26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 8f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious QD:Adware.GenericQ Sample 7bcb6b3adcb4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7bcb6b3adcb4…. Malware family: QD:Adware.GenericQ. Threat score 100/100. 9/24 AV engines flagged this file. 10 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","keywords":["Malicious","QD:Adware.GenericQ","malware analysis","sandbox report","threat intelligence","7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776"],"about":{"@type":"SoftwareApplication","name":"yuanbao_v2.371_x64.exe","applicationCategory":["peexe","executable"],"identifier":"7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"QD:Adware.GenericQ","antivirusDetections":{"malicious":9,"total":24},"behavioralIndicators":{"malicious":10,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1d05,Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcatA"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExA"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfA"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastActivePopup"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorA"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "HeapDestroy"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiA"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedDecrement"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessWindowStation"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "SetHandleCount"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "HeapCreate"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyA"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedIncrement"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")28:T71a,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp")29:T72e,Found PE header "MZ" - Source: "00000000-00003044.00000000.129665.04750000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005176.00000000.128063.00B9C000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005176.00000001.128114.00B9C000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006212.00000000.128298.01300000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00006212.00000000.128298.05000000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00006212.00000000.128298.05060000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006212.00000000.128298.058B0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006212.00000001.130219.01300000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00006212.00000001.130219.05060000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006212.00000001.130219.052D0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00006212.00000001.130219.068A0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006212.00000001.130219.06F30000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006212.00000001.130219.071D0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006212.00000002.132138.04FC0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006212.00000002.132138.05000000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00006212.00000002.132138.052D0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00006212.00000002.132138.058B0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006212.00000002.132138.068A0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006212.00000002.132138.06F30000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006212.00000002.132138.071D0000.00000004.mdmp")2a:T9e1,"yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP") "yuanbao_v2.371_x64.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\PROGID") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\PROGID") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\PROGID") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\PROGID") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER") "yuanbao_v2.371_x64.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER")2b:Ta3a,"yuanbao_v2.371_x64.exe" queried SystemProcessInformation at 00000000-00006148-00000C15-998187553 [PID: 6148] "yuanbao_v2.371_x64.exe" queried SystemProcessInformation at 00000000-00006148-00000C15-998196258 [PID: 6148] "yuanbao_v2.371_x64.exe" queried SystemProcessInformation at 00000000-00006148-00000C15-998274681 [PID: 6148] "yuanbao_v2.371_x64.exe" queried SystemProcessInformation at 00000000-00006148-00000C15-998283874 [PID: 6148] "irsetup.exe" queried SystemProcessInformation at 00000000-00005176-00000C15-999441799 [PID: 5176] "irsetup.exe" queried SystemProcessInformation at 00000000-00005176-00000C15-999449544 [PID: 5176] "WebProcess.exe" queried SystemProcessInformation at 00000000-00006212-00000C15-1003258921 [PID: 6212] "WebProcess.exe" queried SystemProcessInformation at 00000000-00006212-00000C15-1003267595 [PID: 6212] "WebProcess.exe" queried SystemProcessInformation at 00000000-00006212-00000C15-1003422313 [PID: 6212] "WebProcess.exe" queried SystemProcessInformation at 00000000-00006212-00000C15-1003431879 [PID: 6212] "WebProcess.exe" queried SystemProcessInformation at 00000000-00006212-00000C15-1011153275 [PID: 6212] "WebProcess.exe" queried SystemProcessInformation at 00000000-00006212-00000C15-1011161531 [PID: 6212] "WebProcess.exe" queried SystemProcessInformation at 00000000-00006212-00000C15-1011378506 [PID: 6212] "WebProcess.exe" queried SystemProcessInformation at 00000000-00006212-00000C15-1011387738 [PID: 6212] "WebProcess.exe" queried SystemProcessInformation at 00000000-00006212-00000C15-1012020594 [PID: 6212] "WebProcess.exe" queried SystemProcessInformation at 00000000-00006212-00000C15-1012029044 [PID: 6212] "WebProcess.exe" queried SystemProcessInformation at 00000000-00006212-00000C15-1012134649 [PID: 6212] "WebProcess.exe" queried SystemProcessInformation at 00000000-00006212-00000C15-1012144029 [PID: 6212] "WebProcess.exe" queried SystemProcessInformation at 00000000-00006212-00000C15-1041919446 [PID: 6212] "WebProcess.exe" queried SystemProcessInformation at 00000000-00006212-00000C15-1041927766 [PID: 6212] "WebProcess.exe" queried SystemProcessInformation at 00000000-00006212-00000C15-1042008231 [PID: 6212] "WebProcess.exe" queried SystemProcessInformation at 00000000-00006212-00000C15-1042015943 [PID: 6212] "WebProcess.exe" queried SystemProcessInformation at 00000000-00006212-00000C15-1042092339 [PID: 6212] "WebProcess.exe" queried SystemProcessInformation at 00000000-00006212-00000C15-1042148031 [PID: 6212] "WebProcess.exe" queried SystemProcessInformation at 00000000-00006212-00000C15-1042181409 [PID: 6212]2c:T1403,"MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdate.exe" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdate.exe" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\CopilotUpdate.exe" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\CopilotUpdate.exe" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdate.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateCore.exe" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateCore.exe" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateComRegisterShell64.exe" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeComRegisterShellARM64.exe" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeComRegisterShellARM64.exe" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\NOTICE.TXT" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\NOTICE.TXT" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\EdgeUpdate.dat" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\EdgeUpdate.dat" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_af.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_af.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_am.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_am.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ar.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_ar.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_as.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_as.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_az.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_az.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_bg.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_bg.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_bn.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_bn.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_bn-IN.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_bn-IN.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_bs.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_bs.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ca.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_ca.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ca-Es-VALENCIA.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_ca-Es-VALENCIA.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_cs.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_cs.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_cy.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_cy.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_da.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_da.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_de.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_de.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_el.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_el.dll" "MicrosoftEdgeUpdate.exe" renamed original file"C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_en.dll" to "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_en.dll"2d:T478,SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005176-39349-3887-004DCFF3 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005176-39349-3907-00406D80 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005176-39349-6612-004F2370 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006452-55614-8-0048C502 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006452-55614-98-0049317A SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006452-55614-2461-0048C033 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006452-55614-4279-0048C1BF SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001308-60270-8-00E4A553 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001308-60270-43-00E4F475 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001308-60270-2771-00E5A6B9 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003044-64212-12-00DDB431 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003044-64212-16-00DDDCE8 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003044-64212-202-00DDBF28 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003044-64212-478-00DDBD952e:T5ca,Found reference to API InitializeCriticalSectionAndSpinCount@KERNEL32.DLL at 00000000-00005176-39349-3923-004EEAFB Found reference to API GetDiskFreeSpaceExA@KERNEL32.DLL at 00000000-00005176-39349-5583-0043E8BE Found reference to API IsWow64Process@KERNEL32.DLL at 00000000-00005176-39349-5620-0044A4B2 Found reference to API GlobalMemoryStatusEx@KERNEL32.DLL at 00000000-00005176-39349-5827-004675D1 Found reference to API SetThreadStackGuarantee@KERNEL32.DLL at 00000000-00005176-39349-6582-004DC8D7 Found reference to API QueryFullProcessImageNameA@KERNEL32.DLL at 00000000-00005176-39349-7438-00436B0C Found reference to API GetProductInfo@KERNEL32.DLL at 00000000-00005176-39349-7872-00467055 Found reference to API Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00005176-39349-7876-0044A4EB Found reference to API NotifyWinEvent@USER32.DLL at 00000000-00005176-39349-9236-004D2168 Found reference to API Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00005176-39349-10718-0045DDCF Found reference to API RtlGetVersion@NTDLL.DLL at 00000000-00006452-55614-210-00459F01 Found reference to API GetNativeSystemInfo@KERNEL32.DLL at 00000000-00006452-55614-393-0045D564 Found reference to API GlobalMemoryStatusEx@KERNEL32.DLL at 00000000-00006452-55614-405-00416EE0 Found reference to API CreateHardLinkW@KERNEL32.DLL at 00000000-00006452-55614-2318-00414A72 Found reference to API LoadLibraryExA@KERNEL32.DLL at 00000000-00001308-60270-408-00E0BC602f:Tdc7,Found api reference "schannel: CertGetCertificateChain failed: %s" (Indicator: "CertGetCertificateChain"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found api reference "schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED" (Indicator: "CertGetCertificateChain"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found api reference "schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN" (Indicator: "CertGetCertificateChain"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found api reference "schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT" (Indicator: "CertGetCertificateChain"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found api reference "schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID" (Indicator: "CertGetCertificateChain"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found api reference "schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN" (Indicator: "CertGetCertificateChain"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found api reference "schannel: CertGetCertificateChain error mask: 0x%08x" (Indicator: "CertGetCertificateChain"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; File: "yuanbao_v2.371_x64.exe") Found api reference "CryptHashData" (Indicator: "CryptHashData"; File: "yuanbao_v2.371_x64.exe") Found api reference "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "yuanbao_v2.371_x64.exe") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "yuanbao_v2.371_x64.exe") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "yuanbao_v2.371_x64.exe") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "yuanbao_v2.371_x64.exe") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "yuanbao_v2.371_x64.exe") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "yuanbao_v2.371_x64.exe") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "yuanbao_v2.371_x64.exe") Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChain"; File: "yuanbao_v2.371_x64.exe") Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChainEngine"; File: "yuanbao_v2.371_x64.exe") Found api reference "CertCreateCertificateChainEngine" (Indicator: "CertCreateCertificateChainEngine"; File: "yuanbao_v2.371_x64.exe") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "yuanbao_v2.371_x64.exe") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "yuanbao_v2.371_x64.exe") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "yuanbao_v2.371_x64.exe") Found api reference "CertGetNameStringA" (Indicator: "CertGetNameStringA"; File: "yuanbao_v2.371_x64.exe") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; File: "yuanbao_v2.371_x64.exe") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; File: "yuanbao_v2.371_x64.exe") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; File: "yuanbao_v2.371_x64.exe")30:T190c,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-3907-00406D80 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-3907-00406D80 Assembly shows XOR instruction xor ecx dword ptr [eax+08h] in Stream UID: 00000000-00005176-39349-3945-004FA3AD Assembly shows XOR instruction xor dword ptr [eax+08h] ecx in Stream UID: 00000000-00005176-39349-3945-004FA3AD Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00005176-39349-3945-004FA3AD Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00005176-39349-3945-004FA3AD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-4224-004EEDE3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-4224-004EEDE3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-4225-004FC316 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-4225-004FC316 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-4227-004FC2CF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-4227-004FC2CF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-4262-004F078A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-4262-004F078A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-4263-004FC821 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-4263-004FC821 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-4296-004FADBF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-4296-004FADBF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-4526-004EDF1C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-4526-004EDF1C Assembly shows XOR instruction xor cl byte ptr [ebp-02h] in Stream UID: 00000000-00005176-39349-4533-004F3140 Assembly shows XOR instruction xor byte ptr [eax] cl in Stream UID: 00000000-00005176-39349-4533-004F3140 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-4755-004E5729 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-4755-004E5729 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-4768-004F6CF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-4768-004F6CF0 Assembly shows XOR instruction xor byte ptr [edi+2BD07754h] al in Stream UID: 00000000-00005176-39349-5049-004C8552 Assembly shows XOR instruction xor dh bl in Stream UID: 00000000-00005176-39349-5049-004C8552 Assembly shows XOR instruction xor ebx dword ptr [eax+77h] in Stream UID: 00000000-00005176-39349-5049-004C8552 Assembly shows XOR instruction xor eax 921076A8h in Stream UID: 00000000-00005176-39349-5049-004C8552 Assembly shows XOR instruction xor dl dh in Stream UID: 00000000-00005176-39349-5049-004C8552 Assembly shows XOR instruction xor dword ptr [ebp+20h] 00757EC1h in Stream UID: 00000000-00005176-39349-5049-004C8552 Assembly shows XOR instruction xor byte ptr [edx-07h] bl in Stream UID: 00000000-00005176-39349-5049-004C8552 Assembly shows XOR instruction xor byte ptr [esi-2C9F8B08h] cl in Stream UID: 00000000-00005176-39349-5049-004C8552 Assembly shows XOR instruction xor bh cl in Stream UID: 00000000-00005176-39349-5049-004C8552 Assembly shows XOR instruction xor dword ptr [ecx] 74h in Stream UID: 00000000-00005176-39349-5049-004C8552 Assembly shows XOR instruction xor byte ptr [edi+7AB074F8h] dl in Stream UID: 00000000-00005176-39349-5049-004C8552 Assembly shows XOR instruction xor dword ptr [edi+00h] 60000000h in Stream UID: 00000000-00005176-39349-5049-004C8552 Assembly shows XOR instruction xor ah byte ptr [eax+51h] in Stream UID: 00000000-00005176-39349-5049-004C8552 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-5076-004D0E71 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-5076-004D0E71 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-5077-004D0D22 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-5077-004D0D22 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-5154-00405887 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-5154-00405887 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-5303-004C2FBA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-5303-004C2FBA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-5305-004C2DE1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-5305-004C2DE1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-5326-0041E1E7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-5326-0041E1E7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-5487-00436743 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-5487-00436743 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-5488-00436936 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-5488-00436936 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-5498-00438B8C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-5498-00438B8C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-5499-00438BDE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-5499-00438BDE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-5500-00438C84 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-5500-00438C84 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005176-39349-5501-00438CD1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005176-39349-5501-00438CD131:T952,Found reference to API "schannel: CertGetNameString() returned no certificate name information" (Indicator: "CertGetNameString"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "schannel: CertGetNameString() returned certificate name information of unexpected size" (Indicator: "CertGetNameString"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names" (Indicator: "CertGetNameString"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "CryptImportKey" (Indicator: "CryptImportKey"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CertGetNameStringA" (Indicator: "CertGetNameString"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CertGetNameStringW" (Indicator: "CertGetNameString"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CryptDeriveKey" (Indicator: "CryptDeriveKey"; File: "yuanbao_v2.371_x64.exe")32:T414,Found reference to API "CryptImportKey" (Indicator: "CryptImportKey"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "yuanbao_v2.371_x64.exe") Found reference to API "CryptDeriveKey" (Indicator: "CryptDeriveKey"; File: "yuanbao_v2.371_x64.exe")33:T1440,Found string "RSA Public Key (%lu bits)" (Indicator: "public key"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "RSA Public Key" (Indicator: "public key"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "SSL public key does not match pinned public key" (Indicator: "public key"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "SSL: public key does not match pinned public key!" (Indicator: "public key"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "SSL: failed retrieving public key from server certificate" (Indicator: "public key"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "public key hash: sha256//%s" (Indicator: "public key"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "-----BEGIN PUBLIC KEY-----" (Indicator: "public key"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "-----END PUBLIC KEY-----" (Indicator: "public key"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "Public Key Algorithm" (Indicator: "public key"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "Public Key Algorithm: %s" (Indicator: "public key"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "If this option is used several times, the last one will be used. If unspecified, the option defaults to 60 seconds. Added in 7.18.0. --key-type (TLS) Private key file type. Specify wh" (Indicator: "private key"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "--key (TLS SSH) Private key file name. Allows you to provide your pri- vate key in this separate file. For SSH, if not specified, curl tries the following candidates in order: If curl" (Indicator: "private key"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "hashes) to verify the peer. This can be a path to a file which contains a single public key in PEM or DER format, or any number of base64 encoded sha256 hashes preceded by 'sha256//' and sepa- rate" (Indicator: "public key"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "(TLS) Tells curl to use the specified public key file (or hashes) to verify the proxy. This can be a path to a file which contains a single public key in PEM or DER format, or any number of b" (Indicator: "public key"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "certificate indicating its identity. A public key is extracted from this certificate and if it does not exactly match the pub- lic key provided to this option, curl will abort the connection befo" (Indicator: "public key"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "(SFTP SCP) Public key file name. Allows you to provide your pub- lic key in this separate file. If this option is used several times, the last one will be used. (As of 7.39.0, curl attempts to autom" (Indicator: "public key"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "87 unable to parse FTP file list 88 FTP chunk callback reported error 89 No connection available, the session will be queued 90 SSL public key does not matched pinned public key 91 Invalid SSL cer" (Indicator: "public key"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "ncrypted Private Key" (Indicator: "private key"; Source: "00000000-00001172.00000000.134495.034B0000.00000004.mdmp") Found string "90 SSL public key does not matched pinned public key" (Indicator: "public key"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "(SFTP SCP) Public key file name. Allows you to provide your pub-" (Indicator: "public key"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "key from the private key file, so passing this option is gener-" (Indicator: "private key"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "ally not required. Note that this public key extraction requires" (Indicator: "public key"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "certificate indicating its identity. A public key is extracted" (Indicator: "public key"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "contains a single public key in PEM or DER format, or any number" (Indicator: "public key"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "certificate indicating its identity. A public key is extracted" (Indicator: "public key"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp")34:T688,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Possibly contains Public/Private key (encryption) Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Command line contains long Base64-encoded string Matched sigs: Contains reference to crypto DLLs Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Detected Suricata alert – Encrypted channel Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains key cryptographic functions of the CryptoAPI Matched sigs: YARA signature match - AES encryption35:Tf764,Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 362003; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 813613; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 854686; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 911628; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 967926; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1160382; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1295055; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1326536; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1341565; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1442490; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1459818; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1494861; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1536599; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1600782; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1675389; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1734240; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1738686; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1741864; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1760792; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1849329; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1935635; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2061143; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2068650; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2165526; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2172462; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2179305; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2226565; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2228927; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2284648; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2309889; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2351655; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2415841; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2493740; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2527755; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2552910; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2724592; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2775608; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2832584; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2877932; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2895738; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2905307; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2926815; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2965821; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3036972; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3073274; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3077956; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3092409; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3145856; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3165466; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3372360; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3393986; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3442874; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3549512; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3598158; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3653836; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3655759; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3663157; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3665371; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3669689; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3673231; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3742433; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3973803; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4110969; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4215808; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4220423; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4225827; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4249190; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4370943; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4556468; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4825380; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4947557; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 