26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T499,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample 1d1685c4b298… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1d1685c4b298…. Malware family: Crifi.Generic. Threat score 100/100. 7/25 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1d1685c4b298ccddbddc67e03a2bc252ba9cd8381a7c45638cfef438f47e3e22","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","1d1685c4b298ccddbddc67e03a2bc252ba9cd8381a7c45638cfef438f47e3e22"],"about":{"@type":"SoftwareApplication","name":"99d8531ceddafcad188371202030c728.exe","applicationCategory":["peexe","executable"],"identifier":"1d1685c4b298ccddbddc67e03a2bc252ba9cd8381a7c45638cfef438f47e3e22","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":7,"total":25},"behavioralIndicators":{"malicious":7,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5e0,"99d8531ceddafcad188371202030c728.exe" called "FindResourceA" with parameter "17109624" - (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "FindResourceA" with parameter "17109632" - (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "FindResourceA" with parameter "17109660" - (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "FindResourceA" with parameter "17109872" - (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "FindResourceA" with parameter "17109688" - (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "FindResourceA" with parameter "17109844" - (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "FindResourceA" with parameter "17109856" - (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "FindResourceA" with parameter "8911528" - (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "FindResourceA" with parameter "17109740" - (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "FindResourceA" with parameter "17109836" - (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "FindResourceA" with parameter "8911524" - (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "FindResourceA" with parameter "17109704" - (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "FindResourceA" with parameter "17109712" - (UID: 00000000-00004540)28:Tb88,"99d8531ceddafcad188371202030c728.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17156224'}" (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17156080'}" (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17156240'}" (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17156128'}" (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17156096'}" (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17156144'}" (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17156192'}" (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17156064'}" (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17156176'}" (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17156208'}" (UID: 00000000-00004540) "st5Cg19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1362048'}" (UID: 00000000-00002916) "st5Cg19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1361904'}" (UID: 00000000-00002916) "st5Cg19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1362064'}" (UID: 00000000-00002916) "st5Cg19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1361952'}" (UID: 00000000-00002916) "st5Cg19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1361920'}" (UID: 00000000-00002916) "st5Cg19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1361968'}" (UID: 00000000-00002916) "st5Cg19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1362016'}" (UID: 00000000-00002916) "st5Cg19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1361888'}" (UID: 00000000-00002916) "st5Cg19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1362000'}" (UID: 00000000-00002916) "st5Cg19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1362032'}" (UID: 00000000-00002916) "qE5bs90.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11585664'}" (UID: 00000000-00006680) "qE5bs90.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11585520'}" (UID: 00000000-00006680) "qE5bs90.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11585680'}" (UID: 00000000-00006680)29:T4e2,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp")2a:T507,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp")2b:T410,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp")2c:T488,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Reads the cryptographic machine GUID2d:T203f,"99d8531ceddafcad188371202030c728.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004540) "st5Cg19.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002916) "st5Cg19.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002916) "qE5bs90.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006680) "qE5bs90.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006680) "dj6Ma16.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007228) "dj6Ma16.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007228) "1ow92Oz4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000a801cd0d0000000000000101dd0000000000b400b00db400000eb400b8827c030f00000040fd4201000000009e29e27708dd7c0300000000000800000008000000007a0388fd42010000000050000000000000000000000000000000d007b4002000000028fd42017f21f70090ba7c031cba7c0302000000000000000d00000020fd4201bb2ff700f80d01015cfd42018e1ef700020000007e1ef7002e9cd75b02000000a0c8fd000d0000000000000030fd42013706e17714fe4201202df600baeb955bfeffffff7e1ef7002d1ff70070fd42018cfd420174fd420102000000020000000800000094fd42012022f700020000008cfd4201 (UID: 00000000-00007376) "1ow92Oz4.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007376) "1ow92Oz4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007376) "1ow92Oz4.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007376) "2qH8397.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004000)2e:Td49,"99d8531ceddafcad188371202030c728.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007df973b09da9000000000058f987002447f973b09da900b0f98700d527f973b09da90001000000f96f4a8a00000000c1f32a44000000000300000064fa87000a000000640d0000a8fa8700e0f987005f0000000300000068f9870070f987007cfc87005059f973c98636f9feffffffbcfa870047f2f773c1f32a4400000000 (UID: 00000000-00004540) "st5Cg19.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007df973e8ae8e0200000000c0f95e002447f973e8ae8e0218fa5e00d527f973e8ae8e0201000000c9cbf9b900000000f4b6ec280000000003000000ccfa5e000a000000e41a000010fb5e0048fa5e005b00000003000000d0f95e00d8f95e00e4fc5e005059f97351215ccafeffffff24fb5e0047f2f773f4b6ec2800000000 (UID: 00000000-00002916) "qE5bs90.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007df97388ae94000000000008f534002447f97388ae940060f53400d527f97388ae9400010000006bc8fbbd000000008ee6d52c000000000300000014f634000a0000000017000058f6340090f534005b0000000300000018f5340020f534002cf834005059f9738b2d34cefeffffff6cf6340047f2f7738ee6d52c00000000 (UID: 00000000-00006680) "dj6Ma16.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f95e00cc7df97388aef4020000000058f95e002447f97388aef402b0f95e00d527f97388aef40201000000f92dc4e60000000059a4283f000000000300000064fa5e000a00000094180000a8fa5e00e0f95e005d0000000300000068f95e0070f95e0078fc5e005059f973c9c46195feffffffb8fa5e0047f2f77359a4283f (UID: 00000000-00007228) "2qH8397.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000001e83b0007370b000fcf71f01a070b000b0f71f01c428b10012000000aca2b0000000000010000000c428b10012000000aca2b000a07cb00006000000027eb000060000005a7eb000019eb00046bdb000fcf71f01217eb00008f81f0178044305c428b100120000000600000045c3b000 (UID: 00000000-00004000) "2qH8397.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000f71f013800000000000000000000005e1c99009f029900fcf71f01cc029900b0f71f01606bab00ac0000002c6f99004000000010000000606bab00ac0000002c6f9900841399000e000000421799000e0000009a179900016a990042c89900fcf71f016117990008f81f015c045305606bab00ac0000000e00000089ce9900 (UID: 00000000-00004000) "2qH8397.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000005305b1ff98004c275305b0180100000053050040010018d6ad0054f7000054f70000edff980000405305000001000cd6ad00b800990010f61f01f030c10000e0980054f7000010f61f01cb0299007ed3b000efd3b00000e09800f030c1005027530578f81f0128f61f0100e098000100000000000000a4a49e0046020000 (UID: 00000000-00004000) "2qH8397.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000005c0000000000630000000000000001000000740014000000c0fc3e03000000000100000001000000000000002c0000003067400300000000140000000a000000000000000000000000006f00e8733f0314000000000000000000000000000000000000000000000000006e00000000006700000017000017 (UID: 00000000-00004000) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f006e0000005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e00660069006700050000059d4700006805e402b05fe4022e0063006f006e006600690067000000f834e402 (UID: 00000000-00003760)2f:T612,"99d8531ceddafcad188371202030c728.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "99d8531ceddafcad188371202030c728.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "st5Cg19.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "st5Cg19.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "qE5bs90.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "qE5bs90.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "dj6Ma16.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "dj6Ma16.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1ow92Oz4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1ow92Oz4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2qH8397.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2qH8397.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")30:T8e6,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API "1736516288,6884,3024,,RtlGetVersion,NTDLL.dll,"00:17:37.968",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp")31:T3be5,"99d8531ceddafcad188371202030c728.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00004540) "99d8531ceddafcad188371202030c728.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004540) "st5Cg19.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002916) "st5Cg19.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002916) "st5Cg19.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002916) "st5Cg19.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002916) "st5Cg19.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002916) "st5Cg19.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00002916) "st5Cg19.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002916) "qE5bs90.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006680) "qE5bs90.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006680) "qE5bs90.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006680) "qE5bs90.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006680) "qE5bs90.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006680) "qE5bs90.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00006680) "qE5bs90.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00006680) "dj6Ma16.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007228) "dj6Ma16.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007228) "dj6Ma16.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007228) "dj6Ma16.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007228) "dj6Ma16.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007228) "dj6Ma16.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007228) "dj6Ma16.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00007228) "1ow92Oz4.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007376) "1ow92Oz4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007376) "1ow92Oz4.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007376) "1ow92Oz4.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007376) "1ow92Oz4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007376) "1ow92Oz4.exe" called "LoadLibrary" with a parameter %TEMP%\IXP003.TMP\1ow92Oz4.exe (UID: 00000000-00007376) "1ow92Oz4.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00007376) "1ow92Oz4.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007376) "1ow92Oz4.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00007376) "1ow92Oz4.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00007376) "1ow92Oz4.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00007376) "1ow92Oz4.exe" called "LoadLibrary" with a parameter MLANG.dll (UID: 00000000-00007376) "1ow92Oz4.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00007376) "1ow92Oz4.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00007376) "1ow92Oz4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00007376) "2qH8397.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter SHFolder.