmp\\DB6F.tmp\\DB7F. ..." (UID: 00000000-00007280), Spawned process "msedge.exe" with commandline "--single-argument https://www.facebook.com/login" (UID: 00000000-00004300), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00006500) Spawned process "msedge.exe" with commandline "--single-argument https://accounts.google.com/" (UID: 00000000-00006900) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00005332), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00006768), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00002164)41:T6425,"zb5lr61.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\zb5lr61.exe]- [targetUID: 00000000-00007536] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "Fp6XX19.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\Fp6XX19.exe]- [targetUID: 00000000-00000272] "pt999MH.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\pt999MH.exe]- [targetUID: 00000000-00007012] "xZ74Qx7.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\xZ74Qx7.exe]- [targetUID: 00000000-00000884] "vV4ug45.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\vV4ug45.exe]- [targetUID: 00000000-00000272] "2560417.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\2560417.exe]- [targetUID: 00000000-00007216] "zSB8Oz6.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\zSB8Oz6.exe]- [targetUID: 00000000-00007236] "8917152.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP003.TMP\8917152.exe]- [targetUID: 00000000-00006748] "8917152.exe.log" has type "CSV text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0\UsageLogs\8917152.exe.log]- [targetUID: 00000000-00006748] "DB7F.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\DB6E.tmp\DB6F.tmp\DB7F.bat]- [targetUID: 00000000-00007280] "recovery-component-inner.crx" has type "Google Chrome extension version 3"- Location: [%TEMP%\6900_1936157133\recovery-component-inner.crx]- [targetUID: 00000000-00006900] "000009.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000009.log]- [targetUID: 00000000-00006900] "000013.ldb" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000013.ldb]- [targetUID: 00000000-00006900] "v1FieldTypes.json" has type "JSON data"- Location: [%TEMP%\6900_843161663\v1FieldTypes.json]- [targetUID: 00000000-00000148] "000014.ldb" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000014.ldb]- [targetUID: 00000000-00006900] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00008184] "f7612ec27b8d8b43_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\f7612ec27b8d8b43_0]- [targetUID: 00000000-00006900] "f_0004c7" has type "gzip compressed data original size modulo 2^32 766448"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c7]- [targetUID: 00000000-00007540] "edge_autofill_field_data.json" has type "JSON data"- Location: [%TEMP%\6900_843161663\edge_autofill_field_data.json]- [targetUID: 00000000-00000148] "407bc1a1-b2bd-468a-a5a7-54934c19ce8e.tmp" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\407bc1a1-b2bd-468a-a5a7-54934c19ce8e.tmp]- [targetUID: 00000000-00006900] "f_0004c3" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c3]- [targetUID: 00000000-00007540] "449babc3-12d5-48e6-8600-f987c726b410.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\449babc3-12d5-48e6-8600-f987c726b410.tmp]- [targetUID: 00000000-00006900] "cd88d053-6e47-4b12-8b1e-b807c89841f6.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\cd88d053-6e47-4b12-8b1e-b807c89841f6.tmp]- [targetUID: 00000000-00006900] "2a89a528-6bab-4527-9683-e1e69f62f23a.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\2a89a528-6bab-4527-9683-e1e69f62f23a.tmp]- [targetUID: 00000000-00006900] "4724135a-65db-4eb4-9f3b-c18aaf1045d1.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\4724135a-65db-4eb4-9f3b-c18aaf1045d1.tmp]- [targetUID: 00000000-00006900] "80a23cb9-4442-49f8-9aa2-a37f736c5788.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\80a23cb9-4442-49f8-9aa2-a37f736c5788.tmp]- [targetUID: 00000000-00006900] "30945838-3494-48a8-9c82-c9de75738798.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\30945838-3494-48a8-9c82-c9de75738798.tmp]- [targetUID: 00000000-00006900] "f2574aba-d367-44cd-a3d9-d6865d1b6751.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\f2574aba-d367-44cd-a3d9-d6865d1b6751.tmp]- [targetUID: 00000000-00006900] "00af38f2-c3cb-482a-bbf7-7cc57e8c4999.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "42a809c57dccac15_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\42a809c57dccac15_0]- [targetUID: 00000000-00006900] "data.txt" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\6900_422444857\data.txt]- [targetUID: 00000000-00008076] "f_0004c5" has type "gzip compressed data original size modulo 2^32 210122"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c5]- [targetUID: 00000000-00007540] "Entities" has type "UTF-8 Unicode text"- Location: [%TEMP%\6900_2106218869\Mu\Entities]- [targetUID: 00000000-00007540] "cf7d69b2-6b31-4486-887c-7a3371450cb2.tmp" has type "UTF-8 Unicode text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\cf7d69b2-6b31-4486-887c-7a3371450cb2.tmp]- [targetUID: 00000000-00004300] "448fc57b59f16c91_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\448fc57b59f16c91_0]- [targetUID: 00000000-00006900] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "d0ffaf660e8db796_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\d0ffaf660e8db796_0]- [targetUID: 00000000-00006900] "b5642caa999cf879_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\b5642caa999cf879_0]- [targetUID: 00000000-00006900] "6e793be3d8efec58_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\6e793be3d8efec58_0]- [targetUID: 00000000-00006900] "e78fb570e293c9d7_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\e78fb570e293c9d7_0]- [targetUID: 00000000-00006900] "LICENSE" has type "ASCII text"- Location: [%TEMP%\6900_2106218869\Mu\LICENSE]- [targetUID: 00000000-00006900] "f_0004c9" has type "gzip compressed data original size modulo 2^32 111841"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c9]- [targetUID: 00000000-00007540] "b2b33a0379cfb6c9_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\b2b33a0379cfb6c9_0]- [targetUID: 00000000-00006900] "Advertising" has type "ASCII text"- Location: [%TEMP%\6900_2106218869\Mu\Advertising]- [targetUID: 00000000-00007540] "1fc2e0a3aae731f6_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\1fc2e0a3aae731f6_0]- [targetUID: 00000000-00006900] "55540439-c026-4f19-a563-b95ac46d6ab3.