5115151; code bytes = 30d0 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 16590; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 16595; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 29615; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 109703; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 110892; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 111042; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 111089; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 121958; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 163451; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 163457; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 207133; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 373206; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 380818; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386486; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386490; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386494; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386498; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386502; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386506; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386510; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386514; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386518; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386522; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386526; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386530; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386534; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386538; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386542; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386546; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386550; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386554; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386558; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386562; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386566; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386570; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386574; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386578; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386582; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386586; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386590; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386594; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386598; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386602; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386606; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386610; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386614; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386618; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386622; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386626; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386630; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386634; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386638; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386642; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386646; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386650; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386654; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386658; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386662; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386666; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386670; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386674; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386678; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386682; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386686; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386690; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386694; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386698; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386702; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386706; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386710; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386714; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386718; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386722; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386726; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386730; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386734; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 386738; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 458093; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 470878; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 479516; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 481247; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 519159; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 520258; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 520288; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 520322; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 554136; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 571350; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 574107; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 830559; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 854556; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 890472; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 933967; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1001982; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1016675; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1060775; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1076295; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1102673; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1302583; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1371331; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1384623; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1452068; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1494963; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1520400; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1563119; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1644508; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1658004; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1686994; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1845239; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1987380; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2021617; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2028040; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2041075; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2048048; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2072025; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2126909; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2214179; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2276648; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2281472; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2326813; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2332890; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2366001; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2439727; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2490972; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2599710; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2612755; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2698043; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2823532; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3050501; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3091317; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3097955; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3180881; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3222172; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3256172; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3318401; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3353480; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3358323; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3449497; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3481668; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3502491; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3583913; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3584619; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3837691; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3918845; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3984146; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3993710; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4017890; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4017902; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4069150; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4076151; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4097981; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4144499; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4173202; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4196885; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4337314; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4404980; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4472493; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4516288; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4785821; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4898397; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4943858; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 5036132; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 5138076; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 5170126; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 5230343; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 5246213; code bytes = 33c1 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 348514; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 503361; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 522360; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 529450; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 533790; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 936680; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 980774; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1137259; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1183179; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1373797; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1481403; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1539997; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1559482; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1583634; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1667690; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1766582; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1803995; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1829916; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1913018; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1925103; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1938085; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 1986748; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2034887; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2057240; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2079960; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2090384; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2125729; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2261466; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2267617; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2295147; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2306764; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2368290; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2387877; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2466218; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2568191; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2628074; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2648413; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2648852; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2703965; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2809544; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2848835; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 2864601; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3050653; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3117307; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3210677; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3473074; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3663956; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3709138; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3712623; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3804015; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3896219; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 3900340; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4132321; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4138551; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4331610; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4349833; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4376306; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4431495; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4442933; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4466142; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4484499; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4617029; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4683469; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4884344; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4966303; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 4967434; code bytes = 8030 Found XOR loop in file "yuanbao_2.77.1.612_x64.exe" at offset 5032055; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 143208; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 324595; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 551087; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 551774; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 