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter %TEMP%\IXP003.TMP\2qH8397.ENU (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter %TEMP%\IXP003.TMP\2qH8397.EN (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004000) "2qH8397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004000) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003760) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00003760)32:T1497,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000588.00000000.77947.03530000.00000004.mdmp, 00000000-00000588.00000001.79868.03530000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000588.00000000.77947.03530000.00000004.mdmp, 00000000-00000588.00000001.79868.03530000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002544.00000000.77865.02C00000.00000004.mdmp, 00000000-00002544.00000001.79783.02C00000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002544.00000000.77865.02C00000.00000004.mdmp, 00000000-00002544.00000001.79783.02C00000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002620.00000000.77846.02E90000.00000004.mdmp, 00000000-00002620.00000001.79764.02E90000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002620.00000000.77846.02E90000.00000004.mdmp, 00000000-00002620.00000001.79764.02E90000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000000.67979.02B30000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found reference to API "ateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found reference to API "1738854190,6884,3136,,CreateProcessA,kernel32.dll,"00:17:37.968",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003100.00000000.77993.02B50000.00000004.mdmp, 00000000-00003100.00000001.79913.02B50000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003100.00000000.77993.02B50000.00000004.mdmp, 00000000-00003100.00000001.79913.02B50000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003752.00000000.77906.03390000.00000004.mdmp, 00000000-00003752.00000001.79826.03390000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003752.00000000.77906.03390000.00000004.mdmp, 00000000-00003752.00000001.79826.03390000.00000004.mdmp") Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003760.00000000.69444.02E40000.00000004.mdmp, 00000000-00003760.00000001.71364.02E40000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003760.00000000.69444.02E40000.00000004.mdmp, 00000000-00003760.00000001.71364.02E40000.00000004.mdmp, 00000000-00003760.00000002.73284.02E40000.00000004.mdmp")33:T41a,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp")34:T50c,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp")35:Ta954,Found reference to API (Indicator: "CheckTokenMembership"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "DecryptFileA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "FreeSid"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "EqualSid"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "RegCloseKey"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "FindNextFileA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "FindClose"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "LocalAlloc"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "lstrcmpA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "CompareStringA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetLastError"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "DeleteFileA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GlobalFree"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "CloseHandle"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetProcAddress"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GlobalLock"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "LocalFree"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "FreeLibrary"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "ReadFile"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "SizeofResource"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "WriteFile"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "SetFileTime"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "SetFilePointer"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "FindResourceA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "CreateMutexA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "FreeResource"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetVersion"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetTempPathA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "CreateFileA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "SetEvent"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "TerminateThread"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetVersionExA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "LockResource"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "CreateThread"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "ResetEvent"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "LoadResource"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "ExitProcess"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "CreateProcessA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "FormatMessageA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "CreateEventA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "CharUpperA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "MessageBeep"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "CharPrevA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "LoadStringA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "CharNextA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "EnableWindow"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "ReleaseDC"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "PeekMessageA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "SendMessageA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "MessageBoxA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "ShowWindow"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "SetWindowPos"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetDC"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetWindowRect"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "Sleep"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "TerminateProcess"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetTickCount"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "MulDiv"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API (Indicator: "InitializeConditionVariable"; File: "00000000-00003760.00000000.69444.00921000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "00000000-00003760.00000000.69444.00921000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "00000000-00003760.00000000.69444.00921000.00000020.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00000588.00000000.77947.03530000.00000004.mdmp, 00000000-00000588.00000001.79868.03530000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00002544.00000000.77865.02C00000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00002544.00000001.79783.02C00000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00002620.00000001.79764.02E90000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00002620.00000001.79764.02E90000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp, 00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00002916.00000001.69900.00141000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002916.00000001.69900.00141000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00002916.00000001.69900.00141000.00000020.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00003100.00000001.79913.02B50000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00003752.00000000.77906.03390000.00000004.mdmp, 00000000-00003752.00000001.79826.03390000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00003752.00000001.79826.03390000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00003752.00000001.79826.03390000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00003760.00000000.69444.00921000.00000020.mdmp, 00000000-00003760.00000001.71364.72C21000.00000020.mdmp, 00000000-00003760.00000002.73284.6F6D1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00003760.00000000.69444.00921000.00000020.mdmp, 00000000-00003760.00000001.71364.72C21000.00000020.mdmp, 00000000-00003760.00000002.73284.6F6D1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00003760.00000000.69444.00921000.00000020.mdmp, 00000000-00003760.00000001.71364.72C21000.00000020.mdmp, 00000000-00003760.00000002.73284.6F6D1000.00000020.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00003760.00000000.69444.02E40000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00003760.00000000.69444.02E40000.00000004.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00003760.00000001.71364.72C21000.00000020.mdmp, 00000000-00003760.00000002.73284.6F6D1000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00003760.00000001.71364.72C21000.00000020.mdmp, 00000000-00003760.00000002.73284.6F6D1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00003760.00000001.71364.72C21000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00003760.00000001.71364.72C21000.00000020.mdmp, 00000000-00003760.00000002.73284.6F6D1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00003760.00000001.71364.72C21000.00000020.mdmp, 00000000-00003760.00000002.73284.6F6D1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00003760.00000001.71364.72C21000.00000020.mdmp, 00000000-00003760.00000002.73284.6F6D1000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00003760.00000001.71364.72C21000.00000020.mdmp, 00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F6D1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00003760.00000001.71364.72C21000.00000020.mdmp, 00000000-00003760.00000002.73284.6F6D1000.00000020.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00003760.00000002.73284.070F0000.00000004.mdmp")36:T757,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp")37:T405,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "99d8531ceddafcad188371202030c728.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002544.00000000.77865.00931000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002620.00000001.79764.00931000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003760.00000001.71364.72C35000.00000002.mdmp, 00000000-00003760.00000002.73284.6F761000.00000002.mdmp")38:T1629,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 99d8531ceddafcad188371202030c728.exe "DSystem\CurrentControlSet\Control\Session Manager" in Source: 99d8531ceddafcad188371202030c728.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 99d8531ceddafcad188371202030c728.exe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 99d8531ceddafcad188371202030c728.exe "System\CurrentControlSet\Control\Session Manager" in Source: 11617-17-0040256D "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 27246-214-009285B0 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 27246-214-009285B0 "SOFTWARE\Microsoft\PowerShell\3" in Source: 27246-196-0092BFA2 "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 27246-159-0092D560 "SOFTWARE\Microsoft\PowerShell" in Source: 27246-207-00928AF0 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 27246-194-00928190 "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00002916.00000001.69900.00141000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00003760.00000000.69444.00921000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00003760.00000000.69444.00921000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00003760.00000000.69444.00921000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00003760.00000000.69444.00921000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00003760.00000000.69444.00921000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003760.00000000.69444.00921000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003760.00000001.71364.02E40000.00000004.mdmp 00000000-00003760.00000002.73284.02E40000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003760.00000001.71364.02E40000.00000004.mdmp 00000000-00003760.00000001.71364.02F1B000.00000004.mdmp 00000000-00003760.00000002.73284.02E40000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00003760.00000001.71364.04BA0000.00000004.mdmp39:Tab7,"1ow92Oz4.exe" failed to load missing module "%WINDIR%\System32\Windows.UI.AppDefaults.dll" - [base:0; Status:c0000135] "2qH8397.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "2qH8397.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "2qH8397.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "2qH8397.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "2qH8397.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "2qH8397.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135]3a:Tf8a,Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "99d8531ceddafcad188371202030c728.exe") file/memory contains long string with (Indicator: "youtube"; File: "9870c602912cbae0_1") file/memory contains long string with (Indicator: "youtube"; File: "ed14653e3e5610f3_0") file/memory contains long string with (Indicator: "youtube"; File: "c08d6b2d5449a572_0") file/memory contains long string with (Indicator: "youtube"; File: "766415f99b4c6b7d_0") file/memory contains long string with (Indicator: "youtube"; File: "be57e96208f23f53_0") Found string "_keyhttps://www.youtube.com/s/desktop/f4449159/jsbin/web-animations-next-lite.min.vflset/web-animations-next-lite.min.js https://youtube.com/" (Indicator: "youtube"; File: "7ef92bd11684f66a_0") Found string "_keyhttps://www.youtube.com/s/desktop/f4449159/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js https://youtube.com/" (Indicator: "youtube"; File: "1cfabfb9f3622fa4_0") Found string "_keyhttps://www.youtube.com/s/desktop/f4449159/jsbin/intersection-observer.min.vflset/intersection-observer.min.js https://youtube.com/" (Indicator: "youtube"; File: "14d44a83af9e31b2_0") Found string "_keyhttps://www.youtube.com/s/desktop/f4449159/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.js https://youtube.com/" (Indicator: "youtube"; File: "f91bd584a584d4ed_0") Found string "_keyhttps://www.youtube.com/s/desktop/f4449159/jsbin/webcomponents-sd.vflset/webcomponents-sd.js https://youtube.com/" (Indicator: "youtube"; File: "7df6793dfb977880_0") Found string "_keyhttps://www.youtube.com/s/desktop/f4449159/jsbin/desktop_polymer.vflset/desktop_polymer.js https://youtube.com/"}wH" (Indicator: "youtube"; File: "f339c8b9bf1770dd_0"), Found string "_keyhttps://www.youtube.com/s/desktop/f4449159/jsbin/www-tampering.vflset/www-tampering.js https://youtube.com/G'5#+|lw" (Indicator: "youtube"; File: "018200413242a500_0"), Found string "_keyhttps://www.youtube.com/s/player/4fd50162/player_ias.vflset/en_US/inline_preview.js https://youtube.com/" (Indicator: "youtube"; File: "bc9640ee1e222c9d_0"), Found string "_keyhttps://www.youtube.com/s/player/4fd50162/player_ias.vflset/en_US/miniplayer.js https://youtube.com/" (Indicator: "youtube"; File: "4c9a08ed72147a23_0"), Found string "_keyhttps://www.youtube.com/s/desktop/f4449159/jsbin/scheduler.vflset/scheduler.js https://youtube.com//NXMF{]" (Indicator: "youtube"; File: "26089b65e6b8b9ca_0"), Found string "_keyhttps://www.youtube.com/s/player/4fd50162/player_ias.vflset/en_US/endscreen.js https://youtube.com/" (Indicator: "youtube"; File: "d4d113f1fb8c7575_0"), Found string "_keyhttps://www.youtube.com/s/player/4fd50162/player_ias.vflset/en_US/heartbeat.js https://youtube.com/" (Indicator: "youtube"; File: "e0807322fe4d94ee_0"), Found string "_keyhttps://www.youtube.com/s/player/4fd50162/player_ias.vflset/en_US/offline.js https://youtube.com/" (Indicator: "youtube"; File: "e7b68ec6a844259d_0"), Found string "_keyhttps://www.google.com/js/th/UhAHYkQc59SMm3ILQvX2LV9pHtXm_t6HT06w3DJ-zT8.js https://youtube.com/hh{#$q7Z1S7h[9" (Indicator: "youtube"; File: "e774516746b2cd9c_0"), Found string "_keyhttps://www.youtube.com/s/player/4fd50162/player_ias.vflset/en_US/remote.js https://youtube.com/" (Indicator: "youtube"; File: "43d2954fff2a5112_0"), Found string "_keyhttps://www.youtube.com/s/desktop/f4449159/jsbin/network.vflset/network.js https://youtube.com/.+;^" (Indicator: "youtube"; File: "67ea55549cd59788_0"), Found string "_keyhttps://www.youtube.com/s/player/4fd50162/player_ias.vflset/en_US/base.js https://youtube.com/R={J" (Indicator: "youtube"; File: "e653a61f22390c57_0"), Found string "_keyhttps://www.youtube.com/s/desktop/f4449159/jsbin/spf.vflset/spf.js https://youtube.com/*Ka>s`8b" (Indicator: "youtube"; File: "f383b6fed32aa9bf_0"), Found string "_keyhttps://www.gstatic.com/eureka/clank/107/cast_sender.js https://youtube.com/TNR1" (Indicator: "youtube"; File: "6b55a95a8461dae9_0")3b:T3513,"99d8531ceddafcad188371202030c728.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76310000 "99d8531ceddafcad188371202030c728.