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\55540439-c026-4f19-a563-b95ac46d6ab3.tmp]- [targetUID: 00000000-00006900] "0d70ca03-722a-47f3-a998-5aedddb12929.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\0d70ca03-722a-47f3-a998-5aedddb12929.tmp]- [targetUID: 00000000-00006900] "6ea23b40-5147-438a-99f1-d3f1e20847cf.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\6ea23b40-5147-438a-99f1-d3f1e20847cf.tmp]- [targetUID: 00000000-00006900] "6661229b-d1bc-4ddd-aba5-612ab7a7cc04.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\6661229b-d1bc-4ddd-aba5-612ab7a7cc04.tmp]- [targetUID: 00000000-00006900] "30f6b91c-a1f9-4dbd-a1ea-94f9ebb6586d.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\30f6b91c-a1f9-4dbd-a1ea-94f9ebb6586d.tmp]- [targetUID: 00000000-00006900] "f3f879c9-7ab5-4171-9795-9c0456d63371.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\f3f879c9-7ab5-4171-9795-9c0456d63371.tmp]- [targetUID: 00000000-00006900] "e24014b2-06fa-47d8-8291-03a4923eaa09.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\e24014b2-06fa-47d8-8291-03a4923eaa09.tmp]- [targetUID: 00000000-00006900] "83d1a92f-677e-4dea-9da3-866c50ebb58e.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\83d1a92f-677e-4dea-9da3-866c50ebb58e.tmp]- [targetUID: 00000000-00006900] "crl-set" has type "data"- Location: [%TEMP%\6900_883847075\crl-set]- [targetUID: 00000000-00006900] "f_0004c8" has type "Web Open Font Format (Version 2) TrueType length 21700 version 1.0"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c8]- [targetUID: 00000000-00007540] "f_0004c6" has type "Web Open Font Format (Version 2) TrueType length 21464 version 1.0"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c6]- [targetUID: 00000000-00007540] "f2a841d18f15ae4b_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\f2a841d18f15ae4b_0]- [targetUID: 00000000-00006900] "arbitration_service_config.json" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\arbitration_service_config.json]- [targetUID: 00000000-00006900] "62394efd382101a7_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\62394efd382101a7_0]- [targetUID: 00000000-00006900] "f_0004c4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c4]- [targetUID: 00000000-00007540] "Entities" has type "ASCII text"- Location: [%TEMP%\6900_2106218869\Sigma\Entities]- [targetUID: 00000000-00007540] "7faaeb6d807041bb_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\7faaeb6d807041bb_0]- [targetUID: 00000000-00006900] "ed2cf18eab4cc5a4_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\ed2cf18eab4cc5a4_0]- [targetUID: 00000000-00006900] "temp-index" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index]- [targetUID: 00000000-00006900] "42ce332cdbe9fa73_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\42ce332cdbe9fa73_0]- [targetUID: 00000000-00006900] "4b1691c2d8c552f5_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\4b1691c2d8c552f5_0]- [targetUID: 00000000-00006900] "02de9b14-e2be-4a23-9dbc-359233c89d68.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\02de9b14-e2be-4a23-9dbc-359233c89d68.tmp]- [targetUID: 00000000-00007540] "3a22109e-947d-43e0-8586-b35597c5effb.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\3a22109e-947d-43e0-8586-b35597c5effb.tmp]- [targetUID: 00000000-00007540] "Content" has type "ASCII text"- Location: [%TEMP%\6900_2106218869\Mu\Content]- [targetUID: 00000000-00007540] "49d0896e54e4faca_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\49d0896e54e4faca_0]- [targetUID: 00000000-00006900] "Staging" has type "ASCII text"- Location: [%TEMP%\6900_2106218869\Sigma\Staging]- [targetUID: 00000000-00007540] "22a1dfae96f6cc61_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\22a1dfae96f6cc61_0]- [targetUID: 00000000-00006900] "8d5e1c410a09c25f_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\8d5e1c410a09c25f_0]- [targetUID: 00000000-00006900] "Analytics" has type "ASCII text"- Location: [%TEMP%\6900_2106218869\Mu\Analytics]- [targetUID: 00000000-00007540] "edge_autofill_global_block_list.json" has type "JSON data"- Location: [%TEMP%\6900_843161663\edge_autofill_global_block_list.json]- [targetUID: 00000000-00000148] "4945a7b4b1e84510_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\4945a7b4b1e84510_0]- [targetUID: 00000000-00006900] "7b95d65eb18c490e_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\7b95d65eb18c490e_0]- [targetUID: 00000000-00006900] "94ba2e57-b37c-410c-b93f-4b003b2df21b.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\94ba2e57-b37c-410c-b93f-4b003b2df21b.tmp]- [targetUID: 00000000-00007540] "79977a8b-a615-4330-af08-db05a07eed72.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\79977a8b-a615-4330-af08-db05a07eed72.tmp]- [targetUID: 00000000-00007540] "1c3f5153-dfb8-473d-a72a-d4601db954dc.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\1c3f5153-dfb8-473d-a72a-d4601db954dc.tmp]- [targetUID: 00000000-00007540] "01d46223-bf92-40cb-9812-ac17f628cd50.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\01d46223-bf92-40cb-9812-ac17f628cd50.tmp]- [targetUID: 00000000-00007540] "08ef7772-ae7f-42f3-a710-e67d0e80e832.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\08ef7772-ae7f-42f3-a710-e67d0e80e832.tmp]- [targetUID: 00000000-00007540] "54e6de13-0481-45df-a6e1-1b07af9113c8.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\54e6de13-0481-45df-a6e1-1b07af9113c8.tmp]- [targetUID: 00000000-00007540] "269ed77f-da7e-4621-a91c-82e3b90e730d.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\269ed77f-da7e-4621-a91c-82e3b90e730d.tmp]- [targetUID: 00000000-00007540] "2f3fb8a5-110c-43e1-bf15-2fe716a3ecb7.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\2f3fb8a5-110c-43e1-bf15-2fe716a3ecb7.tmp]- [targetUID: 00000000-00007540] "3ff3a285-2b73-410a-857f-00d0b708e764.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\3ff3a285-2b73-410a-857f-00d0b708e764.tmp]- [targetUID: 00000000-00007540] "81b5d89c-5fe5-4353-a424-7646af4d75ac.