551851; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2146767; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2291327; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2296811; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2311227; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2311993; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2330667; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2344539; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2346005; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2349435; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2351263; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2353319; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2355375; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2358181; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2362429; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2362627; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 2366518; code bytes = 30d0 Found XOR loop in file "msedgeupdate.dll" at offset 122816; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 368580; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 386059; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 426843; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 426995; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 501553; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1108174; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1118977; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1119120; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1119189; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1119255; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1225822; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1315697; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2097531; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2168287; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2175597; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2287723; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2290215; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2296007; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2304045; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2306533; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2307439; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2316495; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2327425; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2329247; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2333647; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2333955; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 2341849; code bytes = 33c1 Found XOR loop in file "msedgeupdate.dll" at offset 1238638; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 1238737; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 1506215; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 1548972; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 1561322; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 1784196; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2088769; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2111741; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2167545; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2171991; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2290868; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2294410; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2316610; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2320400; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2323950; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2334520; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2344504; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2344792; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2345970; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2351224; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2353280; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2355336; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2359706; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2360376; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2362588; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2364146; code bytes = 8030 Found XOR loop in file "msedgeupdate.dll" at offset 2369123; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 157214; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 248992; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 256665; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 293842; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 324459; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 330415; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 394616; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 438479; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 503463; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 552839; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 633797; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 645007; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 821084; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 858612; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 913649; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1049260; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1106666; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1172988; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1240093; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1250791; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1269738; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1270378; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1335779; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1348448; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1390897; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1553397; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1567837; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1587220; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1587741; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1681999; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1687094; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 31396; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 36126; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 258378; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 387763; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 469915; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 507130; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 559704; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 596356; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 649755; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 668848; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 705934; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 712464; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1034617; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1034942; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1040394; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1140982; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1144189; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1160539; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1166583; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1205940; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1312976; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1328531; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1452933; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1468694; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1489988; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1554570; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1559436; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1597047; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1679535; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 51183; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 216365; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 248419; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 253669; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 335326; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 358949; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 453895; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 501816; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 506903; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 523428; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 553468; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 621919; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 662707; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 669107; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 682187; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 867109; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 911529; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 928257; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 950026; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1204086; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1222551; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1282058; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1286491; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1413287; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1517101; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1629120; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1683630; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1684722; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateSetup.exe" at offset 1691618; code bytes = 8030 Found XOR loop in file "report_helper.exe" at offset 26044; code bytes = 30d0 Found XOR loop in file "report_helper.exe" at offset 235068; code bytes = 30d0 Found XOR loop in file "report_helper.exe" at offset 268225; code bytes = 30d0 Found XOR loop in file "report_helper.exe" at offset 268380; code bytes = 30d0 Found XOR loop in file "report_helper.exe" at offset 268656; code bytes = 30d0 Found XOR loop in file "report_helper.exe" at offset 773257; code bytes = 30d0 Found XOR loop in file "report_helper.exe" at offset 790287; code bytes = 30d0 Found XOR loop in file "report_helper.exe" at offset 791849; code bytes = 30d0 Found XOR loop in file "report_helper.exe" at offset 792891; code bytes = 30d0 Found XOR loop in file "report_helper.exe" at offset 806013; code bytes = 30d0 Found XOR loop in file "report_helper.exe" at offset 111625; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 111630; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 111651; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 111656; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 112306; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 112498; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 123683; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 123688; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 123774; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 123781; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 123828; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 123835; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 123895; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 123906; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 123960; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 123965; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 124033; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 774665; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 775251; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 781157; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 782795; code bytes = 33c1 Found XOR loop in file "report_helper.exe" at offset 394830; code bytes = 8030 Found XOR loop in file "report_helper.exe" at offset 397194; code bytes = 8030 Found XOR loop in file "report_helper.exe" at offset 398116; code bytes = 8030 Found XOR loop in file "report_helper.exe" at offset 434038; code bytes = 8030 Found XOR loop in file "report_helper.exe" at offset 434645; code bytes = 8030 Found XOR loop in file "report_helper.exe" at offset 435239; code bytes = 8030 Found XOR loop in file "report_helper.exe" at offset 441121; code bytes = 8030 Found XOR loop in file "report_helper.exe" at offset 450994; code bytes = 8030 Found XOR loop in file "report_helper.exe" at offset 740834; code bytes = 8030 Found XOR loop in file "report_helper.exe" at offset 741623; code bytes = 8030 Found XOR loop in file "report_helper.exe" at offset 786360; code bytes = 8030 Found XOR loop in file "report_helper.exe" at offset 789466; code bytes = 8030 Found XOR loop in file "report_helper.exe" at offset 792182; code bytes = 8030 Found XOR loop in file "report_helper.exe" at offset 792872; code bytes = 8030 Found XOR loop in file "report_helper.exe" at offset 793512; code bytes = 8030 Found XOR loop in file "report_helper.exe" at offset 798895; code bytes = 8030 Found XOR loop in file "report_helper.exe" at offset 801557; code bytes = 8030 Found XOR loop in file "report_helper.exe" at offset 801804; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 5916; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 35043; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 42745; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 84093; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 89557; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 116910; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 191806; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 224553; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 287073; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 307246; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 335081; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 422754; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 471564; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 474925; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 525485; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 547295; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 48920; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 55197; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 209247; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 235215; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 235358; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 258595; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 356760; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 365827; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 399831; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 