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76310000 "99d8531ceddafcad188371202030c728.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76310000 "99d8531ceddafcad188371202030c728.exe" loaded module "KERNEL32" at base 76120000 "99d8531ceddafcad188371202030c728.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73f20000 "99d8531ceddafcad188371202030c728.exe" loaded module "KERNEL32.DLL" at base 76120000 "99d8531ceddafcad188371202030c728.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74940000 "99d8531ceddafcad188371202030c728.exe" loaded module "FECLIENT.DLL" at base 73810000 "99d8531ceddafcad188371202030c728.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 737e0000 "99d8531ceddafcad188371202030c728.exe" loaded module "NTDLL.DLL" at base 77de0000 "99d8531ceddafcad188371202030c728.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74750000 "st5Cg19.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76310000 "st5Cg19.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76310000 "st5Cg19.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76310000 "st5Cg19.exe" loaded module "KERNEL32" at base 76120000 "st5Cg19.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73f20000 "st5Cg19.exe" loaded module "KERNEL32.DLL" at base 76120000 "st5Cg19.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74940000 "st5Cg19.exe" loaded module "FECLIENT.DLL" at base 73810000 "st5Cg19.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 737e0000 "st5Cg19.exe" loaded module "NTDLL.DLL" at base 77de0000 "st5Cg19.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74750000 "qE5bs90.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76310000 "qE5bs90.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76310000 "qE5bs90.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76310000 "qE5bs90.exe" loaded module "KERNEL32" at base 76120000 "qE5bs90.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73f20000 "qE5bs90.exe" loaded module "KERNEL32.DLL" at base 76120000 "qE5bs90.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74940000 "qE5bs90.exe" loaded module "FECLIENT.DLL" at base 73810000 "qE5bs90.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 737e0000 "qE5bs90.exe" loaded module "NTDLL.DLL" at base 77de0000 "qE5bs90.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74750000 "dj6Ma16.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76310000 "dj6Ma16.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76310000 "dj6Ma16.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76310000 "dj6Ma16.exe" loaded module "KERNEL32" at base 76120000 "dj6Ma16.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73f20000 "dj6Ma16.exe" loaded module "KERNEL32.DLL" at base 76120000 "dj6Ma16.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74940000 "dj6Ma16.exe" loaded module "FECLIENT.DLL" at base 73810000 "dj6Ma16.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 737e0000 "dj6Ma16.exe" loaded module "NTDLL.DLL" at base 77de0000 "dj6Ma16.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74750000 "1ow92Oz4.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76310000 "1ow92Oz4.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76310000 "1ow92Oz4.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76310000 "1ow92Oz4.exe" loaded module "KERNEL32" at base 76120000 "1ow92Oz4.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73f20000 "1ow92Oz4.exe" loaded module "KERNEL32.DLL" at base 76120000 "1ow92Oz4.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74280000 "1ow92Oz4.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 76310000 "1ow92Oz4.exe" loaded module "COMCTL32.DLL" at base 72a00000 "1ow92Oz4.exe" loaded module "COMCTL32" at base 72a00000 "1ow92Oz4.exe" loaded module "RPCRT4.DLL" at base 77cb0000 "1ow92Oz4.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 731c0000 "1ow92Oz4.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76120000 "1ow92Oz4.exe" loaded module "USER32.DLL" at base 764f0000 "1ow92Oz4.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.SHELL.SERVICEHOSTBUILDER.DLL" at base 72df0000 "1ow92Oz4.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 71e90000 "1ow92Oz4.exe" loaded module "PROPSYS.DLL" at base 73d50000 "1ow92Oz4.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73d50000 "1ow92Oz4.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 76680000 "1ow92Oz4.exe" loaded module "SECUR32.DLL" at base 72d60000 "1ow92Oz4.exe" loaded module "SSPICLI.DLL" at base 74800000 "1ow92Oz4.exe" loaded module "MLANG.DLL" at base 72d20000 "1ow92Oz4.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 77770000 "1ow92Oz4.exe" loaded module "WININET.DLL" at base 73500000 "1ow92Oz4.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.APPDEFAULTS.DLL" at base 0 "1ow92Oz4.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76e50000 "1ow92Oz4.exe" loaded module "NTDLL.DLL" at base 77de0000 "1ow92Oz4.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74750000 "1ow92Oz4.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 73fe0000 "1ow92Oz4.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 74890000 "2qH8397.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76310000 "2qH8397.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76310000 "2qH8397.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76310000 "2qH8397.exe" loaded module "KERNEL32" at base 76120000 "2qH8397.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73f20000 "2qH8397.exe" loaded module "COMCTL32.DLL" at base 72a00000 "2qH8397.exe" loaded module "SHFOLDER.DLL" at base 737a0000 "2qH8397.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74280000 "2qH8397.exe" loaded module "KERNEL32.DLL" at base 76120000 "2qH8397.exe" loaded module "RPCRT4.DLL" at base 77cb0000 "2qH8397.exe" loaded module "SSPICLI.DLL" at base 74800000 "2qH8397.exe" loaded module "ADVAPI32.DLL" at base 74940000 "2qH8397.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73710000 "2qH8397.exe" loaded module "SHLWAPI.DLL" at base 76d70000 "2qH8397.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74890000 "2qH8397.exe" loaded module "VERSION.DLL" at base 74540000 "2qH8397.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72f60000 "2qH8397.exe" loaded module "USER32.DLL" at base 764f0000 "2qH8397.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76310000 "2qH8397.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "2qH8397.exe" loaded module "MSCOREE.DLL" at base 737b0000 "2qH8397.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76680000 "2qH8397.exe" loaded module "PSAPI.DLL" at base 77d70000 "2qH8397.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 715f0000 "2qH8397.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "2qH8397.exe" loaded module "OLE32.DLL" at base 76940000 "2qH8397.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "2qH8397.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76680000 "2qH8397.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76310000 "2qH8397.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72e00000 "2qH8397.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70b90000 "2qH8397.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 70370000 "2qH8397.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "2qH8397.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 72cf0000 "2qH8397.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6fbf0000 "2qH8397.exe" loaded module "NTDLL.DLL" at base 77de0000 "2qH8397.exe" loaded module "SHELL32.DLL" at base 74d10000 "2qH8397.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "2qH8397.exe" loaded module "BCRYPT.DLL" at base 73b20000 "2qH8397.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72ca0000 "2qH8397.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "2qH8397.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74750000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76310000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76310000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76310000 "powershell.exe" loaded module "KERNEL32" at base 76120000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73f20000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 74940000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73710000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 76d70000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74890000 "powershell.exe" loaded module "VERSION.DLL" at base 74540000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72f60000 "powershell.exe" loaded module "USER32.DLL" at base 764f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76310000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 737b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76680000 "powershell.exe" loaded module "PSAPI.DLL" at base 77d70000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76120000 "powershell.exe" loaded module "RPCRT4.DLL" at base 77cb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 715f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 76940000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76680000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 748a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72ca0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 77d80000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76310000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72e00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70b90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 70370000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 76680000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 76680000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77de0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 74d10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6fbf0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 76d200003c:T46e,"99d8531ceddafcad188371202030c728.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77D80000 "99d8531ceddafcad188371202030c728.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B20000 "st5Cg19.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77D80000 "st5Cg19.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B20000 "qE5bs90.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77D80000 "qE5bs90.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B20000 "dj6Ma16.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77D80000 "dj6Ma16.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B20000 "1ow92Oz4.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77D80000 "1ow92Oz4.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B20000 "2qH8397.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77D80000 "2qH8397.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B20000 "powershell.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77D80000 "powershell.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73B200003d:Tdc4,"99d8531ceddafcad188371202030c728.exe" was detected as "Microsoft Cabinet" and name: "sfx" "99d8531ceddafcad188371202030c728.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "99d8531ceddafcad188371202030c728.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "99d8531ceddafcad188371202030c728.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "99d8531ceddafcad188371202030c728.exe" was detected as "Microsoft Linker" and name: "Linker" "st5Cg19.exe" was detected as "Microsoft Cabinet" and name: "sfx" "st5Cg19.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "st5Cg19.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "st5Cg19.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "st5Cg19.exe" was detected as "Microsoft Linker" and name: "Linker" "qE5bs90.exe" was detected as "Microsoft Cabinet" and name: "sfx" "qE5bs90.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "qE5bs90.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "qE5bs90.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "qE5bs90.exe" was detected as "Microsoft Linker" and name: "Linker" "dj6Ma16.exe" was detected as "Microsoft Cabinet" and name: "sfx" "dj6Ma16.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "dj6Ma16.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "dj6Ma16.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "dj6Ma16.exe" was detected as "Microsoft Linker" and name: "Linker" "FANBooster131.exe" was detected as "Microsoft Cabinet" and name: "sfx" "FANBooster131.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "FANBooster131.exe" was detected as "Microsoft Linker" and name: "Linker" "5Mw6gR2.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5Mw6gR2.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5Mw6gR2.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5Mw6gR2.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5Mw6gR2.exe" was detected as "Microsoft Linker" and name: "Linker" "3Xz08LJ.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3Xz08LJ.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3Xz08LJ.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3Xz08LJ.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3Xz08LJ.exe" was detected as "Microsoft Linker" and name: "Linker" "1ow92Oz4.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1ow92Oz4.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1ow92Oz4.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1ow92Oz4.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1ow92Oz4.exe" was detected as "Microsoft Linker" and name: "Linker" "6uY4pV3.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6uY4pV3.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6uY4pV3.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6uY4pV3.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6uY4pV3.exe" was detected as "Microsoft Linker" and name: "Linker"3e:Ta79,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp")3f:T1262,"99d8531ceddafcad188371202030c728.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "st5Cg19.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "qE5bs90.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "dj6Ma16.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "FANBooster131.exe" file has an entrypoint instructions - "jmp 0x86a352,add byte ptr [eax + 8], ah,add byte ptr [eax], al,pushal ,call 0x86a358,pop ebp,sub ebp, 0x10,sub ebp, 0x46a348,jmp 0x86a36e,push edx,mov eax, 0xa348b870,inc esi,add byte ptr [ebx], al,lds eax, ptr [ecx + 0x4cc0],add byte ptr [ecx + 0x620], bh,mov edx, 0x8c41a1d4,xor byte ptr [eax], dl,inc eax,dec ecx,jne 0x86a385,jmp 0x86a398,pop ss," "5Mw6gR2.exe" file has an entrypoint instructions - "jmp 0x7ff8b6,add ah, dh,add eax, 0,add byte ptr [eax - 0x18], ah,add byte ptr [eax], al,add byte ptr [eax], al,pop ebp,sub ebp, 0x10,sub ebp, 0x3ff8ac,jmp 0x7ff8d2,je 0x7ff888,push edi," "3Xz08LJ.