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\81b5d89c-5fe5-4353-a424-7646af4d75ac.tmp]- [targetUID: 00000000-00007540] "Social" has type "ASCII text"- Location: [%TEMP%\6900_2106218869\Sigma\Social]- [targetUID: 00000000-00007540] "76c7e8d8-c807-4afb-b30c-cefac9005616.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\76c7e8d8-c807-4afb-b30c-cefac9005616.tmp]- [targetUID: 00000000-00007540] "nav_config.json" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\TokenBroker\Cache\f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres]- [targetUID: 00000000-00006900] "40701b42ebc1cb18_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\40701b42ebc1cb18_0]- [targetUID: 00000000-00006900] "945a7a9cc1766ccd_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\945a7a9cc1766ccd_0]- [targetUID: 00000000-00006900] "Fingerprinting" has type "ASCII text"- Location: [%TEMP%\6900_2106218869\Mu\Fingerprinting]- [targetUID: 00000000-00007540] "27493ca1a1fa0675_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\27493ca1a1fa0675_0]- [targetUID: 00000000-00006900] "dd4e1c82e3934943_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\dd4e1c82e3934943_0]- [targetUID: 00000000-00006900] "87c7736561b2d55b_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\87c7736561b2d55b_0]- [targetUID: 00000000-00006900] "28ddefd2a358f950_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\28ddefd2a358f950_0]- [targetUID: 00000000-00006900] "5c3670d715a72a09_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\5c3670d715a72a09_0]- [targetUID: 00000000-00006900] "cb73251ed9922b51_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\cb73251ed9922b51_0]- [targetUID: 00000000-00006900] "9a171843bd188202_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\9a171843bd188202_0]- [targetUID: 00000000-00006900] "4a904fb10fbf150e_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\4a904fb10fbf150e_0]- [targetUID: 00000000-00006900] "Cryptomining" has type "ASCII text"- Location: [%TEMP%\6900_2106218869\Mu\Cryptomining]- [targetUID: 00000000-00007540] "d006c09fff9156f7_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\d006c09fff9156f7_0]- [targetUID: 00000000-00006900] "Advertising" has type "ASCII text"- Location: [%TEMP%\6900_2106218869\Sigma\Advertising]- [targetUID: 00000000-00007540] "CompatExceptions" has type "ASCII text"- Location: [%TEMP%\6900_2106218869\Mu\CompatExceptions]- [targetUID: 00000000-00007540] "ad42aa6125b80247_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\ad42aa6125b80247_0]- [targetUID: 00000000-00006900] "Social" has type "ASCII text"- Location: [%TEMP%\6900_2106218869\Mu\Social]- [targetUID: 00000000-00007540] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG]- [targetUID: 00000000-00008184] "ec69a14ae449823e_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\ec69a14ae449823e_0]- [targetUID: 00000000-00006900] "34a8c9e3ef19de93_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\34a8c9e3ef19de93_0]- [targetUID: 00000000-00006900] "2556f6e9598d5fb0_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\2556f6e9598d5fb0_0]- [targetUID: 00000000-00006900] "42f4c516cc7fb026_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\42f4c516cc7fb026_0]- [targetUID: 00000000-00006900] "9e35b0c2ae3dcde4_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\9e35b0c2ae3dcde4_0]- [targetUID: 00000000-00006900] "7a9bea57b8cf5f41_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\7a9bea57b8cf5f41_0]- [targetUID: 00000000-00006900] "ebcedc747b584a9b_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\ebcedc747b584a9b_0]- [targetUID: 00000000-00006900] "f4408fe22e3a4f75_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\f4408fe22e3a4f75_0]- [targetUID: 00000000-00006900] "d4e5d662b01c72f2_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\d4e5d662b01c72f2_0]- [targetUID: 00000000-00006900] "d3776b2d341e7614_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\d3776b2d341e7614_0]- [targetUID: 00000000-00006900] "0fe2e0c1a33ed442_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\0fe2e0c1a33ed442_0]- [targetUID: 00000000-00006900] "settings.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\settings.dat]- [targetUID: 00000000-00006900] "4375vtb45tv8225nv4285n2.txt" has type "ASCII text"- Location: [%TEMP%\4375vtb45tv8225nv4285n2.txt]- [targetUID: 00000000-00004692] "regex_patterns.json" has type "JSON data"- Location: [%TEMP%\6900_843161663\regex_patterns.json]- [targetUID: 00000000-00000148] "Fingerprinting" has type "ASCII text"- Location: [%TEMP%\6900_2106218869\Sigma\Fingerprinting]- [targetUID: 00000000-00007540] "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- [targetUID: 00000000-00000148] "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%TEMP%\6900_1936157133\manifest.json]- [targetUID: 00000000-00000148] "manifest.json" has type "JSON data"- Location: [%TEMP%\6900_2106218869\manifest.json]- [targetUID: 00000000-00000148] "Analytics" has type "ASCII text"- Location: [%TEMP%\6900_2106218869\Sigma\Analytics]- [targetUID: 00000000-00007540] "Last Browser" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Last Browser]- [targetUID: 00000000-00006900] "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%TEMP%\6900_843161663\manifest.json]- [targetUID: 00000000-00000148] "manifest.json" has type "JSON data"- Location: [%TEMP%\6900_883847075\manifest.json]- [targetUID: 00000000-00000148] "TransparentAdvertisers" has type "ASCII text"- Location: [%TEMP%\6900_2106218869\Mu\TransparentAdvertisers]- [targetUID: 00000000-00006900] "Variations" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Variations]- [targetUID: 00000000-00006900] "Other" has type "ASCII text"- Location: [%TEMP%\6900_2106218869\Sigma\Other]- [targetUID: 00000000-00007540] "LICENSE" has type "ASCII text with no line terminators"- Location: [%TEMP%\6900_2106218869\Sigma\LICENSE]- [targetUID: 00000000-00006900] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\6900_1936157133\manifest.fingerprint]- [targetUID: 00000000-00006900] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\6900_883847075\manifest.fingerprint]- [targetUID: 00000000-00006900] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\6900_422444857\manifest.fingerprint]- [targetUID: 00000000-00006900] "manifest.fingerprint" has type "ASCII text with no line terminators"- [targetUID: 