406500; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 481227; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 14881; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 24187; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 24743; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 32772; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 72427; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 92874; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 100996; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 120563; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 121546; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 220306; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 232082; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 243472; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 249097; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 299230; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 341780; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 370013; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 387188; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 456220; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 468898; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 492288; code bytes = 8030 Found XOR loop in file "ProductHelper.dll" at offset 491839; code bytes = 30d0 Found XOR loop in file "ProductHelper.dll" at offset 495979; code bytes = 30d0 Found XOR loop in file "ProductHelper.dll" at offset 496633; code bytes = 30d0 Found XOR loop in file "ProductHelper.dll" at offset 153627; code bytes = 33c1 Found XOR loop in file "ProductHelper.dll" at offset 153648; code bytes = 33c1 Found XOR loop in file "ProductHelper.dll" at offset 153669; code bytes = 33c1 Found XOR loop in file "ProductHelper.dll" at offset 153738; code bytes = 33c1 Found XOR loop in file "ProductHelper.dll" at offset 153830; code bytes = 33c1 Found XOR loop in file "ProductHelper.dll" at offset 153929; code bytes = 33c1 Found XOR loop in file "ProductHelper.dll" at offset 215646; code bytes = 33c1 Found XOR loop in file "ProductHelper.dll" at offset 219074; code bytes = 33c1 Found XOR loop in file "ProductHelper.dll" at offset 268203; code bytes = 33c1 Found XOR loop in file "ProductHelper.dll" at offset 493493; code bytes = 33c1 Found XOR loop in file "ProductHelper.dll" at offset 415503; code bytes = 8030 Found XOR loop in file "ProductHelper.dll" at offset 485720; code bytes = 8030 Found XOR loop in file "ProductHelper.dll" at offset 492010; code bytes = 8030 Found XOR loop in file "ProductHelper.dll" at offset 495960; code bytes = 8030 Found XOR loop in file "ProductHelper.dll" at offset 498400; code bytes = 8030 Found XOR loop in file "ProductHelper.dll" at offset 503296; code bytes = 8030 Found XOR loop in file "ProductHelper.dll" at offset 506135; code bytes = 8030 Found XOR loop in file "psmachine_64.dll" at offset 415798; code bytes = 30d0 Found XOR loop in file "psmachine_64.dll" at offset 96536; code bytes = 33c1 Found XOR loop in file "psmachine_64.dll" at offset 98671; code bytes = 8030 Found XOR loop in file "psmachine_64.dll" at offset 236819; code bytes = 8030 Found XOR loop in file "psmachine_64.dll" at offset 413426; code bytes = 8030 Found XOR loop in file "psmachine_64.dll" at offset 418403; code bytes = 8030 Found XOR loop in file "psuser_64.dll" at offset 415798; code bytes = 30d0 Found XOR loop in file "psuser_64.dll" at offset 96536; code bytes = 33c1 Found XOR loop in file "psuser_64.dll" at offset 98671; code bytes = 8030 Found XOR loop in file "psuser_64.dll" at offset 236819; code bytes = 8030 Found XOR loop in file "psuser_64.dll" at offset 413426; code bytes = 8030 Found XOR loop in file "psuser_64.dll" at offset 418403; code bytes = 8030 Found XOR loop in file "psuser_arm64.dll" at offset 56776; code bytes = 30d0 Found XOR loop in file "psuser_arm64.dll" at offset 347600; code bytes = 30d0 Found XOR loop in file "psuser_arm64.dll" at offset 391734; code bytes = 30d0 Found XOR loop in file "psuser_arm64.dll" at offset 133496; code bytes = 33c1 Found XOR loop in file "psuser_arm64.dll" at offset 389362; code bytes = 8030 Found XOR loop in file "psuser_arm64.dll" at offset 394339; code bytes = 8030 Found XOR loop in file "psmachine_arm64.dll" at offset 56776; code bytes = 30d0 Found XOR loop in file "psmachine_arm64.dll" at offset 347600; code bytes = 30d0 Found XOR loop in file "psmachine_arm64.dll" at offset 391734; code bytes = 30d0 Found XOR loop in file "psmachine_arm64.dll" at offset 133496; code bytes = 33c1 Found XOR loop in file "psmachine_arm64.dll" at offset 389362; code bytes = 8030 Found XOR loop in file "psmachine_arm64.dll" at offset 394339; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 54046; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 148809; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 331633; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 332819; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 333269; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 337719; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 341046; code bytes = 30d0 Found XOR loop in file "psuser.dll" at offset 73374; code bytes = 33c1 Found XOR loop in file "psuser.dll" at offset 83507; code bytes = 33c1 Found XOR loop in file "psuser.dll" at offset 324717; code bytes = 33c1 Found XOR loop in file "psuser.dll" at offset 325933; code bytes = 33c1 Found XOR loop in file "psuser.dll" at offset 39580; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 183404; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 195754; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 203807; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 328796; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 332800; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 333906; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 334800; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 337684; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 338674; code bytes = 8030 Found XOR loop in file "psuser.dll" at offset 343650; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 54046; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 148809; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 331633; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 332819; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 333269; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 337719; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 341046; code bytes = 30d0 Found XOR loop in file "psmachine.dll" at offset 73374; code bytes = 33c1 Found XOR loop in file "psmachine.dll" at offset 83507; code bytes = 33c1 Found XOR loop in file "psmachine.dll" at offset 324717; code bytes = 33c1 Found XOR loop in file "psmachine.dll" at offset 325933; code bytes = 33c1 Found XOR loop in file "psmachine.dll" at offset 343222; code bytes = 33c1 Found XOR loop in file "psmachine.dll" at offset 39580; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 183404; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 195754; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 203807; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 328796; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 332800; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 333906; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 334800; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 337684; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 338674; code bytes = 8030 Found XOR loop in file "psmachine.dll" at offset 343651; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 3307; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 3537; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 269771; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 273974; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 53795; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 58526; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 262257; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 263405; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 265327; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 267415; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 276150; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 159532; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 171882; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 269292; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 270276; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 271602; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateCore.exe" at offset 276579; code bytes = 8030 Found XOR loop in file "INetC.dll" at offset 186764; code bytes = 8030 Found XOR loop in file "INetC.dll" at offset 203870; code bytes = 8030 Found XOR loop in file "INetC.dll" at offset 214480; code bytes = 8030 Found XOR loop in file "INetC.dll" at offset 215386; code bytes = 8030 Found XOR loop in file "INetC.dll" at offset 238080; code bytes = 8030 Found XOR loop in file "INetC.dll" at offset 240920; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 225846; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 23384; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 232584; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 120435; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 128376; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 133360; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 223474; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateComRegisterShell64.exe" at offset 228451; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 192839; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 193785; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 200758; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 45244; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 195271; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 192820; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 193766; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 198386; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdate.exe" at offset 203363; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeComRegisterShellARM64.exe" at offset 192054; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeComRegisterShellARM64.exe" at offset 6224; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeComRegisterShellARM64.exe" at offset 189682; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeComRegisterShellARM64.exe" at offset 194659; code bytes = 8030 Found XOR loop in file "libcef.dll" at offset 2589; code bytes = 30d0 Found XOR loop in file "libcef.dll" at offset 141729; code bytes = 30d0 Found XOR loop in file "libcef.dll" at offset 31741; code bytes = 33c1 Found XOR loop in file "libcef.dll" at offset 32360; code bytes = 33c1 Found XOR loop in file "libcef.dll" at offset 141302; code bytes = 8030 Found XOR loop in file "libcef.dll" at offset 147176; code bytes = 8030 Found XOR loop in file "libcef.dll" at offset 148420; code bytes = 8030 Found XOR loop in file "libcef.dll" at offset 152356; code bytes = 8030 Found XOR loop in file "libcef.dll" at offset 157496; code bytes = 8030 Found XOR loop in file "WebProcess.exe" at offset 107032; code bytes = 30d0 Found XOR loop in file "WebProcess.exe" at offset 131659; code bytes = 30d0 Found XOR loop in file "WebProcess.exe" at offset 134971; code bytes = 30d0 Found XOR loop in file "WebProcess.exe" at offset 136537; code bytes = 30d0 Found XOR loop in file "WebProcess.exe" at offset 129589; code bytes = 33c1 Found XOR loop in file "WebProcess.exe" at offset 145384; code bytes = 33c1 Found XOR loop in file "WebProcess.exe" at offset 131804; code bytes = 8030 Found XOR loop in file "WebProcess.exe" at offset 143010; code bytes = 8030 Found XOR loop in file "WebProcess.exe" at offset 148293; code bytes = 8030 Found XOR loop in file "WebProcess.exe" at offset 150007; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 87805; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 93750; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 2925; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 91378; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateOnDemand.exe" at offset 96354; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 87805; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 93750; code bytes = 30d0 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 2925; code bytes = 33c1 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 91378; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 94670; code bytes = 8030 Found XOR loop in file "MicrosoftEdgeUpdateBroker.exe" at offset 96355; code bytes = 8030 Found XOR loop in file "msedgeupdateres_ml.dll" at offset 24630; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_ml.dll" at offset 22258; code bytes = 8030 Found XOR loop in file "msedgeupdateres_ml.dll" at offset 27235; code bytes = 8030 Found XOR loop in file "msedgeupdateres_el.dll" at offset 24630; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_el.dll" at offset 22258; code bytes = 8030 Found XOR loop in file "msedgeupdateres_el.dll" at offset 25550; code bytes = 8030 Found XOR loop in file "msedgeupdateres_el.dll" at offset 27235; code bytes = 8030 Found XOR loop in file "msedgeupdateres_de.dll" at offset 24630; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_de.dll" at offset 22258; code bytes = 8030 Found XOR loop in file "msedgeupdateres_de.dll" at offset 25550; code bytes = 8030 Found XOR loop in file "msedgeupdateres_de.dll" at offset 27235; code bytes = 8030 Found XOR loop in file "msedgeupdateres_lb.dll" at offset 24118; code bytes = 30d0 Found XOR loop in file "msedgeupdateres_lb.dll" at offset 26294; code bytes = 33c1 Found XOR loop in file "msedgeupdateres_lb.dll" at offset 21746; code bytes = 8030 Found XOR loop in file "msedgeupdateres_lb.dll" at offset 26723; code bytes = 803036:T84a,"irsetup.exe" called "GetWindowTextW" with parameter "Initializing..." - (UID: 00000000-00005176) "irsetup.exe" called "GetWindowTextA" (UID: 00000000-00005176) "WebProcess.exe" called "GetWindowTextW" with parameter "Program Manager" - (UID: 00000000-00006212) "WebProcess.exe" called "GetWindowTextW" with parameter "Yuanbao Setup" - (UID: 00000000-00006212) "yuanbao_2.77.1.612_x64.exe" called "GetWindowTextW" with parameter "%PROGRAMFILES%\Tencent\Yuanbao" - (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "GetWindowTextW" with parameter "&Install" - (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "GetWindowTextW" with parameter "20002000" - (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "GetWindowTextW" with parameter "2000" - (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "GetWindowTextW" with parameter "Choose Install Location" - (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "GetWindowTextW" with parameter "Choose the folder in which to install Yuanbao." - (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "GetWindowTextW" with parameter "B&rowse..." - (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "GetWindowTextW" with parameter "Space available: 34.8 GB" - (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "GetWindowTextW" with parameter "Space required: 250.9 MB" - (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "GetWindowTextW" with parameter "Setup will install Yuanbao in the following folder. To install in a different folder, click Browse and select another folder. Clic" - (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "GetWindowTextW" with parameter "Destination Folder" - (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "GetWindowTextW" with parameter "Create desktop shortcut" - (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "GetWindowTextW" with parameter "Auto start at login" - (UID: 00000000-00006452)37:T2098,"yuanbao_v2.371_x64.