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "1ow92Oz4.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "6uY4pV3.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,"40:T1002,Process "st5Cg19.exe" (UID: 00000000-00002916) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigation", PROCESSOR_ARCHITEW6432="AMD64"" Process "st5Cg19.exe" (UID: 00000000-00002916) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00006276) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "msedge.exe" (UID: 00000000-00006276) was launched with modified environment variables: "Path" Process "2qH8397.exe" (UID: 00000000-00004000) was launched with modified environment variables: "Path" Process "2qH8397.exe" (UID: 00000000-00004000) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, FPS_BROWSER_USER_PROFILE_STRING" Process "msedge.exe" (UID: 00000000-00006588) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_6276_HGNUHZNCDLRTVFTP", FPS_BROWSER_USER_PROFILE_STRING="Default", EDGE_BROWSER_PID="6276"" Process "msedge.exe" (UID: 00000000-00006588) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00006588) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00005652) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00002164) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT"" Process "powershell.exe" (UID: 00000000-00003760) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "powershell.exe" (UID: 00000000-00003760) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "powershell.exe" (UID: 00000000-00003760) was launched with missing environment variables: "CHROME_RESTART, FPS_BROWSER_APP_PROFILE_STRING, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, FPS_BROWSER_USER_PROFILE_STRING, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00006488) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_6276_HGNUHZNCDLRTVFTP", FPS_BROWSER_USER_PROFILE_STRING="Default", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="6276"" Process "msedge.exe" (UID: 00000000-00006488) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00006488) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "powershell.exe" (UID: 00000000-00002620) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "powershell.exe" (UID: 00000000-00002620) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "powershell.exe" (UID: 00000000-00002620) was launched with missing environment variables: "CHROME_RESTART, FPS_BROWSER_APP_PROFILE_STRING, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, FPS_BROWSER_USER_PROFILE_STRING, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID"41:T704,"99d8531ceddafcad188371202030c728.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "99d8531ceddafcad188371202030c728.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "99d8531ceddafcad188371202030c728.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "st5Cg19.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "st5Cg19.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "st5Cg19.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "qE5bs90.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "qE5bs90.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "qE5bs90.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "dj6Ma16.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "dj6Ma16.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "dj6Ma16.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1ow92Oz4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "1ow92Oz4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1ow92Oz4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1ow92Oz4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "2qH8397.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "2qH8397.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2qH8397.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")42:T10fc,Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"3,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"3,"System.Xml Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"3,"System.Configuration Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00004540-00000C25-52738824] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00004540-00000C25-52922439] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00004540-00000BC1-52956894] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00002916-00000BC1-53816380] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00006680-00000BC1-54677101] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00007228-00000BC1-55604209] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004000-00000C25-63546433] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004000-00000C25-66556027] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004000-00000C25-67358359] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004000-00000C25-68104284] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004000-00000C25-69267536] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004000-00000C25-69860796] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004000-00000C25-70023997] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004000-00000C25-70741079] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004000-00000C25-71596676] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00004000-00000C25-71769185] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00004000-00000C25-72057288] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00004000-00000C25-72959361] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00004000-00000C25-73210408] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00004000-00000C25-74361123] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00004000-00000C25-74904427]43:Tbd4,Spawned process "st5Cg19.exe" (UID: 00000000-00002916) Spawned process "qE5bs90.exe" (UID: 00000000-00006680) Spawned process "dj6Ma16.exe" (UID: 00000000-00007228) Spawned process "1ow92Oz4.exe" (UID: 00000000-00007376) Spawned process "msedge.exe" with commandline "--single-argument https://www.youtube.com/" (UID: 00000000-00006276) Spawned process "2qH8397.exe" (UID: 00000000-00004000) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00006588), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00005652), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00002164), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007020), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00002920), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00000352), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00007196), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00007932), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00007188), Spawned process "powershell.exe" with commandline ""powershell" Get-MpPreference -verbose" (UID: 00000000-00003760), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00006488), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00007824), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=audio.mojom.AudioService --lan ..." (UID: 00000000-00007252), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00007548), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00006072), Spawned process "msedge.exe" with commandline "--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu ..." (UID: 00000000-00004192), Spawned process "powershell.exe" with commandline "Set-MpPreference -DisableArchiveScanning $true" (UID: 00000000-00002620), Spawned process "powershell.exe" with commandline "Set-MpPreference -DisablePrivacyMode $true" (UID: 00000000-00002544), Spawned process "powershell.exe" with commandline "Set-MpPreference -DisableScriptScanning $true" (UID: 00000000-00007752)44:Tbd4,Spawned process "st5Cg19.exe" (UID: 00000000-00002916) Spawned process "qE5bs90.exe" (UID: 00000000-00006680) Spawned process "dj6Ma16.exe" (UID: 00000000-00007228) Spawned process "1ow92Oz4.exe" (UID: 00000000-00007376) Spawned process "msedge.exe" with commandline "--single-argument https://www.youtube.com/" (UID: 00000000-00006276) Spawned process "2qH8397.exe" (UID: 00000000-00004000) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00006588), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00005652), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00002164), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007020), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00002920), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00000352), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00007196), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00007932), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00007188), Spawned process "powershell.exe" with commandline ""powershell" Get-MpPreference -verbose" (UID: 00000000-00003760), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00006488), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00007824), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=audio.mojom.AudioService --lan ..." (UID: 00000000-00007252), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00007548), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00006072), Spawned process "msedge.exe" with commandline "--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu ..." (UID: 00000000-00004192), Spawned process "powershell.exe" with commandline "Set-MpPreference -DisableArchiveScanning $true" (UID: 00000000-00002620), Spawned process "powershell.exe" with commandline "Set-MpPreference -DisablePrivacyMode $true" (UID: 00000000-00002544), Spawned process "powershell.exe" with commandline "Set-MpPreference -DisableScriptScanning $true" (UID: 00000000-00007752)45:T704,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp")46:T5d5a,"st5Cg19.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\st5Cg19.exe]- [targetUID: 00000000-00002916] "qE5bs90.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\qE5bs90.exe]- [targetUID: 00000000-00006680] "dj6Ma16.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\dj6Ma16.exe]- [targetUID: 00000000-00006680] "FANBooster131.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- [targetUID: N/A] "5Mw6gR2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5Mw6gR2.exe]- [targetUID: 00000000-00002916] "urlref_httpswww.youtube.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "3Xz08LJ.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\3Xz08LJ.exe]- [targetUID: 00000000-00006680] "1ow92Oz4.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1ow92Oz4.exe]- [targetUID: 00000000-00007228] "6uY4pV3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\6uY4pV3.exe]- [targetUID: 00000000-00004540] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00003760] "FANBooster131.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Archive ctime=Fri Jan 5 18:54:49 2024 mtime=Fri Jan 5 18:54:49 2024 atime=Sat Jan 6 02:26:16 2024 length=1546240 window=hide"- [targetUID: N/A] "21f4153c313bcd49_1" has type "data"- [targetUID: N/A] "data_3" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3]- [targetUID: 00000000-00002164] "21f4153c313bcd49_0" has type "data"- [targetUID: N/A] "fc85335c80972bd8_1" has type "data"- [targetUID: N/A] "data_2" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2]- [targetUID: 00000000-00002164] "0" has type "exported SGML document ASCII text with very long lines"- [targetUID: N/A] "fc85335c80972bd8_0" has type "data"- [targetUID: N/A] "5480e4a42253b2b4_0" has type "data"- [targetUID: N/A] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1]- [targetUID: 00000000-00002164] "f_0004c5" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c5]- [targetUID: 00000000-00002164] "1510a40b-b559-458a-886a-ca1ce6368898.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 1287975160 gzip compressed data reserved method ASCII has comment encrypted from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 1287975160"- Location: [%TEMP%\1510a40b-b559-458a-886a-ca1ce6368898.tmp]- [targetUID: 00000000-00006276] "f_0004cc" has type "gzip compressed data max compression original size modulo 2^32 2480018"- [targetUID: N/A] "7502c6be18faa42e_1" has type "data"- [targetUID: N/A] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00006276] "0ae129c33e7a30bd_1" has type "data"- [targetUID: N/A] "0a41c5226f4ea45c_0" has type "data"- [targetUID: N/A] "9c72f2e4b7cb5e64_0" has type "data"- [targetUID: N/A] "4a116762e8761c87_1" has type "data"- [targetUID: N/A] "7502c6be18faa42e_0" has type "data"- [targetUID: N/A] "dfca2054b66c022f_1" has type "data"- [targetUID: N/A] "f_0004c4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c4]- [targetUID: 00000000-00002164] "0ae129c33e7a30bd_0" has type "data"- [targetUID: N/A] "data_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0]- [targetUID: 00000000-00002164] "4a116762e8761c87_0" has type "data"- [targetUID: N/A] "5adb92481aca08ab_1" has type "data"- [targetUID: N/A] "293fbb979ab942f8_1" has type "data"- [targetUID: N/A] "dfca2054b66c022f_0" has type "data"- [targetUID: N/A] "sslkey.txt" has type "ASCII text"- Location: [%TEMP%\sslkey.txt]- [targetUID: 00000000-00006276] "e44a0ab4-9363-410c-a84d-00985a40d9f5.tmp" has type "JSON data"- [targetUID: N/A] "ff6ae8e2ff523cc8_1" has type "data"- [targetUID: N/A] "f_0004cd" has type "data"- [targetUID: N/A] "b1467eea0ece75cc_1" has type "data"- [targetUID: N/A] "5adb92481aca08ab_0" has type "data"- [targetUID: N/A] "293fbb979ab942f8_0" has type "data"- [targetUID: N/A] "0a326454-c803-4a35-8f1b-c8d9b7a22c58.tmp" has type "UTF-8 Unicode text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\0a326454-c803-4a35-8f1b-c8d9b7a22c58.tmp]- [targetUID: 00000000-00006276] "f_0004c7" has type "RIFF (little-endian) data Web/P image VP8 encoding 720x404 Scaling: [none]x[none] YUV color decoders should clamp"- [targetUID: N/A] "fe11038b-acad-4122-9204-9b981c9f0af3.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "4dd170b3-73cd-475d-9546-70a27f27732a.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "d9e4bc01-d100-44a8-8320-36ee377e2e2b.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "96caa928-65c7-49eb-8d3d-25f2051cd1a0.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "82e2002d-2edd-4a0b-9802-60123da2621c.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "5b4fc793-4031-48f7-bd79-d3945b0fea42.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "54763073-1fca-495e-adb2-acba2c2a5e75.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "654804ac-7a1c-49ce-bf60-634e858b4868.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "519bdbcb-9ce2-403d-8605-03038b1154f9.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\519bdbcb-9ce2-403d-8605-03038b1154f9.tmp]- [targetUID: 00000000-00006276] "3be35605-c390-4d59-96c3-f9c405254c58.