00000000-00006900] ".ses" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\.ses]- [targetUID: 00000000-00006900] "manifest.json" has type "JSON data"- Location: [%TEMP%\6900_422444857\manifest.json]- [targetUID: 00000000-00000148] "MANIFEST-000001" has type "PGP Secret Key -"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001]- [targetUID: 00000000-00006900] "Content" has type "ASCII text"- Location: [%TEMP%\6900_2106218869\Sigma\Content]- [targetUID: 00000000-00007540] "Other" has type "ASCII text"- Location: [%TEMP%\6900_2106218869\Mu\Other]- [targetUID: 00000000-00007540] "Cryptomining" has type "ASCII text"- Location: [%TEMP%\6900_2106218869\Sigma\Cryptomining]- [targetUID: 00000000-00007540] "000001.dbtmp" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp]- [targetUID: 00000000-00006900] "Last Version" has type "ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Last Version]- [targetUID: 00000000-00006900] "53f56b34-a563-4e1a-b089-863137f32795.tmp" has type "very short file (no magic)"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\53f56b34-a563-4e1a-b089-863137f32795.tmp]- [targetUID: 00000000-00006900] "d55e37ca-25d3-4076-98ef-5684846e7076.tmp" has type "UTF-8 Unicode text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\d55e37ca-25d3-4076-98ef-5684846e7076.tmp]- [targetUID: 00000000-00004300]42:T146b,"407bc1a1-b2bd-468a-a5a7-54934c19ce8e.tmp" has type "JSON data" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\407bc1a1-b2bd-468a-a5a7-54934c19ce8e.tmp] "449babc3-12d5-48e6-8600-f987c726b410.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\449babc3-12d5-48e6-8600-f987c726b410.tmp] "cd88d053-6e47-4b12-8b1e-b807c89841f6.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\cd88d053-6e47-4b12-8b1e-b807c89841f6.tmp] "2a89a528-6bab-4527-9683-e1e69f62f23a.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\2a89a528-6bab-4527-9683-e1e69f62f23a.tmp] "4724135a-65db-4eb4-9f3b-c18aaf1045d1.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\4724135a-65db-4eb4-9f3b-c18aaf1045d1.tmp] "80a23cb9-4442-49f8-9aa2-a37f736c5788.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\80a23cb9-4442-49f8-9aa2-a37f736c5788.tmp] "30945838-3494-48a8-9c82-c9de75738798.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\30945838-3494-48a8-9c82-c9de75738798.tmp] "f2574aba-d367-44cd-a3d9-d6865d1b6751.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\f2574aba-d367-44cd-a3d9-d6865d1b6751.tmp] "00af38f2-c3cb-482a-bbf7-7cc57e8c4999.tmp" has type "ASCII text with very long lines with no line terminators" "cf7d69b2-6b31-4486-887c-7a3371450cb2.tmp" has type "UTF-8 Unicode text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\cf7d69b2-6b31-4486-887c-7a3371450cb2.tmp] "55540439-c026-4f19-a563-b95ac46d6ab3.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\55540439-c026-4f19-a563-b95ac46d6ab3.tmp] "0d70ca03-722a-47f3-a998-5aedddb12929.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\0d70ca03-722a-47f3-a998-5aedddb12929.tmp] "6ea23b40-5147-438a-99f1-d3f1e20847cf.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\6ea23b40-5147-438a-99f1-d3f1e20847cf.tmp] "6661229b-d1bc-4ddd-aba5-612ab7a7cc04.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\6661229b-d1bc-4ddd-aba5-612ab7a7cc04.tmp] "30f6b91c-a1f9-4dbd-a1ea-94f9ebb6586d.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\30f6b91c-a1f9-4dbd-a1ea-94f9ebb6586d.tmp] "f3f879c9-7ab5-4171-9795-9c0456d63371.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\f3f879c9-7ab5-4171-9795-9c0456d63371.tmp] "e24014b2-06fa-47d8-8291-03a4923eaa09.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\e24014b2-06fa-47d8-8291-03a4923eaa09.tmp] "83d1a92f-677e-4dea-9da3-866c50ebb58e.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\83d1a92f-677e-4dea-9da3-866c50ebb58e.tmp] "02de9b14-e2be-4a23-9dbc-359233c89d68.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\02de9b14-e2be-4a23-9dbc-359233c89d68.tmp] "3a22109e-947d-43e0-8586-b35597c5effb.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\3a22109e-947d-43e0-8586-b35597c5effb.tmp] "94ba2e57-b37c-410c-b93f-4b003b2df21b.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\94ba2e57-b37c-410c-b93f-4b003b2df21b.tmp] "79977a8b-a615-4330-af08-db05a07eed72.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\79977a8b-a615-4330-af08-db05a07eed72.tmp] "1c3f5153-dfb8-473d-a72a-d4601db954dc.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\1c3f5153-dfb8-473d-a72a-d4601db954dc.tmp] "01d46223-bf92-40cb-9812-ac17f628cd50.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\01d46223-bf92-40cb-9812-ac17f628cd50.tmp] "08ef7772-ae7f-42f3-a710-e67d0e80e832.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\08ef7772-ae7f-42f3-a710-e67d0e80e832.tmp]43:T7aa,"04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")44:Tf15,"04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "04B84C79663129ED4A038D47747BD220A0216C7AB97098F7E7C8D2FF00525E89.EXE"; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")45:T52d,"04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" trying to touch file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" trying to touch file "C:\04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" trying to touch file "C:\Windows\SysWOW64\AcLayers.dll" "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" trying to touch file "C:\Windows\SysWOW64\mpr.dll" "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" trying to touch file "C:\Windows\SysWOW64\sfc.dll"46:T442,"AppLaunch.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "AppLaunch.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "AppLaunch.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "AppLaunch.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "AppLaunch.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "AppLaunch.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History"47:Td3f,"04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ZB5LR61.EXE" "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ZSB8OZ6.EXE" "zb5lr61.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "zb5lr61.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "zb5lr61.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "zb5lr61.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "zb5lr61.