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006148) "yuanbao_v2.371_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006148) "yuanbao_v2.371_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000e8d50f0538cfa877b436b40254d60f05010000006836b402b436b4026836b402040000000400000000e054740010000054d60f05010000006836b402cd97a8779c97a87729907cd3b50f4b746836b4020000a87700000000a40c456f0000000080ee51740100000060d70f05f8e2547400000000040000000000000048405374f8e2547458d60f0580e8c276289cb40280e8c27654d60f050000000080e8c27680d60f051b800800f8d60f055806000084dd0f05642a267427645e2f01000000faffffff30de0f05000000001800000000000000e4d227200000000000000000ffffffff0000000000000000000000005effb60274ffb602 (UID: 00000000-00006148) "yuanbao_v2.371_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000084dd0f05f8d60f051b8008008b474900ec010000000000000000000000000000e8d60f051b80080060d70f0558060000ecdd0f0518000000e4d22720ec0100000000000062484973ec010000000000000000000000000000e8d60f05000000000000000018000000ecdd0f0560d70f050cd2272084d50f05ec01000098d60f05a2e04a738ceb6356feffffffa8d60f05222a2674ec01000000000000000000000000000080d60f051b800800f8d60f055806000084dd0f05642a267427645e2f01000000faffffff30de0f05000000001800000000000000e4d227200000000000000000ffffffff0000000000000000000000008e03b702a603b702 (UID: 00000000-00006148) "yuanbao_v2.371_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000084dd0f05f8d60f051b8008008b474900ec010000000000000000000000000000e8d60f051b80080060d70f0558060000ecdd0f0518000000e4d22720ec0100000000000062484973ec010000000000000000000000000000e8d60f05000000000000000018000000ecdd0f0560d70f050cd2272084d50f05ec01000098d60f05a2e04a738ceb6356feffffffa8d60f05222a2674ec01000000000000000000000000000080d60f051b800800f8d60f055806000084dd0f05642a267427645e2f01000000faffffff30de0f05000000001800000000000000e4d227200000000000000000ffffffff0000000000000000000000005620b7026a20b702 (UID: 00000000-00006148) "yuanbao_v2.371_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000084dd0f05f8d60f051b8008008b474900ec010000000000000000000000000000e8d60f051b80080060d70f0558060000ecdd0f0518000000e4d22720ec0100000000000062484973ec010000000000000000000000000000e8d60f05000000000000000018000000ecdd0f0560d70f050cd2272084d50f05ec01000098d60f05a2e04a738ceb6356feffffffa8d60f05222a2674ec01000000000000000000000000000080d60f051b800800f8d60f055806000084dd0f05642a267427645e2f01000000faffffff30de0f05000000001800000000000000e4d227200000000000000000ffffffff000000000000000000000000f63cb7020e3db702 (UID: 00000000-00006148) "yuanbao_v2.371_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000084dd0f05f8d60f051b8008008b474900ec010000000000000000000000000000e8d60f051b80080060d70f0558060000ecdd0f0518000000e4d22720ec0100000000000062484973ec010000000000000000000000000000e8d60f05000000000000000018000000ecdd0f0560d70f050cd2272084d50f05ec01000098d60f05a2e04a738ceb6356feffffffa8d60f05222a2674ec01000000000000000000000000000080d60f051b800800f8d60f055806000084dd0f05642a267427645e2f01000000faffffff30de0f05000000001800000000000000e4d227200000000000000000ffffffff000000000000000000000000962fb702ac2fb702 (UID: 00000000-00006148) "yuanbao_v2.371_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000084dd0f05f8d60f051b8008008b474900ec010000000000000000000000000000e8d60f051b80080060d70f0558060000ecdd0f0518000000e4d22720ec0100000000000062484973ec010000000000000000000000000000e8d60f05000000000000000018000000ecdd0f0560d70f050cd2272084d50f05ec01000098d60f05a2e04a738ceb6356feffffffa8d60f05222a2674ec01000000000000000000000000000080d60f051b800800f8d60f055806000084dd0f05642a267427645e2f01000000faffffff30de0f05000000001800000000000000e4d227200000000000000000ffffffff0000000000000000000000004646b7025e46b702 (UID: 00000000-00006148) "yuanbao_v2.371_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000084dd0f05f8d60f051b8008008b474900ec010000000000000000000000000000e8d60f051b80080060d70f0558060000ecdd0f0518000000e4d22720ec0100000000000062484973ec010000000000000000000000000000e8d60f05000000000000000018000000ecdd0f0560d70f050cd2272084d50f05ec01000098d60f05a2e04a738ceb6356feffffffa8d60f05222a2674ec01000000000000000000000000000080d60f051b800800f8d60f055806000084dd0f05642a267427645e2f01000000faffffff30de0f05000000001800000000000000e4d227200000000000000000ffffffff000000000000000000000000ee40b7020641b702 (UID: 00000000-00006148) "yuanbao_v2.371_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000004973ec010000000000000000000000000000b0cf0f051b80080028d00f0558060000b4d60f05180000003ccb2720ec0100000000000062484973ec010000000000000000000000000000b0cf0f05000000000000000000000000b4d60f0528d00f051b8008008b474900ec01000000000000000000000000000018d00f051b80080090d00f05580600001cd70f051800000094cb2720ec0100000000000062484973ec01000000000000000000000000000018d00f050000000000000000180000001cd70f0590d00f053ccb2720b4ce0f05ec010000c8cf0f05a2e04a730000000000000000ffffffff00000000000000000000000046cbb7025ecbb702 (UID: 00000000-00006148) "yuanbao_v2.371_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c000b402b067b4020000000001000000b0cf0f051b80080028d00f055806000002680000e0000000a301a8774d987cd338aeb8020000b40278d6b70200000000a301a87775987cd398c7b7020000b40238a9b802000000860000000028d00f05fd6700000200000200000000e1670086f8afb802e167008602000000d50000000000b402c0cf0f0500b0b802ff0700001a0000003b98fffffeffffffd0073c00e0000000e00000000800000000003c003b98ffff9400000038aeb8021c00000028a1b80208d1b70201000000000000002000000000003c0028023c000000000000000000ffffffff000000000000000000000000eeabb80206acb802 (UID: 00000000-00006148) "yuanbao_v2.371_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c000b402b067b4020000000001000000b0cf0f051b80080028d00f055806000002680000e0000000a301a8774d987cd338aeb8020000b40278d6b70200000000a301a87775987cd398c7b7020000b40238a9b802000000860000000028d00f05fd6700000200000200000000e1670086f8afb802e167008602000000d50000000000b402c0cf0f0500b0b802ff0700001a0000003b98fffffeffffffd0073c00e0000000e00000000000000000003c003b98ffffe600000038aeb8021c00000028a1b80208d1b70200000000000000002000000000003c0028023c000000000000000000ffffffff000000000000000000000000eec7b70206c8b702 (UID: 00000000-00006148) "yuanbao_v2.371_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c000b402b067b4020000000001000000b0cf0f051b80080028d00f055806000002680000e0000000a301a8774d987cd338aeb8020000b40278d6b70200000000a301a87775987cd398c7b7020000b40238a9b802000000860000000028d00f05fd6700000200000200000000e1670086f8afb802e167008602000000d50000000000b402c0cf0f0500b0b802ff0700001a0000003b98fffffeffffffd0073c00e0000000e00000000600000000003c003b98ffffb0ea000038aeb8021c00000028a1b80208d1b70206000000000000002000000000003c0028023c000000000000000000ffffffff000000000000000000000000f6c1b8020ac2b802 (UID: 00000000-00006148)38:Td47,"yuanbao_v2.371_x64.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000a3b4026836b40208a3b4026836b4026836b4026836b4026836b4021833b4026836b4026836b4026836b40208a3b4026836b4026836b4026836b4026836b4026836b4026836b402b88db4026836b4026836b4026836b4026836b4021833b4026836b4026836b4021833b4026836b4026836b4026836b4026836b4026836b402 (UID: 00000000-00006148) "irsetup.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000050f2ba0050840f0390810f03a07bb577a07bb57700000000b0c90f0306000000000000000020f573001000000600000000000000c420f57302000000d04ef473bc20f5730050010000000000ffffffff0000000056004300520055004e00540049004d0045003100340030002e0064006c006c000000000000000000 (UID: 00000000-00005176) "irsetup.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005176) "irsetup.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000d4f8ba00040000000000000088de55cc340000004ae74d0004100705847951008078510001000000fcf8ba00cc984e00e86b56003cf9ba00f3e14d00080000006f144e0069144e00024060878479510080785100010000006d60510010f9ba00a8500f03d4f9ba0060ca4d00a6ca8f87feffffff69144e0079144e00 (UID: 00000000-00005176) "irsetup.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000b330364000000a8fa0f03f9644a00f85f0f03a8fa0f0318cb120340f0ba005ac44d00000007050000000079c44d007e49608788bb2f07b03e5600a015300728cb120314f0ba00efd8ffffecf0ba0060ca4d008ec88f87feffffff79c44d00fe064c0078bb2f077017400078bb2f07c56e4000349851007044560000000000 (UID: 00000000-00005176) "irsetup.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000084fa74ae0204001f03000001000000000000001cf5ba00a8c4f874008e7d0301000000c8c00000586b1775f0f4ba009c2cfe74ebffffff00917d0300000000010000003cf5ba00759ef97470030300c8c000002cf5ba00a940fc7400917d030000000080e7b772180303000000000018030300ae7a4b0090f5ba00eb274000 (UID: 00000000-00005176) "irsetup.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005176) "irsetup.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000675600d067560044f2ba0087fd4c0098633177100001001c09012200000000000000001c0922ffffffffff20af2e7450f2ba0009af2e7403000000b0292d74c906000088292d7468f2ba0014af2e74a65e4f8580f2ba00ab8a317403000000b0292d74c906000088292d74100001001c09012201000000d0825100e38a3174 (UID: 00000000-00005176) "yuanbao_2.77.1.612_x64.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000d80a7f0000000000e8ea7c005916a8770100000008000000010000000000af02d712f2af10000000000000000000000002000000020000000000af0201000000080000000000000008eb7c00ee13a87701000000ee13a87708000000000000000800000037e6b9dc40ed7c00ad9c4b720000af020800000001000000 (UID: 00000000-00006452)39:T666,GetTickCount@KERNEL32.DLL at 00000000-00005176-39349-5617-00447290 GlobalMemoryStatus@KERNEL32.DLL at 00000000-00005176-39349-5827-004675D1 GetTickCount@KERNEL32.DLL at 00000000-00005176-39349-6692-004F2F5E GlobalMemoryStatus@KERNEL32.DLL at 00000000-00005176-39349-7057-0041E876 GetTickCount@KERNEL32.DLL at 00000000-00005176-39349-7592-0044783A GetTickCount@KERNEL32.DLL at 00000000-00005176-39349-7617-00447B22 GetTickCount@KERNEL32.DLL at 00000000-00006452-55614-210-00459F01 GetTickCount@KERNEL32.DLL at 00000000-00006452-55614-263-0045EA9E GetTickCount@KERNEL32.DLL at 00000000-00006452-55614-264-0045D6A0 GetTickCount@KERNEL32.DLL at 00000000-00006452-55614-284-0045E96D GlobalMemoryStatus@KERNEL32.DLL at 00000000-00006452-55614-405-00416EE0 GetTickCount@KERNEL32.DLL at 00000000-00006452-55614-479-00403E88 GetTickCount@KERNEL32.DLL at 00000000-00006452-55614-501-00404108 GetTickCount@KERNEL32.DLL at 00000000-00006452-55614-502-004040A4 GetTickCount@KERNEL32.DLL at 00000000-00006452-55614-505-00407B83 GetTickCount@KERNEL32.DLL at 00000000-00006452-55614-1050-0041483A GetTickCount@KERNEL32.DLL at 00000000-00006452-55614-1198-0040F536 GetTickCount@KERNEL32.DLL at 00000000-00006452-55614-2078-004704CF GetTickCount@KERNEL32.DLL at 00000000-00001308-60270-213-00E1C1A0 GetTickCount@KERNEL32.DLL at 00000000-00001308-60270-1371-00DFE005 GetTickCount@KERNEL32.DLL at 00000000-00001308-60270-1373-00E01F40 GetTickCount@KERNEL32.DLL at 00000000-00001308-60270-1424-00DF39B0 GetTickCount@KERNEL32.DLL at 00000000-00001308-60270-1427-00DF3010 GetTickCount@KERNEL32.DLL at 00000000-00001308-60270-1577-00E5AC273a:T52a,FindFirstFileA@KERNEL32.DLL at 00000000-00005176-39349-5305-004C2DE1 FindFirstFileA@KERNEL32.DLL at 00000000-00005176-39349-6938-004CA4B5 FindFirstFileA@KERNEL32.DLL at 00000000-00005176-39349-6989-0043C078 FindFirstFileA@KERNEL32.DLL at 00000000-00005176-39349-7175-0043CFA9 FindFirstFileA@KERNEL32.DLL at 00000000-00005176-39349-7177-0043C667 FindNextFileA@KERNEL32.DLL at 00000000-00005176-39349-7477-0043C744 FindNextFileA@KERNEL32.DLL at 00000000-00005176-39349-7996-004742D2 FindFirstFileA@KERNEL32.DLL at 00000000-00005176-39349-8002-004748F0 FindFirstFileW@KERNEL32.DLL at 00000000-00006452-55614-423-00401722 FindNextFileW@KERNEL32.DLL at 00000000-00006452-55614-450-00401A0D FindFirstFileW@KERNEL32.DLL at 00000000-00006452-55614-456-004077EC FindFirstFileW@KERNEL32.DLL at 00000000-00006452-55614-466-004075D3 FindNextFileW@KERNEL32.DLL at 00000000-00006452-55614-691-004155D0 FindFirstFileW@KERNEL32.DLL at 00000000-00006452-55614-693-00415287 FindFirstFileExW@KERNEL32.DLL at 00000000-00006452-55614-2560-00495BBA FindFirstFileExA@KERNEL32.DLL at 00000000-00001308-60270-1147-00E4CF56 FindNextFileW@KERNEL32.DLL at 00000000-00003044-64212-393-00DDC71C FindFirstFileExW@KERNEL32.DLL at 00000000-00003044-64212-395-00DDC75D FindFirstFileExW@KERNEL32.DLL at 00000000-00003044-64212-510-00DE03943b:T588,GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005176-39349-4818-004F5E6A GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005176-39349-4823-004E4E1B GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005176-39349-5325-004DDDB1 FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00005176-39349-5486-004366E5 FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00005176-39349-5534-0043BD58 FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00005176-39349-6342-004CA486 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005176-39349-6644-004E4E5E GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005176-39349-6692-004F2F5E FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00006452-55614-548-00416C23 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006452-55614-1052-0041704B FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00006452-55614-2039-00440416 FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00006452-55614-2090-004492CE GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006452-55614-2487-0048C38D GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001308-60270-383-00E49F7C FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00001308-60270-814-00E4BE1C FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00001308-60270-1147-00E4CF56 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001308-60270-1577-00E5AC27 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003044-64212-496-00DDBC733c:T516,GetVersionExA@KERNEL32.DLL at 00000000-00005176-39349-5487-00436743 GetVersionExA@KERNEL32.DLL at 00000000-00005176-39349-5498-00438B8C