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\3be35605-c390-4d59-96c3-f9c405254c58.tmp]- [targetUID: 00000000-00006276] "9eb2606a4ecc536e_1" has type "data"- [targetUID: N/A] "f_0004ca" has type "RIFF (little-endian) data Web/P image VP8 encoding 720x404 Scaling: [none]x[none] YUV color decoders should clamp"- [targetUID: N/A] "f_0004c6" has type "data"- [targetUID: N/A] "f_0004cb" has type "RIFF (little-endian) data Web/P image VP8 encoding 720x404 Scaling: [none]x[none] YUV color decoders should clamp"- [targetUID: N/A] "ModuleAnalysisCache" has type "data"- [targetUID: N/A] "000004.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000004.log]- [targetUID: 00000000-00006276] "ff6ae8e2ff523cc8_0" has type "data"- [targetUID: N/A] "f_0004c9" has type "data"- [targetUID: N/A] "Cookies" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies]- [targetUID: 00000000-00002164] "b1467eea0ece75cc_0" has type "data"- [targetUID: N/A] "Reporting and NEL" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Reporting and NEL]- [targetUID: 00000000-00002164] "9eb2606a4ecc536e_0" has type "data"- [targetUID: N/A] "dd0569f7cce13cab_1" has type "data"- [targetUID: N/A] "f_0004cf" has type "data"- [targetUID: N/A] "f_0004ce" has type "data"- [targetUID: N/A] "d5e5fbb73c625e94_1" has type "data"- [targetUID: N/A] "f_0004d1" has type "data"- [targetUID: N/A] "89e39861-406e-40c8-a0f0-e6e0740ef960.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "0cc37bf5-634f-4cbb-a684-d54aa60838e7.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "e2e2a237-4624-4ceb-b55f-0bdbcd21c74b.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "f_0004c3" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c3]- [targetUID: 00000000-00002164] "a86f6368-8322-4bac-b369-257af1230134.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "56883f62-73ca-4149-ac9a-6a14854eba70.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "447ac51e-4b7d-4943-8e10-acb91c8af5e7.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\447ac51e-4b7d-4943-8e10-acb91c8af5e7.tmp]- [targetUID: 00000000-00006276] "4b3900da-9b41-43e6-b74b-5b1cc869e8eb.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "6cd360e1-ea30-4807-8eb8-9a5ebf8de082.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\6cd360e1-ea30-4807-8eb8-9a5ebf8de082.tmp]- [targetUID: 00000000-00006276] "StartupProfileData-NonInteractive" has type "data"- [targetUID: N/A] "30455d5fa758cb53_1" has type "data"- [targetUID: N/A] "f_0004d0" has type "data"- [targetUID: N/A] "f_0004c8" has type "PNG image data 1152 x 603 8-bit colormap non-interlaced"- [targetUID: N/A] "arbitration_service_config.json" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\arbitration_service_config.json]- [targetUID: 00000000-00006276] "dd0569f7cce13cab_0" has type "data"- [targetUID: N/A] "2a0afd649b00527b_0" has type "data"- [targetUID: N/A] "43369b51eb5ae0ed_1" has type "data"- [targetUID: N/A] "9c6cf49f853dad49_0" has type "data"- [targetUID: N/A] "3761f940ae901389_0" has type "data"- [targetUID: N/A] "2da03c4ec7cf74ae_0" has type "data"- [targetUID: N/A] "temp-index" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index]- [targetUID: 00000000-00006276] "d5e5fbb73c625e94_0" has type "data"- [targetUID: N/A] "f05d2360f77289a1_1" has type "data"- [targetUID: N/A] "30455d5fa758cb53_0" has type "data"- [targetUID: N/A] "2a0afd649b00527b_1" has type "data"- [targetUID: N/A] "8bea1db12ae72945_1" has type "data"- [targetUID: N/A] "555d296a-352b-4961-83a0-e26e391d4fd6.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "43369b51eb5ae0ed_0" has type "data"- [targetUID: N/A] "000004.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Session Storage\000004.log]- [targetUID: 00000000-00006276] "8bea1db12ae72945_0" has type "data"- [targetUID: N/A] "b5adca99b81aec6c_0" has type "data"- [targetUID: N/A] "f05d2360f77289a1_0" has type "data"- [targetUID: N/A] "e60eb196-8330-4edf-9eac-e42b5bd8e005.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "03c95cf4-6e3f-423f-95b7-2731b4789fd4.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "4bec9d39-452e-40a9-8e83-555523ecbc1d.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "7162e1d2493ab2a1_0" has type "data"- [targetUID: N/A] "9870c602912cbae0_1" has type "data"- [targetUID: N/A] "9870c602912cbae0_0" has type "data"- [targetUID: N/A] "1aca1f18437ce2af_0" has type "data"- [targetUID: N/A] "f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\TokenBroker\Cache\f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres]- [targetUID: 00000000-00006276] "temp-index" has type "data"- [targetUID: 00000000-00006276] "b506592c-3438-4e9d-98a5-35771fc2b1a4.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "2dd4c3bd-2957-4d5f-a109-468f1ca424f4.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "86d427b2-c977-475f-b7cc-536957c7eca4.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "bf7a8649fa9dbeb9_0" has type "data"- [targetUID: N/A] "003aab12-3272-4b9f-8897-357cf44b677f.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "2d2975f3-0c21-4d99-a663-2d9f463ef51d.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\2d2975f3-0c21-4d99-a663-2d9f463ef51d.tmp]- [targetUID: 00000000-00002164] "7b6785d9-2d5f-49b6-82aa-5ef8cf976b92.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "ed14653e3e5610f3_0" has type "data"- [targetUID: N/A] "12a088f5df51fc41_0" has type "data"- [targetUID: N/A] "a99747c743014393_0" has type "data"- [targetUID: N/A] "e7890cf39e18cf26_0" has type "data"- [targetUID: N/A] "b1a18341-7106-4794-aabe-b5bcaedee71d.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\b1a18341-7106-4794-aabe-b5bcaedee71d.tmp]- [targetUID: 00000000-00002164] "d0b40ffeb2fe39a6_0" has type "data"- [targetUID: N/A] "8798af3c84594e1b_0" has type "data"- [targetUID: N/A] "c85d3865b8a09bbd_0" has type "data"- [targetUID: N/A] "f835a9c68ede7223_0" has type "data"- [targetUID: N/A] "b39bb45419b60405_0" has type "data"- [targetUID: N/A] "ea620276acec5737_0" has type "data"- [targetUID: N/A] "0bef2a0adb368490_0" has type "data"- [targetUID: N/A] "1767a8b348839f1c_0" has type "data"- [targetUID: N/A] "ae7557eee904f6ed_0" has type "data"- [targetUID: N/A] "b25b3aae265ef44d_0" has type "data"- [targetUID: N/A] "2bcfe390dba90335_0" has type "data"- [targetUID: N/A] "2ee660419e7bb481_0" has type "data"- [targetUID: N/A] "b262aeaa780b5937_0" has type "data"- [targetUID: N/A] "3e7834d4964b8805_0" has type "data"- [targetUID: N/A] "2bf260df9eec0de3_0" has type "data"- [targetUID: N/A] "ef92fbea0aff4515_0" has type "data"- [targetUID: N/A] "8bcd9e8b0b746dec_0" has type "data"- [targetUID: N/A] "b9faf49cd63f59a6_0" has type "data"- [targetUID: N/A] "fc496558f77f6d37_0" has type "data"- [targetUID: N/A] "11ca329ff4409162_0" has type "data"- [targetUID: N/A] "d5b24d864da153a2_0" has type "data"- [targetUID: N/A] "1e109dc9985e23e3_0" has type "data"- [targetUID: N/A] "e4cb571d59fd7eb7_0" has type "data"- [targetUID: N/A] "8ef2564ddabd1ac9_0" has type "data"- [targetUID: N/A] "57c63dee16688cf9_0" has type "data"- [targetUID: N/A] "296a61baf34a477b_0" has type "data"- [targetUID: N/A] "c5c34262898c6925_0" has type "data"- [targetUID: N/A] "a6b2e6529740b47c_0" has type "data"- [targetUID: N/A] "232e8ce34b8361a8_0" has type "data"- [targetUID: N/A] "cccb4af9a32d559a_0" has type "data"- [targetUID: N/A] "b3f0e35eea4b0f24_0" has type "data"- [targetUID: N/A] "5da2fb196c265036_0" has type "data"- [targetUID: N/A] "4815725c8ce7cac2_0" has type "data"- [targetUID: N/A] "c22e1f4f0fd215b9_0" has type "data"- [targetUID: N/A] "c9e3e9d320c9c18e_0" has type "data"- [targetUID: N/A] "9f0570cf70573c01_0" has type "data"- [targetUID: N/A] "047389f836a23469_0" has type "data"- [targetUID: N/A] "df6fcc25dfcae313_0" has type "data"- [targetUID: N/A] "d109b9b7172fb490_0" has type "data"- [targetUID: N/A] "8d439ccb90934736_0" has type "data"- [targetUID: N/A] "45abe68dd5c5eef9_0" has type "data"- [targetUID: N/A] "b00e230b1666101f_0" has type "data"- [targetUID: N/A] "85ade39e4df78f89_0" has type "data"- [targetUID: N/A] "05dcb51db89022db_0" has type "data"- [targetUID: N/A] "9ab8f143aeb5e79f_0" has type "data"- [targetUID: N/A] "f80c5d3ceb7c8259_0" has type "data"- [targetUID: N/A] "73c023c4157dee87_0" has type "data"- [targetUID: N/A] "f40a64cbc66a4451_0" has type "data"- [targetUID: N/A] "f5c01eb9c70a0925_0" has type "data"- [targetUID: N/A] "1557b7fdc2795560_0" has type "data"- [targetUID: N/A] "676309ebc9bee713_0" has type "data"- [targetUID: N/A] "3941d9264340cece_0" has type "data"- [targetUID: N/A] "6e13fa10387f2f71_0" has type "data"- [targetUID: N/A] "d2555b74a1131c9d_0" has type "data"- [targetUID: N/A] "69efd29ffe7f5db8_0" has type "data"- [targetUID: N/A] "bf3ff48678c82259_0" has type "data"- [targetUID: N/A] "51db86437fbde823_0" has type "data"- [targetUID: N/A] "bd90de8af9374096_0" has type "data"- [targetUID: N/A] "2aefc90dcd923e21_0" has type "data"- [targetUID: N/A] "2a3a5eeb2614d0f8_0" has type "data"- [targetUID: N/A] "d8d9cdb8ccf2edca_0" has type "data"- [targetUID: N/A] "e163140695fca878_0" has type "data"- [targetUID: N/A] "e5c07661ec64c5fe_0" has type "data"- [targetUID: N/A] "fcd77c4e5365feb9_0" has type "data"- [targetUID: N/A] "50e90a0afa1981bf_0" has type "data"- [targetUID: N/A] "f2683fabe64bae2f_0" has type "data"- [targetUID: N/A] "e4e447ee380a509e_0" has type "data"- [targetUID: N/A] "e2aa79afcd69da46_0" has type "data"- [targetUID: N/A] "181921b9c261bfa8_0" has type "data"- [targetUID: N/A] "cc128d1b3dedff96_0" has type "data"- [targetUID: N/A] "1094d8464a878fe5_0" has type "data"- [targetUID: N/A] "d005f5c73ad30c1e_0" has type "data"- [targetUID: N/A] "9ddda9536225ca22_0" has type "data"- [targetUID: N/A] "b5360af0b77ffc5b_0" has type "data"- [targetUID: N/A] "880927cc8e6e9765_0" has type "data"- [targetUID: N/A] "d0ae18162ad8eb6b_0" has type "data"- [targetUID: N/A] "e979d1cda74c68a9_0" has type "data"- [targetUID: N/A] "7adef1711f65fa38_0" has type "data"- [targetUID: N/A] "a4bb93aff597cdd5_0" has type "data"- [targetUID: N/A] "9c60a0453baf11bf_0" has type "data"- [targetUID: N/A] "7272decba30800cf_0" has type "data"- [targetUID: N/A] "c539d577bdedde3b_0" has type "data"- [targetUID: N/A] "bf2ab0d73a66faa4_0" has type "data"- [targetUID: N/A] "4bfc653db9edfcdc_0" has type "data"- [targetUID: N/A] "4ea02909a5d84a9b_0" has type "data"- [targetUID: N/A] "e025c39cbd947b46_0" has type "data"- [targetUID: N/A] "80eba78637633e1d_0" has type "data"- [targetUID: N/A] "135f15e6b6aa3240_0" has type "data"- [targetUID: N/A] "8052d137354c78a6_0" has type "data"- [targetUID: N/A] "ab0423415fc0f8de_0" has type "data"- [targetUID: N/A] "c08d6b2d5449a572_0" has type "data"- [targetUID: N/A] "766415f99b4c6b7d_0" has type "data"- [targetUID: N/A] "be57e96208f23f53_0" has type "data"- [targetUID: N/A] "temp-index" has type "MS Windows COFF Motorola 68000 object file"- [targetUID: 00000000-00006276] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG]- [targetUID: 00000000-00006276] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG]- [targetUID: 00000000-00006276] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Session Storage\LOG]- [targetUID: 00000000-00006276] "settings.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\settings.dat]- [targetUID: 00000000-00006588] "7ef92bd11684f66a_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\7ef92bd11684f66a_0]- [targetUID: 00000000-00006276] "1cfabfb9f3622fa4_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\1cfabfb9f3622fa4_0]- [targetUID: 00000000-00006276] "14d44a83af9e31b2_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\14d44a83af9e31b2_0]- [targetUID: 00000000-00006276] "f91bd584a584d4ed_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\f91bd584a584d4ed_0]- [targetUID: 00000000-00006276] "7df6793dfb977880_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\7df6793dfb977880_0]- [targetUID: 00000000-00006276] "f339c8b9bf1770dd_0" has type "data"- [targetUID: N/A] "018200413242a500_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\018200413242a500_0]- [targetUID: 00000000-00006276] "bc9640ee1e222c9d_0" has type "data"- [targetUID: N/A] "4c9a08ed72147a23_0" has type "data"- [targetUID: N/A] "26089b65e6b8b9ca_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\26089b65e6b8b9ca_0]- [targetUID: 00000000-00006276] "d4d113f1fb8c7575_0" has type "data"- [targetUID: N/A] "e0807322fe4d94ee_0" has type "data"- [targetUID: N/A] "e7b68ec6a844259d_0" has type "data"- [targetUID: N/A] "e774516746b2cd9c_0" has type "data"- [targetUID: N/A] "43d2954fff2a5112_0" has type "data"- [targetUID: N/A] "67ea55549cd59788_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\67ea55549cd59788_0]- [targetUID: 00000000-00006276] "e653a61f22390c57_0" has type "data"- [targetUID: N/A] "f383b6fed32aa9bf_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\f383b6fed32aa9bf_0]- [targetUID: 00000000-00006276] "6b55a95a8461dae9_0" has type "data"- [targetUID: N/A] "335e69ddec2b9ac6_0" has type "data"- [targetUID: N/A] "index.txt.tmp" has type "data"- [targetUID: N/A] "Last Browser" has type "data"- [targetUID: N/A] "Variations" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Variations]- [targetUID: 00000000-00006276] ".ses" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "MANIFEST-000001" has type "PGP Secret Key -"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001]- [targetUID: 00000000-00006276] "index" has type "data"- [targetUID: 00000000-00002164] "MANIFEST-000001" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001]- [targetUID: 00000000-00006276] "000001.dbtmp" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000001.dbtmp]- [targetUID: 00000000-00006276] "Last Version" has type "ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Last Version]- [targetUID: 00000000-00006276] "c94e7687-b0a2-4f83-a111-ce3e7e880629.tmp" has type "very short file (no magic)"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\c94e7687-b0a2-4f83-a111-ce3e7e880629.tmp]- [targetUID: 00000000-00006276] "OfficeTrackerNMP131.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- [targetUID: N/A] "MaxLoonaFest131.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- [targetUID: N/A] "2qH8397.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\2qH8397.exe]- [targetUID: 00000000-00007228] "4ede6a59-68af-4634-965b-d1bcb92eb68d.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "31000269-bc3c-43b9-bafd-aa453c654e13.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "69152bc5-7798-42d2-ac94-1731b489a810.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "000001.dbtmp" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp]- [targetUID: 00000000-00006276]47:Tda1,"1510a40b-b559-458a-886a-ca1ce6368898.