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FP6XX19.EXE" "zb5lr61.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\XZ74QX7.EXE" "Fp6XX19.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "Fp6XX19.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "Fp6XX19.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "Fp6XX19.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "Fp6XX19.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\VV4UG45.EXE" "Fp6XX19.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\PT999MH.EXE" "vV4ug45.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "vV4ug45.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\CABINET.DLL" "vV4ug45.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\VERSION.DLL" "vV4ug45.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\FLTLIB.DLL" "vV4ug45.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2560417.EXE" "vV4ug45.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\8917152.EXE" "2560417.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL"48:T890,"04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" trying to access non-existent file "\Device\HarddiskVolume2\04B84C79663129ED4A038D47747BD220A0216C7AB97098F7E7C8D2FF00525E89.EXE.LOCAL" "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "zb5lr61.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ZB5LR61.EXE.LOCAL" "zb5lr61.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "Fp6XX19.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FP6XX19.EXE.LOCAL" "Fp6XX19.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "vV4ug45.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\VV4UG45.EXE.LOCAL" "vV4ug45.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "8917152.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\MSCOREE.DLL.LOCAL" "8917152.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\8917152.EXE.CONFIG" "8917152.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "8917152.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\8917152.EXE.LOG" "8917152.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\HEALER" "8917152.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\8917152.INI" "8917152.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL"49:T2f1b,Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com/" Heuristic match: "GqA.U.la" Heuristic match: "6G`.aD" Heuristic match: "sdT.Sl" Heuristic match: "sPu.IR" Heuristic match: "A).HK" Pattern match: "https://www.facebook.com/loginstart" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/y_/r/c4cu0aEjco-.js?_nc_x=Ij3Wp8lg5Kz.Array.fromflatArray.flatflatMap.flatMapa:QdJ%+findIndexfind.Array.findfill.Array.fillisFinite.isFiniteQcBvisNaNNumber.isNaNaisInteger.isIntegerisSafeIntegerindexOfincludes.includesvalues" Pattern match: "q9.Zz/~e3c\A~+,-DRI_h" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yn/r/FQIPxzEyFvX.js?_nc_x=Ij3Wp8lg5KzfreezeACTIVEDYNAMICBIOMETRICDEPRECATEDIOS_NATIVEANDROID_NATIVEEQUAL_BY_VALUEEQUAL_BY_CONTEXT" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yf/r/LgvwffuKmeX.js?_nc_x=Ij3Wp8lg5KzexportsDaFhL`0]E\/Illegal" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yi/r/VaHNVNii56Z.js?_nc_x=Ij3Wp8lg5KzdurationGdocumentaddEventListenerkeydownLL`getTargetisElementInteractiveQcn2" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3iqES4/yB/l/en_US/xWVLjJ40HKK.js?_nc_x=Ij3Wp8lg5Kza((^|\.)instagram\.com$)|((^|\.)wit\.ai$)|((^|\.)accountkit\.com$)httpsa.setHandlerabsetHandlera.setTimeoutaQdJ#setTimeouta.sendsenda._send_sendexportsCookiesi_detect_broken_pr" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3i7M54/yM/l/en_US/LKOC0D0Ap0H.js?_nc_x=Ij3Wp8lg5KzaONLOAD_HOOKloadedapplyWithGuardQdVxPageHooks:onbeforeleavehooksonbeforeunloadhooksregisterCallbackBIGPIPE_DOMREADYQe~@INITIAL_JS_READYBIGPIPE_ONLOADsubscribe$QgvDNATIVE_ONBEFO" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yo/r/j5B70NmINXl.js?_nc_x=Ij3Wp8lg5KzgetIDQd2agetAccountIDCgetPossiblyNonFacebookUserIDCgetEIMUgetEmployeeWorkUserIDgetNamegetShortNameCgetEPOUisLoggedInisLoggedInNowisEmployeeisTestUserhasWorkUserisWorkUserisWorkroomsUseris" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yb/r/X98p6omdveu.js?_nc_x=Ij3Wp8lg5KzreactcreateContextwrapPrepareQueryResourceCexports4Qkfreact-relay/relay-hooks/ProfilerContexta.getTL`&consumeBootloadholdClogHeroRenderlogMetadatalogPageletVCClogReactCommitlogReactPostCo" Pattern match: "avocet.io/aprecision.net/adpdealerservices.com/nuffnang.com.my/demdex.net/augur.io/cmmeglobal.com/adrolays.com/atrinsic.com/acuityads.com/wishabi.net/admedia.com/vertamedia.com/adworx.at/2leep.com/globe7.com/awaps.yandex.ru/i-behavior.com/reklamstore.com/m" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yI/r/8iBPf52GdU5.js?_nc_x=Ij3Wp8lg5KzcreateHTMLa.createHTMLaTrustedTypescreatePolicyQd^@dom-ie-fixQb27k" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53r3l?ver=5412,PORTRAIT:https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53bta?ver=2bf3,update_period:86400},creativeId:128000000003595" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yA/r/gYsh5OsZKde.js?_nc_x=Ij3Wp8lg5Kzcall$EventEmitterWithValidation1$EventEmitterWithValidation2babelHelpersQe~2inheritsLooseindexOfemitc.emithL`0__eventEmitterextends__types__ignoreUnknownEventsassignemitAndHoldaddListener" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/ym/r/R_qswDMOLWA.js?_nc_x=Ij3Wp8lg5KzgetFalcoLogPolicy_DO_NOT_USE1828905" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yO/r/_tJ17sGyxOX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yY/r/LkvpBxTgS0D.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yd/r/D8yA-TXiNuk.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yt/r/jIUN0Hn2kpD.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://www.clarity.ms,supports_spdy:true},{anonymization:[],server:https://microsoftedgewelcome.microsoft.com,supports_spdy:true},{anonymization:[],server:https://edgefrecdn.azureedge.net,supports_spdy:true},{anonymization:[],server" Pattern match: "google.as/cambio.com/chrome.google.com/theboombox.com/baynote.com/aolanswers.com/tidaltv.com/disqus.com/heyzap.com/google.com.au/google.co.id/google.kg/google.co.ve/google.nr/yahoo.com/autoblog.com/feedproxy.google.com/s-msn.com/mandatory.com/noisecreep.co" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yt/r/d4QqVJOdC1V.