GetVersionExA@KERNEL32.DLL at 00000000-00005176-39349-5499-00438BDE GetVersionExA@KERNEL32.DLL at 00000000-00005176-39349-5555-004BA50D GetVersion@KERNEL32.DLL at 00000000-00005176-39349-6313-004C8905 GetVersionExA@KERNEL32.DLL at 00000000-00005176-39349-6716-004FF3F7 GetVersionExA@KERNEL32.DLL at 00000000-00005176-39349-6877-00442538 GetVersionExA@KERNEL32.DLL at 00000000-00005176-39349-6933-00443127 GetVersionExA@KERNEL32.DLL at 00000000-00005176-39349-7058-0044AF1B GetVersionExA@KERNEL32.DLL at 00000000-00005176-39349-7658-004C774F GetVersionExA@KERNEL32.DLL at 00000000-00005176-39349-7872-00467055 GetVersion@KERNEL32.DLL at 00000000-00005176-39349-9035-004D0784 GetVersionExA@KERNEL32.DLL at 00000000-00005176-39349-9231-004E38A4 GetVersionExA@KERNEL32.DLL at 00000000-00005176-39349-9825-004FF5F1 GetVersionExA@KERNEL32.DLL at 00000000-00005176-39349-11142-0044B0B6 GetVersionExA@KERNEL32.DLL at 00000000-00005176-39349-11193-00442D32 GetVersionExA@KERNEL32.DLL at 00000000-00005176-39349-11298-004631BD RtlGetVersion@NTDLL.DLL at 00000000-00006452-55614-210-00459F01 GetVersionExW@KERNEL32.DLL at 00000000-00006452-55614-2393-004786073d:T502,GetLocaleInfoA@KERNEL32.DLL at 00000000-00005176-39349-4227-004FC2CF EnumSystemLocalesA@KERNEL32.DLL at 00000000-00005176-39349-4760-004F720A EnumSystemLocalesA@KERNEL32.DLL at 00000000-00005176-39349-4761-004F71CE EnumSystemLocalesA@KERNEL32.DLL at 00000000-00005176-39349-4763-004F7169 GetLocaleInfoA@KERNEL32.DLL at 00000000-00005176-39349-4768-004F6CF0 GetLocaleInfoA@KERNEL32.DLL at 00000000-00005176-39349-6311-004C86FB GetLocaleInfoA@KERNEL32.DLL at 00000000-00005176-39349-6684-004FC63E GetLocaleInfoA@KERNEL32.DLL at 00000000-00005176-39349-6696-004F6DD2 GetLocaleInfoA@KERNEL32.DLL at 00000000-00005176-39349-6699-004F6E68 GetLocaleInfoA@KERNEL32.DLL at 00000000-00005176-39349-6701-004F70AA GetLocaleInfoA@KERNEL32.DLL at 00000000-00005176-39349-6715-004FF38E EnumSystemLocalesA@KERNEL32.DLL at 00000000-00001308-60270-1358-00E58D35 EnumSystemLocalesA@KERNEL32.DLL at 00000000-00001308-60270-1359-00E58CF9 EnumSystemLocalesA@KERNEL32.DLL at 00000000-00001308-60270-1361-00E58C92 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001308-60270-1366-00E5880A GetLocaleInfoA@KERNEL32.DLL at 00000000-00001308-60270-1552-00E58901 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001308-60270-1554-00E589A8 GetLocaleInfoA@KERNEL32.DLL at 00000000-00001308-60270-1557-00E58BD43e:T68b,"yuanbao_v2.371_x64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "yuanbao_v2.371_x64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "irsetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "irsetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "WebProcess.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "yuanbao_2.77.1.612_x64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "yuanbao_2.77.1.612_x64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "report_helper.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "MicrosoftEdgeWebview2Setup_908350031_1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "MicrosoftEdgeWebview2Setup_908350031_1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "MicrosoftEdgeUpdate.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "MicrosoftEdgeUpdate.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "MicrosoftEdgeUpdateComRegisterShell64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")3f:T4ab,GetProcessHeap@KERNEL32.DLL at 00000000-00005176-39349-4149-004A9850 GetProcessHeap@KERNEL32.DLL at 00000000-00005176-39349-4535-004FD630 OpenProcess@KERNEL32.DLL at 00000000-00005176-39349-5608-00446936 OpenProcessToken@ADVAPI32.DLL at 00000000-00005176-39349-5627-0044AE61 OpenProcessToken@ADVAPI32.DLL at 00000000-00005176-39349-5628-0044AEBD GetProcessHeap@KERNEL32.DLL at 00000000-00005176-39349-7020-0041AB36 GetProcessHeap@KERNEL32.DLL at 00000000-00005176-39349-7021-0041ABF7 OpenProcessToken@ADVAPI32.DLL at 00000000-00005176-39349-7058-0044AF1B OpenProcessToken@ADVAPI32.DLL at 00000000-00005176-39349-10630-00438D2D OpenProcessToken@ADVAPI32.DLL at 00000000-00005176-39349-11142-0044B0B6 OpenProcess@KERNEL32.DLL at 00000000-00005176-39349-11318-0046745A GetProcessHeap@KERNEL32.DLL at 00000000-00006452-55614-123-00496E50 OpenProcessToken@ADVAPI32.DLL at 00000000-00006452-55614-442-00404487 OpenProcessToken@ADVAPI32.DLL at 00000000-00006452-55614-753-004586A8 OpenProcessToken@ADVAPI32.DLL at 00000000-00006452-55614-1174-004166D2 GetProcessHeap@KERNEL32.DLL at 00000000-00001308-60270-444-00E5CD02 GetProcessHeap@KERNEL32.DLL at 00000000-00003044-64212-64-00DE206040:T4cc,Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by "cmp eax, edi" and "je 004F11F5h" at 00000000-00005176-39349-4792-004F0FD9 Found API call GetVersionExA@KERNEL32.DLL directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "xor ecx, ebp" at 00000000-00005176-39349-5555-004BA50D Found API call GetVersionExA@KERNEL32.DLL directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "jne 004FF438h" at 00000000-00005176-39349-6716-004FF3F7 Found API call GetVersionExA@KERNEL32.DLL directly followed by "cmp dword ptr [ebp-00000094h], 02h" and "jne 004C77E0h" at 00000000-00005176-39349-7658-004C774F Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000004h" and "je 00515F35h" at 00000000-00005176-39349-9814-00515EF2 Found API call GetVersionExA@KERNEL32.DLL directly followed by "cmp dword ptr [ebp-10h], 02h" and "jne 004FF655h" at 00000000-00005176-39349-9825-004FF5F1 Found API call GetVersionExW@KERNEL32.DLL directly followed by "cmp word ptr [esp+44h], ax" and "jne 00404507h" at 00000000-00006452-55614-442-00404487 Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by "cmp eax, edi" and "je 00E512A4h" at 00000000-00001308-60270-825-00E510AB41:T83c,"MicrosoftEdgeUpdate.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "ENABLEDHCP"; Value: "") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "MicrosoftEdgeUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")42:Tbc1,"MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00003044-00000C17-1026436937 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3" at 00000000-00003044-00000C17-1054859141 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\Program Files (x86)\Microsoft\EdgeUpdate\Offline" at 00000000-00003044-00000C17-1054940910 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00007664-00000C17-1029952602 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00004704-00000C17-1035558018 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00004704-00000C17-1041659157 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00004704-00000C17-1047960754 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00004704-00000C17-1054203824 "MicrosoftEdgeUpdateComRegisterShell64.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00005904-00000C17-1037175848 "MicrosoftEdgeUpdateComRegisterShell64.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00006516-00000C17-1043572238 "MicrosoftEdgeUpdateComRegisterShell64.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00008188-00000C17-1049982217 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00007912-00000C17-1057424374 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00007672-00000C17-1058022756 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00007672-00000C17-1061365360 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00007708-00000C17-1060353340 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2C5E8545-77C5-41DE-896B-7EA8CF456EE4}" at 00000000-00007708-00000C17-1061464403 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00002400-00000C17-1064916692 "MicrosoftEdgeUpdate.exe" queries volume information of "C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log" at 00000000-00001172-00000C17-110134056143:T83a,"yuanbao_v2.371_x64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IRSETUP.EXE") "irsetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IRSETUP.EXE") "WebProcess.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "WebProcess.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "WebProcess.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "WebProcess.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "WebProcess.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYNAME") "WebProcess.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "WebProcess.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "WebProcess.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "WebProcess.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "WebProcess.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "WebProcess.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "WebProcess.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "DISPLAYNAME") "WebProcess.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "WebProcess.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE"; Key: "DISPLAYNAME") "WebProcess.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOOGLE CHROME") "WebProcess.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOOGLE CHROME"; Key: "DISPLAYNAME")44:T583,"yuanbao_2.77.1.612_x64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "yuanbao_2.77.1.612_x64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "yuanbao_2.77.1.612_x64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "yuanbao_2.77.1.612_x64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "yuanbao_2.77.1.612_x64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "yuanbao_2.77.1.612_x64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "yuanbao_2.77.1.612_x64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "yuanbao_2.77.1.612_x64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "yuanbao_2.77.1.612_x64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "yuanbao_2.77.1.612_x64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")45:Ta14,"yuanbao_v2.371_x64.exe" called "CreateDirectoryA" with parameter %TEMP%\_ir_sf_temp_0 (UID: 00000000-00006148) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\upload\ (UID: 00000000-00005176) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\upload\uploa\ (UID: 00000000-00005176) "yuanbao_2.77.1.612_x64.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "CreateDirectoryW" with parameter %TEMP%\nsw9161.tmp (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "CreateDirectoryW" with parameter %APPDATA%\Tencent (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "CreateDirectoryW" with parameter %APPDATA%\Tencent\yuanbao (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "CreateDirectoryW" with parameter %APPDATA%\Tencent\yuanbao\Global (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "CreateDirectoryW" with parameter %APPDATA%\Tencent\yuanbao\Global\Logs (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "CreateDirectoryW" with parameter %APPDATA%\Tencent\yuanbao\Global\Logs\ (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "CreateDirectoryW" with parameter C:\WINDOWS (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp (UID: 00000000-00006452) "MicrosoftEdgeWebview2Setup_908350031_1.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Microsoft (UID: 00000000-00003932) "MicrosoftEdgeWebview2Setup_908350031_1.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Microsoft\Temp (UID: 00000000-00003932) "MicrosoftEdgeWebview2Setup_908350031_1.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp (UID: 00000000-00003932) "MicrosoftEdgeUpdate.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23 (UID: 00000000-00003044)46:T90b,"yuanbao_v2.371_x64.exe" called "CreateProcessW" with parameter ""%TEMP%\_ir_sf_temp_0\irsetup.exe" __IRAOFF:641570 "__IRAFN:C:\yuanbao_v2.371_x64.exe" "__IRCT:2" "__" - (UID: 00000000-00006148), "irsetup.exe" called "CreateProcessA" with parameter "%PROGRAMFILES%\(x86)\upload\uploa\WebProcess.exe" - (UID: 00000000-00005176), "irsetup.exe" called "CreateProcessA" with parameter "%PROGRAMFILES%\(x86)\upload\uploa\yuanbao_2.77.1.612_x64.exe" - (UID: 00000000-00005176), "yuanbao_2.77.1.612_x64.exe" called "CreateProcessW" with parameter "--connect-timeout 3 --location --request POST "https://otheve.beacon.qq.com/analytics/v2_upload" --header "Content-Type: applicat" - (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "CreateProcessW" with parameter "%TEMP%\MicrosoftEdgeWebview2Setup_908350031_1.exe /silent /install" - (UID: 00000000-00006452) "MicrosoftEdgeWebview2Setup_908350031_1.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3" - (UID: 00000000-00003932), "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc" - (UID: 00000000-00003044), "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver" - (UID: 00000000-00003044), "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cm" - (UID: 00000000-00003044), "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&app" - (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateComRegisterShell64.exe"" - (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cm" - (UID: 00000000-00007708)47:T8106,"yuanbao_v2.371_x64.exe" called "LoadLibrary" with a parameter Advapi32.dll (UID: 00000000-00006148) "irsetup.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00005176) "irsetup.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005176) "irsetup.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00005176) "irsetup.exe" called "LoadLibrary" with a parameter comdlg32.dll (UID: 00000000-00005176) "irsetup.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005176) "irsetup.exe" called "LoadLibrary" with a parameter NETAPI32.dll (UID: 00000000-00005176) "irsetup.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005176) "irsetup.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005176) "irsetup.exe" called "LoadLibrary" with a parameter oledlg.dll (UID: 00000000-00005176) "irsetup.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005176) "irsetup.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005176) "irsetup.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005176) "irsetup.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005176) "irsetup.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005176) "irsetup.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00005176) "irsetup.exe" called "LoadLibrary" with a parameter WINSPOOL.DRV (UID: 00000000-00005176) "irsetup.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00005176) "WebProcess.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter PSAPI.DLL (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter DINPUT8.dll (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter ext-ms-win-mininput-inputhost-l1-1-1.dll (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter ext-ms-win-mininput-inputhost-l1-1-0.dll (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter msdmo.dll (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter avicap32.dll (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006212) "WebProcess.