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 1287975160 gzip compressed data reserved method ASCII has comment encrypted from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 1287975160" - Location: [%TEMP%\1510a40b-b559-458a-886a-ca1ce6368898.tmp] "e44a0ab4-9363-410c-a84d-00985a40d9f5.tmp" has type "JSON data" "0a326454-c803-4a35-8f1b-c8d9b7a22c58.tmp" has type "UTF-8 Unicode text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\0a326454-c803-4a35-8f1b-c8d9b7a22c58.tmp] "fe11038b-acad-4122-9204-9b981c9f0af3.tmp" has type "ASCII text with very long lines with no line terminators" "4dd170b3-73cd-475d-9546-70a27f27732a.tmp" has type "ASCII text with very long lines with no line terminators" "d9e4bc01-d100-44a8-8320-36ee377e2e2b.tmp" has type "ASCII text with very long lines with no line terminators" "96caa928-65c7-49eb-8d3d-25f2051cd1a0.tmp" has type "ASCII text with very long lines with no line terminators" "82e2002d-2edd-4a0b-9802-60123da2621c.tmp" has type "ASCII text with very long lines with no line terminators" "5b4fc793-4031-48f7-bd79-d3945b0fea42.tmp" has type "ASCII text with very long lines with no line terminators" "54763073-1fca-495e-adb2-acba2c2a5e75.tmp" has type "ASCII text with very long lines with no line terminators" "654804ac-7a1c-49ce-bf60-634e858b4868.tmp" has type "ASCII text with very long lines with no line terminators" "519bdbcb-9ce2-403d-8605-03038b1154f9.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\519bdbcb-9ce2-403d-8605-03038b1154f9.tmp] "3be35605-c390-4d59-96c3-f9c405254c58.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\3be35605-c390-4d59-96c3-f9c405254c58.tmp] "89e39861-406e-40c8-a0f0-e6e0740ef960.tmp" has type "ASCII text with very long lines with no line terminators" "0cc37bf5-634f-4cbb-a684-d54aa60838e7.tmp" has type "ASCII text with very long lines with no line terminators" "e2e2a237-4624-4ceb-b55f-0bdbcd21c74b.tmp" has type "ASCII text with very long lines with no line terminators" "a86f6368-8322-4bac-b369-257af1230134.tmp" has type "ASCII text with very long lines with no line terminators" "56883f62-73ca-4149-ac9a-6a14854eba70.tmp" has type "ASCII text with very long lines with no line terminators" "447ac51e-4b7d-4943-8e10-acb91c8af5e7.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\447ac51e-4b7d-4943-8e10-acb91c8af5e7.tmp] "4b3900da-9b41-43e6-b74b-5b1cc869e8eb.tmp" has type "ASCII text with very long lines with no line terminators" "6cd360e1-ea30-4807-8eb8-9a5ebf8de082.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\6cd360e1-ea30-4807-8eb8-9a5ebf8de082.tmp] "555d296a-352b-4961-83a0-e26e391d4fd6.tmp" has type "ASCII text with very long lines with no line terminators" "e60eb196-8330-4edf-9eac-e42b5bd8e005.tmp" has type "ASCII text with very long lines with no line terminators" "03c95cf4-6e3f-423f-95b7-2731b4789fd4.tmp" has type "ASCII text with very long lines with no line terminators" "4bec9d39-452e-40a9-8e83-555523ecbc1d.tmp" has type "ASCII text with very long lines with no line terminators"48:T64a,"99d8531ceddafcad188371202030c728.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")49:T434,"99d8531ceddafcad188371202030c728.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\st5Cg19.exe" (UID: 4540) "st5Cg19.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\qE5bs90.exe" (UID: 2916) "qE5bs90.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\dj6Ma16.exe" (UID: 6680) "dj6Ma16.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1ow92Oz4.exe" (UID: 7228) "dj6Ma16.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2qH8397.exe" (UID: 7228) "1ow92Oz4.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1ow92Oz4.exe" (UID: 7376) "1ow92Oz4.exe" queries basic process information of the "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (UID: 7376) "2qH8397.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2qH8397.exe" (UID: 4000)4a:Tc75,"99d8531ceddafcad188371202030c728.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "99D8531CEDDAFCAD188371202030C728.EXE"; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "99d8531ceddafcad188371202030c728.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")4b:Tc4f,"99d8531ceddafcad188371202030c728.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "99d8531ceddafcad188371202030c728.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "99d8531ceddafcad188371202030c728.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "99d8531ceddafcad188371202030c728.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "99d8531ceddafcad188371202030c728.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ST5CG19.EXE" "99d8531ceddafcad188371202030c728.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\st5Cg19.exe" "99d8531ceddafcad188371202030c728.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6UY4PV3.EXE" "99d8531ceddafcad188371202030c728.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6uY4pV3.exe" "st5Cg19.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "st5Cg19.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "st5Cg19.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "st5Cg19.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "st5Cg19.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\QE5BS90.EXE" "st5Cg19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\qE5bs90.exe" "st5Cg19.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5MW6GR2.EXE" "st5Cg19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5Mw6gR2.exe" "qE5bs90.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "qE5bs90.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "qE5bs90.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "qE5bs90.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "qE5bs90.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\DJ6MA16.EXE" "qE5bs90.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\dj6Ma16.exe" "qE5bs90.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3XZ08LJ.EXE" "qE5bs90.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3Xz08LJ.exe" "dj6Ma16.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL"4c:T8d3,"99d8531ceddafcad188371202030c728.exe" trying to access non-existent file "\Device\HarddiskVolume2\99D8531CEDDAFCAD188371202030C728.EXE.LOCAL" "99d8531ceddafcad188371202030c728.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "99d8531ceddafcad188371202030c728.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "st5Cg19.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\ST5CG19.EXE.LOCAL" "st5Cg19.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "st5Cg19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "qE5bs90.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\QE5BS90.EXE.LOCAL" "qE5bs90.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "qE5bs90.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "dj6Ma16.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\DJ6MA16.EXE.LOCAL" "dj6Ma16.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "dj6Ma16.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "1ow92Oz4.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1OW92OZ4.EXE.LOCAL" "1ow92Oz4.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "1ow92Oz4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1ow92Oz4.exe.Local\" "2qH8397.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2QH8397.EXE.LOCAL" "2qH8397.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2qH8397.exe.Local\" "2qH8397.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2QH8397.ENU"4d:T65d,file/memory contains long string with (Indicator: ".googleapis.com"; File: "d5e5fbb73c625e94_1") file/memory contains long string with (Indicator: ".googleapis.com"; File: "dd0569f7cce13cab_0") file/memory contains long string with (Indicator: ".googleapis.com"; File: "d5e5fbb73c625e94_0") file/memory contains long string with (Indicator: "githubusercontent.com"; File: "555d296a-352b-4961-83a0-e26e391d4fd6.tmp") file/memory contains long string with (Indicator: ".googleapis.com"; File: "555d296a-352b-4961-83a0-e26e391d4fd6.tmp") file/memory contains long string with (Indicator: "githubusercontent.com"; File: "e60eb196-8330-4edf-9eac-e42b5bd8e005.tmp") file/memory contains long string with (Indicator: ".googleapis.com"; File: "e60eb196-8330-4edf-9eac-e42b5bd8e005.tmp") file/memory contains long string with (Indicator: "githubusercontent.com"; File: "03c95cf4-6e3f-423f-95b7-2731b4789fd4.tmp") file/memory contains long string with (Indicator: ".googleapis.com"; File: "03c95cf4-6e3f-423f-95b7-2731b4789fd4.tmp") file/memory contains long string with (Indicator: "githubusercontent.com"; File: "4bec9d39-452e-40a9-8e83-555523ecbc1d.tmp") file/memory contains long string with (Indicator: ".googleapis.com"; File: "4bec9d39-452e-40a9-8e83-555523ecbc1d.tmp") Found string "fonts.googleapis.com" (Indicator: ".googleapis.com"; File: "PCAP") Found string "jnn-pa.googleapis.com" (Indicator: ".googleapis.com"; File: "PCAP") file/memory contains long string with (Indicator: ".googleapis.com"; File: "0") file/memory contains long string with (Indicator: ".googleapis.com"; File: "urlref_httpswww.youtube.com")4e:T6d6d,Pattern match: "https://www.youtube.com/" Heuristic match: "4Q.mx" Heuristic match: "=B.Et" Pattern match: "https://www.youtube.com/s/player/4fd50162/player_ias.vflset/en_US/offline.jsQbB`?QbZ" Pattern match: "https://www.youtube.com/s/player/4fd50162/player_ias.vflset/en_US/remote.jsQb&p%Qb&pQbBpOhQbN!QbRQQb" Pattern match: "https://www.youtube.com/s/desktop/f4449159/jsbin/webcomponents-sd.vflset/webcomponents-sd.jsQb8Qb&@yQb" Pattern match: "https://www.youtube.com/s/player/4fd50162/player_ias.vflset/en_US/captions.jsQbF`QbF4" Pattern match: "https://www.youtube.com/s/desktop/f4449159/jsbin/web-animations-next-lite.min.vflset/web-animations-next-lite.min.jsDaN_delay_endDelay_fill_iterationStart_iterations_duration_playbackRate_direction_easing_easingFunction|6^7https://www.youtube.com/s/desktop" Pattern match: "https://www.youtube.com/s/desktop/f4449159/jsbin/spf.vflset/spf.jsQb8Qb&@yQb" Pattern match: "4.fg/w7@/hYB].QD:7'K:sGx`3uKtz:+\?2J,@$S7CN&!t=ka7iJU3Ox8+p|$" Pattern match: "https://www.youtube.com/s/player/4fd50162/player_ias.vflset/en_US/endscreen.jswindowQb6,QbNcQbN^" Pattern match: "https://ntp.www.office.com&_https://ntp.msn.comCookieSyncExpiry'_https://ntp.msn.comDefaultFeedPolicy_https://ntp.msn.comGpuExist/_https://ntp.msn.comNOTIFICATION_CACHE_LS_KEY_https://ntp.msn.combkgdV+_https://ntp.msn.combreakingNewsDismissed" Pattern match: "www2.bing.comMUIDB/www.bing.comMUIDB/.msn.comUSRLOC/.microsoft.comMUID/.bing.com_RwBf/.bing.comSRCHUID/.bing.comSRCHD/.mediago.io__mguid_/.ups.comAMCV_036784BD57A8BB277F000101%40AdobeOrg/.facebook.com_js_datr/.mgid.commuidn/.ups.comups_language_preference" Pattern match: "csp.withgoogle.com/csp/report-to/youtube_mainm/[]httpswww.gstatic.comcloudview-releasehttps://csp.withgoogle.com/csp/report-to/cloudview-releasea.%w[]httpswww.google.combotguard-scshttps://csp.withgoogle.com/csp/report-to/botguard-scs|-[]httpsstatic.double" Pattern match: "https://www.youtube.com/s/desktop/f4449159/jsbin/network.vflset/network.jsQb&@yQb&bQbjhPQbn2Qb.iQb65eQbF9DQb^}QbrChttps://www.youtube.com/s/desktop/f4449159/jsbin/network.vflset/network.jswindowselfMath" Pattern match: "tV.eLsm/@,mJQJ8,yRh_wi~/b'p9dk*#wWv36uIA?K'{;-sj6xq8j]FMB]U-%2" Pattern match: "https://www.youtube.com/s/desktop/f4449159/jsbin/www-tampering.vflset/www-tampering.jshttps://www.youtube.com/s/desktop/f4449159/jsbin/www-tampering.vflset/www-tampering.jswindowselfMath" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53r3l?ver=5412,PORTRAIT:https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53bta?ver=2bf3,update_period:86400},creativeId:128000000003595" Pattern match: "https://www.youtube.com/s/desktop/f4449159/jsbin/scheduler.vflset/scheduler.jsQbrCQb&@yQb&bQbRSiuhttps://www.youtube.com/s/desktop/f4449159/jsbin/scheduler.vflset/scheduler.jswindowselfMath" Pattern match: "https://www.youtube.com/s/desktop/f4449159/jsbin/network.vflset/network.js" Pattern match: "www.youtube.com\/s\/desktop\/f4449159\/jsbin\/serviceworker-kevlar-appshell.vflset\/serviceworker-kevlar-appshell.js" Pattern match: "www.youtube.com/s/player/4fd50162/player_ias.vflset/en_US/miniplayer.jsPL`$callbuttonQb2{ytp-miniplayer-expand-watch-page-buttonytp-buttonytp-miniplayer-button-top-leftQcJCrtitle{{title}}data-tooltip-target-idaria-keyshortcuts$QgRdata-title-no-tooltip{{dat" Pattern match: "https://www.youtube.com/s/desktop/f4449159/cssbin/www-main-desktop-watch-page-skeleton.css:root{--blob-a-x:55%;--blob-a-y:15%;--blob-b-x:101%;--blob-b-y:3%;--blob-c-x:94%;--blob-c-y:113%;--blob-d-x:10%;--blob-d-y:70%;--blob-e-x:0%;--blob-e-y:0%}@property" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/offline_no_content/v1/192px.svg" Pattern match: "https://www.youtube.com/s/desktop/f4449159/cssbin/www-main-desktop-home-page-skeleton.css:root{--blob-a-x:55%;--blob-a-y:15%;--blob-b-x:101%;--blob-b-y:3%;--blob-c-x:94%;--blob-c-y:113%;--blob-d-x:10%;--blob-d-y:70%;--blob-e-x:0%;--blob-e-y:0%}@property" Pattern match: "https://www.youtube.com/s/desktop/f4449159/jsbin/www-tampering.vflset/www-tampering.js" Pattern match: "https://www.youtube.com/s/desktop/f4449159/jsbin/intersection-observer.min.vflset/intersection-observer.min.jstimerootBoundsboundingClientRectintersectionRectisIntersectingwidthheightintersectionRatiohttps://www.youtube.com/s/desktop/f4449159/jsbin/interse" Pattern match: "https://www.youtube.com/s/desktop/f4449159/jsbin/scheduler.vflset/scheduler.js" Pattern match: "www.youtube.com/sw.jshttps://www.youtube.com/s/desktop/f4449159/jsbin/serviceworker-kevlar-appshell.vflset/serviceworker-kevlar-appshell.jscreateScriptURLDI]DcQez" Pattern match: "https://www.youtube.com/s/desktop/f4449159/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.jssplitexecScriptvar" Pattern match: "https://www.clarity.ms,supports_spdy:true},{anonymization:[],server:https://microsoftedgewelcome.microsoft.com,supports_spdy:true},{anonymization:[],server:https://edgefrecdn.azureedge.net,supports_spdy:true},{anonymization:[],server" Pattern match: "www.youtube.com/s/player/4fd50162/player_ias.vflset/en_US/miniplayer.js" Pattern match: "https://googleads.g.doubleclick.net/next-map-idQnamespace-3bbc91a6_51d0_4200_9fa7_2e3ec0fddf25-https://tpc.googlesyndication.com/34U" Pattern match: "https://www.youtube.com/s/desktop/f4449159/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.js" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/yt-logo-updated/v2/24px.svg" Pattern match: "https://www.youtube.com/s/desktop/f4449159/jsbin/intersection-observer.min.vflset/intersection-observer.min.js/*" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/youtube_round/v1/24px.svg" Pattern match: "https://www.youtube.com/s/desktop/f4449159/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js|L`:windowcustomElementsHTMLElementdefinecallhttps://www.youtube.com/s/desktop/f4449159/jsbin/custom-elements-es5-adapter.vflset/custom-elemen" Pattern