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "cmail26.com/indexww.com/mkt5654.com/snapchat.com/mgid.com/zendable.com/mkt3798.com/adsafety.net/technical-service.net/hybrid.ai/contentsquare.net/mkt32.net/helpscout.net/admanmedia.com/mkt8756.com/dmxleo.com/mkt9430.com/basis.net/mailstat.us/mkt7832.com/bf" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yF/r/gb_2sOlx922.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yr/r/6XlDJXhMTmo.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "acxiom.com/atinternet.com/hitslink.com/mm7.net/go-mpulse.net/retailautomata.com/free-pagerank.com/amplitude.com/i-stats.com/dl-rms.com/enquisite.com/p.brsrvr.com/onestat.com/lyris.com/alexametrics.com/inboundwriter.com/awio.com/betssonpalantir.com/xiti.com" Pattern match: "autofill.account.microsoft.com/,type" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/ye/r/yUtEQ4ajXZI.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yk/r/kg_LcWkMBGy.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "emaillabs.co/open.mkt4477.com/open.mkt10008.com/open.mkt6917.com/open.mkt1946.com/convertkit-mail5.com/social-tracker.msedgedemo.example/open.mkt8062.com/open.mkt8008.com/open.mkt6316.com/m3651.net/open.mkt6793.com/open.mkt3838.com/open.mkt4158.com/eds5.ma" Pattern match: "www.microsoft365.com" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yh/r/bpW4eEg-2_W.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.XCHOJI6Wf1s.es5.O/ck=boq-identity.AccountsSignInUi.tXM8FeZkc1k.L.W.O/am=DoCRE48NgPhPE-fvGSeHAQAAAAAAAAAA1kB2/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0" Pattern match: "ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.s" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.XCHOJI6Wf1s.es5.O/ck=boq-identity.AccountsSignInUi.tXM8FeZkc1k.L.W.O/am=DoCRE48NgPhPE-fvGSeHAQAAAAAAAAAA1kB2/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,K" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.XCHOJI6Wf1s.es5.O/ck=boq-identity.AccountsSignInUi.tXM8FeZkc1k.L.W.O/am=DoCRE48NgPhPE-fvGSeHAQAAAAAAAAAA1kB2/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb," Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.XCHOJI6Wf1s.es5.O/ck=boq-identity.AccountsSignInUi.tXM8FeZkc1k.L.W.O/am=DoCRE48NgPhPE-fvGSeHAQAAAAAAAAAA1kB2/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/w" Pattern match: "anybest.site/webmine.pro/jsecoin.com/flightzy.bid/nerohut.com/flightsy.bid/coinpot.co/yololike.space/flightzy.win/zymerget.bid/bitcoin-pay.eu/freecontent.stream/authedwebmine.cz/zymerget.faith/hostingcloud.racing/mineralt.io/dinorslick.icu/coinhive.com/bms" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.XCHOJI6Wf1s.es5.O/ck=boq-identity.AccountsSignInUi.tXM8FeZkc1k.L.W.O/am=DoCRE48NgPhPE-fvGSeHAQAAAAAAAAAA1kB2/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEx" Pattern match: "ufpcdn.com/vdx.tv/ebaystatic.com/ad4m.at/00px.net/warumbistdusoarm.space/ownpage.fr/smct.io/ansira.com/photorank.me/fengkongcloud.com/vtex.com.br/vocento.com/ie8eamus.com/flocktory.com/justpremium.com/dynata.com/stripst.com/adskeeper.com/curalate.com/vptms" Pattern match: "auth.adobe.com/^/horizonte.browserapps.amazon.com/^/horizonte.browserapps.amazon.de/^/horizonte.browserapps.amazon.ca/^/acrobatservices.adobe.com/^/signin.aws.amazon.com/^/horizonte-browserapps.amazon.com.br/^/zendesk.com/^/my.salesforce.com/^/disqus.com/^" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.XCHOJI6Wf1s.es5.O/am=DoCRE48NgPhPE-fvGSeHAQAAAAAAAAAA1kB2/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlG6KrcgBpUbIBacQ3KL7PjBWiZbGQ/m=_b,_tp" Pattern match: "mail.google.com/apps.fbsbx.com/fb.com/developers.google.com/friendfeed.com/social-tracker.msedgedemo.example/googlemail.com/facebook.com/plus.google.com/fbsbx.com/voice.google.com/facebook.de/facebook.fr/wave.google.com/twimg.com/orkut.com/twitter.jp/gmail" Pattern match: "assets.db/MANIFEST-0000012023/10/03-07:03:03.621" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3i7M54/yM/l/en_US/LKOC0D0Ap0H.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3iqES4/yB/l/en_US/xWVLjJ40HKK.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yo/r/j5B70NmINXl.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yf/r/LgvwffuKmeX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yI/r/8iBPf52GdU5.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yn/r/FQIPxzEyFvX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/ym/r/R_qswDMOLWA.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/y_/r/c4cu0aEjco-.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yi/r/VaHNVNii56Z.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yb/r/X98p6omdveu.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yA/r/gYsh5OsZKde.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "http://5.42.92.211/2023-10-03" Pattern match: "zadn.vn/ansira.com/fcmatch.google.com/origo.hu/fcmatch.youtube.com/refersion.com/flocktory.com/vtex.com.br/rqtrk.eu/vocento.com/fingerprinter.msedgedemo.example/" Pattern match: "gimbal.com/thirdwatch.ai/fndrsp.net/analytics-tracker.msedgedemo.example/cuebiq.com/inrix.com/zoominfo.com/clarity.ms/" Pattern match: "microsoftedgeinsider.com/Fabrikam^microsoftedgeinsider.com/VanArsdel^microsoftedgeinsider.com/" Pattern match: "fcmatch.youtube.com/fcmatch.google.com/other-tracker.msedgedemo.example/" Heuristic match: "accounts.google.com" Heuristic match: "arc.msn.com" Heuristic match: "connect.facebook.net" Heuristic match: "facebook.com" Heuristic match: "fbcdn.net" Heuristic match: "fbsbx.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "play.google.com" Heuristic match: "static.xx.fbcdn.net" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Pattern match: "https://accounts.google.com" Pattern match: "www.playstation.com},{applied_policy:block,domain:bing.com},{applied_policy:block,domain:browserbench.org},{applied_policy:block,domain:www.principledtechnologies.com},{applied_policy:block,domain:web.basemark.com},{applie" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.itxXp8cph_Q.L.B1.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/ed=1/rs=AOaEmlFd7GjYMAgM5w0eXNgMHhWXX1y-rA/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5Bikz2SRVqI.es5.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEWxJh2X2eTkMcHjarL7EJ8Tp6etA/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Pattern match: "assets.db/MANIFEST-000001" Pattern match: "assets.db/000003.log" Pattern match: "http://www.w3.org/2001/XMLSchema-instance"4a:T7f3,"04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00000396) "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00000396) "zb5lr61.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00007536) "zb5lr61.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00007536) "Fp6XX19.exe" called "FindFirstFileA" with parameter %TEMP%\IXP002.TMP\* (UID: 00000000-00000272) "Fp6XX19.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00000272) "vV4ug45.exe" called "FindFirstFileA" with parameter %TEMP%\IXP003.TMP\* (UID: 00000000-00006584) "vV4ug45.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00006584) "8917152.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006748) "8917152.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00006748) "8917152.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006748) "8917152.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006748) "8917152.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006748) "8917152.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006748) "8917152.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006748) "8917152.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006748) "8917152.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00006748) "8917152.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00006748) "8917152.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00006748) "8917152.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00006748)4b:T863,file/memory contains long string with (Indicator: "base64"; File: "f7612ec27b8d8b43_0") file/memory contains long string with (Indicator: "base64"; File: "42a809c57dccac15_0") file/memory contains long string with (Indicator: "blowfish"; File: "42a809c57dccac15_0") file/memory contains long string with (Indicator: "base64"; File: "448fc57b59f16c91_0") file/memory contains long string with (Indicator: "aes"; File: "d0ffaf660e8db796_0") file/memory contains long string with (Indicator: "base64"; File: "d0ffaf660e8db796_0") file/memory contains long string with (Indicator: "base64"; File: "6e793be3d8efec58_0") file/memory contains long string with (Indicator: "base64"; File: "e78fb570e293c9d7_0") file/memory contains long string with (Indicator: ".decrypt"; File: "7faaeb6d807041bb_0") file/memory contains long string with (Indicator: ".encrypt"; File: "7faaeb6d807041bb_0") file/memory contains long string with (Indicator: "base64"; File: "7faaeb6d807041bb_0") file/memory contains long string with (Indicator: "blowfish"; File: "7faaeb6d807041bb_0") file/memory contains long string with (Indicator: "aes"; File: "02de9b14-e2be-4a23-9dbc-359233c89d68.tmp") file/memory contains long string with (Indicator: "aes"; File: "3a22109e-947d-43e0-8586-b35597c5effb.tmp") file/memory contains long string with (Indicator: "aes"; File: "945a7a9cc1766ccd_0") file/memory contains long string with (Indicator: "aes"; File: "27493ca1a1fa0675_0") file/memory contains long string with (Indicator: "aes"; File: "dd4e1c82e3934943_0") file/memory contains long string with (Indicator: "aes"; File: "87c7736561b2d55b_0") file/memory contains long string with (Indicator: "aes"; File: "28ddefd2a358f950_0") file/memory contains long string with (Indicator: "aes"; File: "5c3670d715a72a09_0") file/memory contains long string with (Indicator: "aes"; File: "cb73251ed9922b51_0") file/memory contains long string with (Indicator: "aes"; File: "9a171843bd188202_0") file/memory contains long string with (Indicator: "aes"; File: "4a904fb10fbf150e_0") file/memory contains long string with (Indicator: "aes"; File: "d006c09fff9156f7_0")4c:T520,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp")4d:T646,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp")4e:T519,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp")4f:Tde6,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp")50:T517,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp")51:T494,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp")52:T8d9,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000272.00000000.70256.00BF1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000272.00000000.70256.00BF1000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000396.00000000.70161.00B51000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000396.00000000.70161.00B51000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp")53:T9c2,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00000272.00000000.70256.00BFA000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00000272.00000000.70256.032C0000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00000396.00000000.70161.00B5A000.00000002.mdmp")54:Tdbc,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: 04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: zb5lr61.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: zb5lr61.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: zb5lr61.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: zb5lr61.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: zb5lr61.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Fp6XX19.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Fp6XX19.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Fp6XX19.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Fp6XX19.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Fp6XX19.exe] Observed import api "DeleteAce" which can "Deletes an access control entry (ACE) from an access control list (ACL)" [Source: pt999MH.exe] Observed import api "DeleteAce" which can "Deletes an access control entry (ACE) from an access control list (ACL)" [Source: xZ74Qx7.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: vV4ug45.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: vV4ug45.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: vV4ug45.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: vV4ug45.