match: "https://www.youtube.com/s/desktop/f4449159/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js'use" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/youtube_kids_round/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/gear/v6/24px.svg" Pattern match: "https://www.youtube.com/s/desktop/f4449159/img/favicon.icoaccept-rangesbytes615899alt-svc.h3=:443" Pattern match: "https://www.youtube.com/s/desktop/f4449159/cssbin/www-onepick.css.picker-frame{width:100%;height:100%;border:0;overflow:hidden}.picker.modal-dialog-bg{position:absolute;top:0;left:0;background-color:#fff}.picker.modal-dialog{position:absolute;top:0;left:0;" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/creator_studio_red_logo/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/youtube_shorts/v8/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/shorts-dislike/v2/32px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/radar_live/v6/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/radar_live/v6/24px.svg" Pattern match: "fonts.gstatic.com/s/i/youtube_outline/volume_off/v4/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/shorts-like/v2/32px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/question_circle/v5/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/radar_live/v6/16px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/broadcast/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/broadcast/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/person_circle/v8/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/fire/v8/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/thumb_up/v17/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/gaming/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/gear/v6/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/shorts-share/v2/32px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/shorts-comment/v2/32px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/arrow_time/v8/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/bell/v8/24px.svg" Pattern match: "www.gstatic.com/youtube/img/icons/web/youtube_outline/waveform/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/youtube_shorts/v8/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/volume_on/v3/24px.svg" Pattern match: "fonts.gstatic.com/s/i/youtube_outline/lightbulb/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/overflow_vertical/v10/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/location_point/v5/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/gaming/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/fashion/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/fire/v8/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/bag/v4/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/overflow_horizontal/v4/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/fashion/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/trophy/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/bag/v4/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/volume-off/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/search/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/search/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/mic/v8/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/arrow_time/v8/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/thumb_up/v17/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/bell/v8/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/mic/v8/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/youtube_shorts_brand_24/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/audio/v5/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/lightbulb/v1/24px.svg" Pattern match: "fonts.gstatic.com/s/i/youtube_outline/clock/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/video_camera_add/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/news/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/add_circle/v3/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/youtube_music/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/trophy/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/x_mark/v4/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/message_bubble_alert/v6/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_outline/refresh/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/news/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/flag/v6/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/subscriptions/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/check_circle/v8/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/clapperboard/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/clapperboard/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/home/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/trash_can/v5/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/audio/v5/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/open_new/v6/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/unplugged_logo/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/library/v6/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/clock/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/message_bubble_alert/v6/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/subscriptions/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/arrow_down/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/play_arrow/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/arrow_up/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/arrow_down/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/star/v3/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/library/v6/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/arrow_up/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/my_videos/v6/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/list_play_arrow/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/download/v9/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/download/v9/24px.svg" Pattern match: "fonts.gstatic.com/s/i/youtube_fill/list_play_arrow/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/home/v7/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/flag/v6/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/chevron_left/v8/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/chevron_down/v7/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/volume-up/v1/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/chevron_right/v4/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/chevron_up/v6/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/copy/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_outline/bars_3/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/bars_3/v2/24px.svg" Pattern match: "https://fonts.gstatic.com/s/i/youtube_fill/pause/v6/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/offline_download/v1/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_outline/keyboard-arrow-up/v1/24px.svg" Pattern match: "https://www.gstatic.com/youtube/img/icons/web/youtube_fill/play-arrow/v1/24px.svg" Pattern match: "assets.db/MANIFEST-0000012024/01/05-10:42:58.494" Pattern match: "www.youtube.com/s/desktop/f4449159/jsbin/web-animations-next-lite.min.vflset/web-animations-next-lite.min.js" Pattern match: "www.youtube.com/s/desktop/f4449159/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js" Pattern match: "www.youtube.com/s/desktop/f4449159/jsbin/intersection-observer.min.vflset/intersection-observer.min.js" Pattern match: "www.youtube.com/s/desktop/f4449159/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.js" Pattern match: "www.youtube.com/s/desktop/f4449159/jsbin/webcomponents-sd.vflset/webcomponents-sd.js" Pattern match: "www.youtube.com/s/desktop/f4449159/jsbin/desktop_polymer.vflset/desktop_polymer.js" Pattern match: "www.youtube.com/s/desktop/f4449159/jsbin/www-tampering.vflset/www-tampering.js" Pattern match: "www.youtube.com/s/player/4fd50162/player_ias.vflset/en_US/inline_preview.js" Pattern match: "www.youtube.com/s/desktop/f4449159/jsbin/scheduler.vflset/scheduler.js" Pattern match: "www.youtube.com/s/player/4fd50162/player_ias.vflset/en_US/endscreen.js" Pattern match: "www.youtube.com/s/player/4fd50162/player_ias.vflset/en_US/heartbeat.js" Pattern match: "www.youtube.com/s/player/4fd50162/player_ias.vflset/en_US/offline.js" Pattern match: "www.google.com/js/th/UhAHYkQc59SMm3ILQvX2LV9pHtXm_t6HT06w3DJ-zT8.js" Pattern match: "www.youtube.com/s/player/4fd50162/player_ias.vflset/en_US/remote.js" Pattern match: "www.youtube.com/s/desktop/f4449159/jsbin/network.vflset/network.js" Pattern match: "www.youtube.com/s/player/4fd50162/player_ias.vflset/en_US/base.js" Pattern match: "www.youtube.com/s/desktop/f4449159/jsbin/spf.vflset/spf.js" Pattern match: "www.gstatic.com/eureka/clank/107/cast_sender.js" Pattern match: "www.gstatic.com/cv/js/sender/v1/cast_sender.js" Pattern match: "www.youtube.com/https://www.youtube.com/" Heuristic match: "accounts.google.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "googleads.g.doubleclick.net" Heuristic match: "i.ytimg.com" Heuristic match: "jnn-pa.googleapis.com" Heuristic match: "lh4.googleusercontent.com" Heuristic match: "play.google.com" Heuristic match: "rr4---sn-n4v7snly.googlevideo.com" Heuristic match: "static.doubleclick.net" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Pattern match: "www.youtube.com" Heuristic match: "youtube.com" Heuristic match: "yt3.ggpht.com" Pattern match: "https://www.gstatic.com/youtube/img/useredu/smart_downloads_optin_banner.svg" Pattern match: "https://www.youtube.com/howyoutubeworks/product-features/search/" Pattern match: "www.ads.eventcache.getLastCompanionData" Pattern match: "www.ads&&ya.yt.www.ads.eventcache&&ya.yt.www.ads.eventcache.getLastCompanionData?ya.yt.www.ads.eventcache.getLastCompanionData():null" Pattern match: "static.doubleclick.net/instream/ad_status.js,b" Pattern match: "https://schema.org,@type:VideoObject,description:iB(a.description),duration:PT+(a.lengthSeconds||0)+S,embedUrl:a.embed?a.embed.iframeUrl:,interactionCount:a.viewCount,name:iB(a.title),thumbnailUrl" Pattern match: "https://i.ytimg.com/vi/+a+/frame0.jpg" Pattern match: "https://www.gstatic.com/youtube/img/labs/early_access_web_background_expanded_ai_2x.jpg;a.headerBackgroundDark=https://www.gstatic.com/youtube/img/labs/early_access_web_background_expanded_ai_2x.jpg;a.actionMap={yt-dark-mode-toggled-action:onDarkMode" Pattern match: "https://www.gstatic.com/images/icons/material/system/1x/local_shipping_grey600_48dp.png;a.shippingAddressIcon=https://www.gstatic.com/images/icons/material/system/1x/location_on_grey600_48dp.png;a.googleGuaranteeIcon=https://www.gstatic.com/images/icon" Pattern match: "https://www.gstatic.com/youtube/img/lottie/animated_like_icon/+I+.json,loop:!1,autoplay:!1,rendererSettings:{viewBoxOnly:!0" Pattern match: "https://www.gstatic.com/youtube/img/lottie/subscribe_action/subscribe_action_bell_icon_+(S?dark:light)+.json,loop:!1,autoplay:!1,rendererSettings:{className:animated-subscribe-icon}}},totalFrames:79,lazyLoad:!1};break" Pattern match: "https://www.google-analytics.com/analytics.js" Pattern match: "http://www.w3.org/2000/svg,use" Pattern match: "www.gstatic.com/eureka/clank/+a+/cast_sender.js" Pattern match: "www.gstatic.com/cast/sdk/libs/sender/1.0/cast_framework.js,jQc,c" Pattern match: "www.gstatic.com/eureka/clank/cast_sender.js" Pattern match: "https://myaccount.google.com,https://myaccount-dev.corp.google.com,https://myaccount-autopush.corp.google.com,https://myaccount-staging.corp.google.com" Pattern match: "https://oauth-redirect.googleusercontent.com,https://oauth-redirect-sandbox.googleusercontent.com,https://oauth-redirect-test.googleusercontent.com" Pattern match: "https://apis.google.com/js/api.js" Pattern match: "https://+a+/signedin+b+/landing" Pattern match: "https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_36dp.png:https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_36dp.png;e.style.height=72px;e.style.width=" Pattern match: "https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_24dp.png:https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_24dp.png;b.style.display=block;b.style.heigh" Pattern match: "http://+this.original_.substring(this.originalPrefix_.length)" Pattern match: "www.google.com/images/cleardot.gif" Pattern match: "https://www.gstatic.com/cv/js/sender/v1/cast_sender.js" Pattern match: "https://embeddedassistant-webchannel.googleapis.com/google.assistant.embedded.v1.EmbeddedAssistant/YTAssist/channel===b||https://embeddedassistant-clients6.youtube.com/google.assistant.embedded.v1.EmbeddedAssistant/YTAssist/channel===" Pattern match: "https://embeddedassistant-frontend-webchannel.googleapis.com/google.assistant.embedded.v1.EmbeddedAssistant/YTAssist/channel===b||https://embeddedassistant-frontend-clients6.youtube.com/google.assistant.embedded.v1.EmbeddedAssistant/YTAssist/channel===b" Pattern match: "https://embeddedassistant-webchannel.googleapis.com/google.assistant.embedded.v1.EmbeddedAssistant/YTAssist/channel;H(kevlar_voice_search_auth_enabled)||H(kevlar_voice_search_use_yt_endpoint)?a=https://embeddedassistant-frontend-clients6.youtube.com/" Pattern match: "https://www.googletagmanager.com/ns.html?id=GTM-5KBDVVN\" Pattern match: "https://www.googletagmanager.com/ns.html?id=GTM-TGBSZFB\" Pattern match: "www.masthead.searchbox.initPolymer" Pattern match: "https://+(e?www.youtube-nocookie.com:this.embedHost_)+/embed/+h;a.clipId&&(m.push(clip=+a.clipId),m.push(clipt=+a.clipTiming));m=0" Pattern match: "www.youtube.com;expires=Thu" Pattern match: "http://go/join-youtube-web" Pattern match: "http://www.w3.org/2000/svg,svg" Pattern match: "http://www.w3.org/2000/svg,defs" Pattern match: "www.youtube.com\//g" Pattern match: "https://www.youtube.com/error_204?t=jserror&level=ERROR" Pattern match: "https://www.youtube.com/s/desktop/f4449159/img/favicon.ico" Pattern match: "https://i.ytimg.com/generate_204" Pattern match: "https://www.youtube.com/s/desktop/f4449159/cssbin/www-main-desktop-watch-page-skeleton.css" Heuristic match: "1t;_s_//nnm.y0utubg.com" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Pattern match: "http://schemas.microsoft.com/SMI/2016/WindowsSettings" Heuristic match: "S;.VBE;.JS;.JSE;.WSF;.WS" Heuristic match: "ETFXS~1.HKFnetfxsbs12.hk" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Pattern match: "Microsoft.Net/assembly/GAC_32/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1$0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0L" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "www.verisign.com/CPS" Pattern match: "https://www.verisign.com/CPS04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0K" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" Pattern