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: vV4ug45.exe] Observed import api "DeleteAce" which can "Deletes an access control entry (ACE) from an access control list (ACL)" [Source: 2560417.exe]55:T1079,"04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\ZB5LR61.EXE"; Value: "") "04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\ZSB8OZ6.EXE"; Value: "") "zb5lr61.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\FP6XX19.EXE"; Value: "") "zb5lr61.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\XZ74QX7.EXE"; Value: "") "Fp6XX19.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\VV4UG45.EXE"; Value: "") "Fp6XX19.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\PT999MH.EXE"; Value: "") "vV4ug45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\2560417.EXE"; Value: "") "vV4ug45.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\8917152.EXE"; Value: "") "2560417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "2560417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "pt999MH.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "pt999MH.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "xZ74Qx7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "xZ74Qx7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "")56:T4d1,"zb5lr61.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\zb5lr61.exe]- [targetUID: 00000000-00007536] "Fp6XX19.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\Fp6XX19.exe]- [targetUID: 00000000-00000272] "pt999MH.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\pt999MH.exe]- [targetUID: 00000000-00007012] "xZ74Qx7.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\xZ74Qx7.exe]- [targetUID: 00000000-00000884] "vV4ug45.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\vV4ug45.exe]- [targetUID: 00000000-00000272] "2560417.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\2560417.exe]- [targetUID: 00000000-00007216] "zSB8Oz6.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\zSB8Oz6.exe]- [targetUID: 00000000-00007236] "8917152.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP003.TMP\8917152.exe]- [targetUID: 00000000-00006748]57:T106a,Dropped file: "8917152.exe.log" - Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0\UsageLogs\8917152.exe.log]- [targetUID: 00000000-00006748] Dropped file: "000009.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000009.log]- [targetUID: 00000000-00006900] Dropped file: "000013.ldb" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000013.ldb]- [targetUID: 00000000-00006900] Dropped file: "000014.ldb" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000014.ldb]- [targetUID: 00000000-00006900] Dropped file: "000003.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00008184] Dropped file: "f7612ec27b8d8b43_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\f7612ec27b8d8b43_0]- [targetUID: 00000000-00006900] Dropped file: "f_0004c7" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c7]- [targetUID: 00000000-00007540] Dropped file: "407bc1a1-b2bd-468a-a5a7-54934c19ce8e.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\407bc1a1-b2bd-468a-a5a7-54934c19ce8e.tmp]- [targetUID: 00000000-00006900] Dropped file: "f_0004c3" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c3]- [targetUID: 00000000-00007540] Dropped file: "449babc3-12d5-48e6-8600-f987c726b410.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\449babc3-12d5-48e6-8600-f987c726b410.tmp]- [targetUID: 00000000-00006900] Dropped file: "cd88d053-6e47-4b12-8b1e-b807c89841f6.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\cd88d053-6e47-4b12-8b1e-b807c89841f6.tmp]- [targetUID: 00000000-00006900] Dropped file: "2a89a528-6bab-4527-9683-e1e69f62f23a.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\2a89a528-6bab-4527-9683-e1e69f62f23a.tmp]- [targetUID: 00000000-00006900] Dropped file: "4724135a-65db-4eb4-9f3b-c18aaf1045d1.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\4724135a-65db-4eb4-9f3b-c18aaf1045d1.tmp]- [targetUID: 00000000-00006900] Dropped file: "80a23cb9-4442-49f8-9aa2-a37f736c5788.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\80a23cb9-4442-49f8-9aa2-a37f736c5788.tmp]- [targetUID: 00000000-00006900] Dropped file: "30945838-3494-48a8-9c82-c9de75738798.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\30945838-3494-48a8-9c82-c9de75738798.tmp]- [targetUID: 00000000-00006900] Dropped file: "f2574aba-d367-44cd-a3d9-d6865d1b6751.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\f2574aba-d367-44cd-a3d9-d6865d1b6751.tmp]- [targetUID: 00000000-00006900] Dropped file: "42a809c57dccac15_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\42a809c57dccac15_0]- [targetUID: 00000000-00006900] Dropped file: "f_0004c5" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c5]- [targetUID: 00000000-00007540] Dropped file: "cf7d69b2-6b31-4486-887c-7a3371450cb2.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\cf7d69b2-6b31-4486-887c-7a3371450cb2.tmp]- [targetUID: 00000000-00004300] Dropped file: "448fc57b59f16c91_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\448fc57b59f16c91_0]- [targetUID: 00000000-00006900] Dropped file: "d0ffaf660e8db796_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\d0ffaf660e8db796_0]- [targetUID: 00000000-00006900] Dropped file: "b5642caa999cf879_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\b5642caa999cf879_0]- [targetUID: 00000000-00006900] Dropped file: "6e793be3d8efec58_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\6e793be3d8efec58_0]- [targetUID: 00000000-00006900] Dropped file: "e78fb570e293c9d7_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\e78fb570e293c9d7_0]- [targetUID: 00000000-00006900] Dropped file: "f_0004c9" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c9]- [targetUID: 00000000-00007540]58:T4ea,"04b84c79663129ed4a038d47747bd220a0216c7ab97098f7e7c8d2ff00525e89.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "zb5lr61.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "Fp6XX19.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "vV4ug45.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "2560417.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "8917152.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "pt999MH.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "xZ74Qx7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "zSB8Oz6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1")59:T4001,"initAft()