match: "http://schemas.microsoft.com/powershell/Microsoft.PowerShell" Heuristic match: "Set-Location $MyInvocation.MyCommand.Name" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=225750" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=225747" Heuristic match: "Get-Content $file | more.com" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/XMLSchema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=113316" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=160712" Pattern match: "Microsoft.Net/assembly/GAC_MSIL/Microsoft.PowerShell.ConsoleHost/v4.0_3.0.0.0__31bf3856ad364e35/Microsoft.PowerShell.ConsoleHost.dll" Heuristic match: "ntrust.net" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0F" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/ThawtePCA-G3.crl0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.microsoft.com/pkiops/Docs/Repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/CPS_2048" Pattern match: "http://www.certplus.com/CRL/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/STCA.crl0" Pattern match: "0www.entrust.net/CPS" Pattern match: "crl.comodoca.com/AAACertificateServices.crl06" Pattern match: "crl.comodo.net/AAACertificateServices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "go.microsoft.com/fwlink/?LinkID=851034&clcid=0x409&" Heuristic match: "ile:///C:/WINDOWS/Microsoft.Net" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0" Heuristic match: "DOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0"4f:T444a,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000588.00000000.77947.03530000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000588.00000001.79868.03530000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002544.00000000.77865.02C00000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002544.00000001.79783.02C00000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002620.00000000.77846.02E90000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002620.00000001.79764.02E90000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002916.00000000.67979.028C0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002916.00000002.71820.028C0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003100.00000000.77993.02B50000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003100.00000001.79913.02B50000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003752.00000000.77906.03390000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003752.00000001.79826.03390000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003760.00000000.69444.02E40000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003760.00000001.71364.02E40000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003760.00000001.71364.02F1B000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003760.00000001.71364.02F1B000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0_qpkvqpkvq0l1" - Source: "00000000-00003760.00000001.71364.02F1B000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003760.00000001.71364.02F1B000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003760.00000001.71364.02F1B000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003760.00000001.71364.02F1B000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%yg6" - Source: "00000000-00003760.00000001.71364.02F1B000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003760.00000001.71364.02F1B000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0lhfq" - Source: "00000000-00003760.00000001.71364.02F1B000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003760.00000001.71364.070F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003760.00000001.71364.070F0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003760.00000001.71364.070F0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003760.00000001.71364.070F0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00003760.00000001.71364.070F0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00003760.00000001.71364.070F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00003760.00000001.71364.070F0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003760.00000001.71364.070F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003760.00000001.71364.070F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003760.00000001.71364.070F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003760.00000001.71364.070F0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003760.00000001.71364.070F0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003760.00000001.71364.070F0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003760.00000001.71364.070F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003760.00000001.71364.070F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?vqyqd" - Source: "00000000-00003760.00000001.71364.070F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn" - Source: "00000000-00003760.00000001.71364.72C21000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003760.00000002.73284.02E40000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003760.00000002.73284.02F1B000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003760.00000002.73284.02F1B000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003760.00000002.73284.02F1B000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003760.00000002.73284.02F1B000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%y" - Source: "00000000-00003760.00000002.73284.02F1B000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003760.00000002.73284.02F1B000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003760.00000002.73284.02F1B000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl05fqtnfq4?gq88ppf=fqmnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003760.00000002.73284.070F0000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00003760.00000002.73284.070F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00003760.00000002.73284.070F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003760.00000002.73284.070F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0,@70gq(xpkvqgqx4," - Source: "00000000-00003760.00000002.73284.070F0000.00000004.mdmp") Found URL "http://?azh_qpkvqpkvqkvqb?azh_qpkvqpkvqd@fqpkvq@5ptvqptvqtvq$tvq$tvqsvq<_qhtvqhtvqttvqttvquvq$uvq$uvq0uvq0uvqhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003760.00000002.73284.070F0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00003760.00000002.73284.6F6D1000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00003760.00000002.73284.6F6D1000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00003760.00000002.73284.6F6D1000.00000020.mdmp") Found URL "http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/latestcrl.crl07+0)0'http://pki-ocsp.symauth.com0*>gf3ul6)sfuk" - Source: "00000000-00004000.00000000.68381.00C2C000.00000040.mdmp") Found URL "http://pki-crl.symauth.com/offlineca/theinstituteofelectricalandelectronicsengineersincieeerootca.crl0verisignmpki-2-3990" - Source: "00000000-00004000.00000000.68381.00C2C000.00000040.mdmp") Found URL "https://enigmaprotector.com/e-mail" - Source: "00000000-00004000.00000000.68381.00C2C000.00000040.mdmp")50:T5d8,Observed import api "WNetAddConnection" which can "makes a connection to a network resource" [Source: 3Xz08LJ.exe] Observed import api "WNetCancelConnection" which can "cancels an existing network connection" [Source: 3Xz08LJ.exe] Observed import api "WNetGetConnection" which can "retrieves the name of the network resource associated with a local device" [Source: 3Xz08LJ.exe] Observed import api "WNetUseConnection" which can "makes a connection to a network resource" [Source: 3Xz08LJ.exe] Observed import api "WNetAddConnection" which can "makes a connection to a network resource" [Source: 1ow92Oz4.exe] Observed import api "WNetCancelConnection" which can "cancels an existing network connection" [Source: 1ow92Oz4.exe] Observed import api "WNetGetConnection" which can "retrieves the name of the network resource associated with a local device" [Source: 1ow92Oz4.exe] Observed import api "WNetUseConnection" which can "makes a connection to a network resource" [Source: 1ow92Oz4.exe] Observed import api "WNetAddConnection" which can "makes a connection to a network resource" [Source: 6uY4pV3.exe] Observed import api "WNetCancelConnection" which can "cancels an existing network connection" [Source: 6uY4pV3.exe] Observed import api "WNetGetConnection" which can "retrieves the name of the network resource associated with a local device" [Source: 6uY4pV3.exe] Observed import api "WNetUseConnection" which can "makes a connection to a network resource" [Source: 6uY4pV3.exe]51:Ta36,Found HTTPS GET request to https://api.edgeoffer.microsoft.com/edgeoffer/experiments?appId=edge-extensions&country=US Found HTTPS POST request to https://rr4---sn-n4v7snly.googlevideo.com/videoplayback?expire=1704501763&ei=o02YZe7IAZ7dsfIP0ayWuAk&ip=67.218.111.202&id=wCvGGR46zU8.2&itag=243&aitags=242%2C243%2C244%2C247%2C278&source=yt_live_broadcast&requiressl=yes&xpc=EgVo2aDSNQ%3D%3D&mh=Ex&mm=44%2C29&mn=sn-n4v7snly%2Csn-o097znze&ms=lva%2Crdu&mv=m&mvi=4&pl=19&pcm2=yes&initcwndbps=1163750&spc=UWF9f7xqlUAU6Ijb7YqhCxN8yi3Pf7V-FyisxM4rgQ&vprv=1&live=1&hang=1&noclen=1&svpuc=1&mime=video%2Fwebm&ns=BRKvbI8WXEyvhjvSZnEy-CMQ&gir=yes&mt=1704479318&fvip=1&keepalive=yes&fexp=24007246&c=WEB&sefc=1&n=HkObBQXZr3stvQ&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cxpc%2Cpcm2%2Cspc%2Cvprv%2Clive%2Chang%2Cnoclen%2Csvpuc%2Cmime%2Cns%2Cgir&sig=AJfQdSswRgIhALJsjDf2tvLOKr91AHAD-KQPfvxR_qotU8bwVeeNj0qSAiEAg2cbemJpHcMn-BWdS24p8CkxVyRqnf0MbLMnoKlBhO0%3D&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AAO5W4owRQIhAIAu_9H7oJzyunYpTM2hZ_fuFeI1PLm8gqiH8EE_jD8RAiBgKSjDSDkK2QB5PkM541vhLLhZJKYlYLOMoCXFpNlQMA%3D%3D&alr=yes&cpn=_MDFDj6CXB3WrqM5&cver=2.20240102.07.00&headm=2&rn=3&rbuf=0&pot=MnSuzbUyrq1x3K71iiHRo82heIfvo4SVyp95NUG8S549OQ0bLsYu3pT4P37qYs-LhDaXfdYplKiE7FHo4L8cFC4IF_VU-fx32yOv_aeFGy2YQdwMLMO4NBw_dfm896x6ZeNm47jDvuDGw7-9yD9U1P7hzZmHWQ==&ump=1&srfvp=1 Found HTTPS POST request to https://rr4---sn-n4v7snly.googlevideo.com/videoplayback?expire=1704501763&ei=o02YZe7IAZ7dsfIP0ayWuAk&ip=67.218.111.202&id=wCvGGR46zU8.2&itag=140&aitags=140&source=yt_live_broadcast&requiressl=yes&xpc=EgVo2aDSNQ%3D%3D&mh=Ex&mm=44%2C29&mn=sn-n4v7snly%2Csn-o097znze&ms=lva%2Crdu&mv=m&mvi=4&pl=19&pcm2=yes&initcwndbps=1163750&spc=UWF9f7xqlUAU6Ijb7YqhCxN8yi3Pf7V-FyisxM4rgQ&vprv=1&live=1&hang=1&noclen=1&svpuc=1&mime=audio%2Fmp4&ns=BRKvbI8WXEyvhjvSZnEy-CMQ&gir=yes&mt=1704479318&fvip=1&keepalive=yes&fexp=24007246&c=WEB&sefc=1&n=HkObBQXZr3stvQ&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cxpc%2Cpcm2%2Cspc%2Cvprv%2Clive%2Chang%2Cnoclen%2Csvpuc%2Cmime%2Cns%2Cgir&sig=AJfQdSswRgIhALerMyCosK9JAEkLOYQEdmqQzqQL67HX7bkLpLjo2CPXAiEA57heYsnP1WZ9IsYsaBQbY__i72ZO80XXC7EbMc0sXhM%3D&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AAO5W4owRQIhAIAu_9H7oJzyunYpTM2hZ_fuFeI1PLm8gqiH8EE_jD8RAiBgKSjDSDkK2QB5PkM541vhLLhZJKYlYLOMoCXFpNlQMA%3D%3D&alr=yes&cpn=_MDFDj6CXB3WrqM5&cver=2.20240102.07.00&headm=2&rn=4&rbuf=0&pot=MnSuzbUyrq1x3K71iiHRo82heIfvo4SVyp95NUG8S549OQ0bLsYu3pT4P37qYs-LhDaXfdYplKiE7FHo4L8cFC4IF_VU-fx32yOv_aeFGy2YQdwMLMO4NBw_dfm896x6ZeNm47jDvuDGw7-9yD9U1P7hzZmHWQ==&ump=1&srfvp=152:Ta9c,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp")53:T621,"2qH8397.exe" called "FindFirstFileW" with parameter %TEMP%\IXP003.TMP\2qH8397.exe (UID: 00000000-00004000) "2qH8397.exe" called "FindFirstFileW" with parameter c:\users (UID: 00000000-00004000) "2qH8397.exe" called "FindNextFileW" with parameter Users (UID: 00000000-00004000) "2qH8397.exe" called "FindFirstFileW" with parameter c:\Users\%OSUSER% (UID: 00000000-00004000) "2qH8397.exe" called "FindNextFileW" with parameter %OSUSER% (UID: 00000000-00004000) "2qH8397.exe" called "FindFirstFileW" with parameter %USERPROFILE%\appdata (UID: 00000000-00004000) "2qH8397.exe" called "FindNextFileW" with parameter AppData (UID: 00000000-00004000) "2qH8397.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData\local (UID: 00000000-00004000) "2qH8397.exe" called "FindNextFileW" with parameter Local (UID: 00000000-00004000) "2qH8397.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\temp (UID: 00000000-00004000) "2qH8397.exe" called "FindNextFileW" with parameter Temp (UID: 00000000-00004000) "2qH8397.exe" called "FindFirstFileW" with parameter %TEMP%\ixp003.tmp (UID: 00000000-00004000) "2qH8397.exe" called "FindNextFileW" with parameter IXP003.TMP (UID: 00000000-00004000) "2qH8397.exe" called "FindFirstFileW" with parameter c:\windows (UID: 00000000-00004000) "2qH8397.exe" called "FindNextFileW" with parameter Windows (UID: 00000000-00004000) "2qH8397.exe" called "FindFirstFileW" with parameter %WINDIR%\system32 (UID: 00000000-00004000) "2qH8397.exe" called "FindNextFileW" with parameter System32 (UID: 00000000-00004000)54:Tef9,file/memory contains long string with (Indicator: "aes"; File: "4a116762e8761c87_1") file/memory contains long string with (Indicator: "chacha"; File: "293fbb979ab942f8_1") file/memory contains long string with (Indicator: "aes"; File: "555d296a-352b-4961-83a0-e26e391d4fd6.tmp") file/memory contains long string with (Indicator: "aes"; File: "e60eb196-8330-4edf-9eac-e42b5bd8e005.tmp") file/memory contains long string with (Indicator: "aes"; File: "03c95cf4-6e3f-423f-95b7-2731b4789fd4.tmp") file/memory contains long string with (Indicator: "aes"; File: "4bec9d39-452e-40a9-8e83-555523ecbc1d.tmp") file/memory contains long string with (Indicator: ".encrypt"; File: "0") file/memory contains long string with (Indicator: "base64"; File: "0") Found string "f.parseAndSetUint64Base64Option_=function(a,b,c,d,e){if(""==b)return 0;pVc(a,b,c,d,e,function(h){return h?1:0});" (Indicator: "base64"; File: "0") Found string "f.handleImageUpdatedAction=function(a,b){this.hideContainer=!1;this.previewDataUrl=a;this.encryptedBlobId=b};" (Indicator: ".encrypt"; File: "0") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00003760.00000000.69444.00921000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003760.00000000.69444.00921000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003760.00000000.69444.00921000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003760.00000000.69444.00921000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003760.00000000.69444.00921000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003760.00000000.69444.00921000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003760.00000000.69444.00921000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003760.00000000.69444.00921000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003760.00000000.69444.00921000.00000020.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00003760.00000001.71364.04BA0000.00000004.mdmp") Found string "[-WindowStyle