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006212) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter %TEMP%\nsw9161.tmp\System.dll (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter %TEMP%\nsw9161.tmp\ProductHelper.dll (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RichEd20.dll (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter %TEMP%\nsw9161.tmp\INetC.dll (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00006452) "report_helper.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001308) "MicrosoftEdgeWebview2Setup_908350031_1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003932) "MicrosoftEdgeWebview2Setup_908350031_1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003932) "MicrosoftEdgeWebview2Setup_908350031_1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003932) "MicrosoftEdgeWebview2Setup_908350031_1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003932) "MicrosoftEdgeWebview2Setup_908350031_1.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003932) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdate.dll (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_en.dll (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernelbase.dll (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ntdll.dll (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wldp.dll (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007664) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007664) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007664) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007664) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007664) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007664) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007664) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007664) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007664) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007664) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll (UID: 00000000-00007664) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007664) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00007664) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00007664) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00007664) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007664) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_en.dll (UID: 00000000-00007664) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007664) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007664) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\psmachine.dll (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter NETAPI32.dll (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004704) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004704) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00005904) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00005904) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005904) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005904) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\psmachine_64.dll (UID: 00000000-00005904) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005904) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005904) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00006516) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00006516) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006516) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006516) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\psmachine_64.dll (UID: 00000000-00006516) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00006516) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006516) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00008188) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00008188) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008188) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008188) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\psmachine_64.dll (UID: 00000000-00008188) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00008188) "MicrosoftEdgeUpdateComRegisterShell64.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00008188) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter Iphlpapi.dll (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\winhttp (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007912) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_en.dll (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter NETAPI32.dll (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter atlthunk.dll (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ntdll.dll (UID: 00000000-00007672) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_en.dll (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ntdll.dll (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wldp.dll (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wtsapi32.dll (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter slwga.dll (UID: 00000000-00007708) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wtsapi32.dll (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter Iphlpapi.dll (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\winhttp (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002400) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MDMRegistration.dll (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NetApi32.dll (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdateres_en.dll (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wtsapi32.dll (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter Iphlpapi.dll (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\winhttp (UID: 00000000-00001172) "MicrosoftEdgeUpdate.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001172)48:T4e1,Found reference to API "CreateFileShortcuts" (Indicator: "CreateFile"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found reference to API "Failed to get filetime: CreateFile failed: GetLastError %u" (Indicator: "CreateFile"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "Failed to set filetime %I64d on outfile: CreateFile failed: GetLastError %u" (Indicator: "CreateFile"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "yuanbao_v2.371_x64.exe") Found reference to API "Failed to get filetime: CreateFile failed: GetLastError %u" (Indicator: "CreateFile"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found reference to API "Failed to set filetime %I64d on outfile: CreateFile failed: GetLastError %u" (Indicator: "CreateFile"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp")49:T64e,Sleep@KERNEL32.DLL at 00000000-00005176-39349-3925-004EECC0 Sleep@KERNEL32.DLL at 00000000-00005176-39349-3938-004EED00 Sleep@KERNEL32.DLL at 00000000-00005176-39349-4804-004EED93 WaitForSingleObject@KERNEL32.DLL at 00000000-00005176-39349-4836-004FD967 Sleep@KERNEL32.DLL at 00000000-00005176-39349-6073-004948B8 Sleep@KERNEL32.DLL at 00000000-00005176-39349-7042-00476C4E Sleep@KERNEL32.DLL at 00000000-00005176-39349-9153-004EED48 SetTimer at 00000000-00005176-39349-10723-0047607D Sleep@KERNEL32.DLL at 00000000-00005176-39349-11290-0046040A WaitForSingleObject@KERNEL32.DLL at 00000000-00006452-55614-267-00489A1B SetTimer at 00000000-00006452-55614-441-004043A6 WaitForSingleObject@KERNEL32.DLL at 00000000-00006452-55614-446-00403C37 WaitForSingleObject@KERNEL32.DLL at 00000000-00006452-55614-470-00407380 Sleep@KERNEL32.DLL at 00000000-00006452-55614-501-00404108 WaitForMultipleObjects@KERNEL32.DLL at 00000000-00006452-55614-1252-0041B23E WaitForMultipleObjects@KERNEL32.DLL at 00000000-00006452-55614-2044-0044773F WaitForMultipleObjects@KERNEL32.DLL at 00000000-00006452-55614-4368-0041AA3A Sleep@KERNEL32.DLL at 00000000-00001308-60270-53-00E4F7EF Sleep@KERNEL32.DLL at 00000000-00001308-60270-57-00E4F834 Sleep@KERNEL32.DLL at 00000000-00001308-60270-211-00E0A940 Sleep@KERNEL32.DLL at 00000000-00001308-60270-466-00E4F8CE WaitForSingleObject@KERNEL32.DLL at 00000000-00001308-60270-559-00E1C940 SleepEx@KERNEL32.DLL at 00000000-00001308-60270-732-00E1A000 Sleep@KERNEL32.DLL at 00000000-00001308-60270-787-00E0AD80 Sleep@KERNEL32.DLL at 00000000-00001308-60270-1134-00E0A9104a:T6ab,LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-3912-004FB83F LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-5094-004BC9C5 LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-5147-00406699 LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-5154-00405887 LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-5490-004367B7 LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-5602-00444E71 LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-5788-0045D74B LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-6009-004BB7DD LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-6016-004CE311 LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-6311-004C86FB LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-6717-004FF7B0 LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-7019-0041B21E LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-7034-00470DA1 LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-7103-0041AE31 LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-7181-0044032C LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-7438-00436B0C LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-7585-00446DB3 LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-9737-004323C5 LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-10705-0043B9AD LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-10716-0045D7E7 LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-10718-0045DDCF LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-11179-00439074 LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-11194-004444CB LoadLibraryExA@KERNEL32.DLL at 00000000-00005176-39349-11203-00447649 LoadLibraryA@KERNEL32.DLL at 00000000-00005176-39349-11324-00468A484b:T88b,"msedgeupdate.dll" contains export function called "DllEntry" at ordinal 1 "ProductHelper.dll" contains export function called "AssocFileWithProject" at ordinal 1 "ProductHelper.dll" contains export function called "ChangeEditToSuitableSize" at ordinal 2 "ProductHelper.dll" contains export function called "ChangeWindowsSize" at ordinal 3 "ProductHelper.dll" contains export function called "CheckDiskFreeSpace" at ordinal 4 "ProductHelper.dll" contains export function called "CheckInstallPathEndWitchProduct" at ordinal 5 "ProductHelper.dll" contains export function called "CleanupEmptyVersionDirs" at ordinal 6 "ProductHelper.dll" contains export function called "CleanupOldVersionDirs" at ordinal 7 "ProductHelper.dll" contains export function called "CleanupProgramDataOldVersionDirs" at ordinal 8 "ProductHelper.dll" contains export function called "DelCommonReportData" at ordinal 9 "ProductHelper.dll" contains export function called "DeletePendingFile" at ordinal 10 "ProductHelper.dll" contains export function called "FWAddApplication" at ordinal 11 "ProductHelper.dll" contains export function called "FWInit" at ordinal 12 "ProductHelper.dll" contains export function called "FWRemoveApplication" at ordinal 13 "ProductHelper.dll" contains export function called "FileSizeCheck" at ordinal 14 "ProductHelper.dll" contains export function called "FindProcessByName" at ordinal 15 "ProductHelper.dll" contains export function called "FindProjectProcess" at ordinal 16 "ProductHelper.dll" contains export function called "GetFileMd5" at ordinal 17 "ProductHelper.dll" contains export function called "GetFileNameFromPath" at ordinal 18 "ProductHelper.dll" contains export function called "GetGuanjiaSupplyidFromAppName" at ordinal 19 "ProductHelper.dll" contains export function called "GetNameOfSigner" at ordinal 20 "ProductHelper.dll" contains export function called "GetParentProcessPath" at ordinal 21 "ProductHelper.dll" contains export function called "GetUniqueDeviceId" at ordinal 22 "ProductHelper.dll" contains export function called "HttpPost" at ordinal 23 "ProductHelper.dll" contains export function called "InitBeaconSDK" at ordinal 244c:Tf3e,"Software\Microsoft\Windows\CurrentVersion\Installer" in Source: 39349-5154-00405887 "SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 39349-5590-00440422 "Software\Microsoft\Windows\CurrentVersion" in Source: 39349-6873-00413652 "Software\Microsoft\Windows NT\CurrentVersion" in Source: 39349-6873-00413652 "%s\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 39349-6875-004120CD "Software\Microsoft\Shared Tools\DAO360.dll" in Source: 39349-6876-00412856 "Software\Microsoft\Shared Tools\DAO350.dll" in Source: 39349-6876-00412856 "Software\Microsoft\Shared Tools\DAO350" in Source: 39349-6876-00412856 "Software\Microsoft\Shared Tools\DAO" in Source: 39349-6876-00412856 "Software\Microsoft\Windows\CurrentVersion\Fonts" in Source: 39349-7027-00443217 "Software\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 39349-7027-00443217 "Remove uninstall CP entry from Registry: HKEY_LOCAL_MACHINE\" in Source: 39349-7029-0041C10B "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 39349-7172-0041D888 "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 39349-7242-00429139 "HKEY_LOCAL_MACHINE\" in Source: 39349-7242-00429139 "Software\Microsoft\Windows\CurrentVersion\I652R9823\" in Source: 39349-7314-0041F84B "Software\Indigo Rose\ACData\" in Source: 39349-7631-0044BBF5 "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 39349-11298-004631BD "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 39349-11298-004631BD "Software\" in Source: 39349-11570-004C9082 "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 64212-424-00DD9A36 "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001172.00000000.134495.034B0000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00001172.00000000.134495.034B0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00001172.00000000.134495.034B0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00002400.00000000.132170.02730000.00000004.mdmp 00000000-00002400.00000001.134088.02730000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00002400.00000000.132170.02730000.00000004.mdmp 00000000-00002400.00000001.134088.02730000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18" in Source: 00000000-00002400.00000000.132170.03BB9000.00000004.mdmp 00000000-00002400.00000001.134088.03BB9000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002400.00000000.132170.04660000.00000004.mdmp 00000000-00002400.00000001.134088.04660000.00000004.mdmp "Software\Microsoft\" in Source: 00000000-00003044.00000000.129665.009C0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00003044.00000000.129665.009C0000.00000004.mdmp "HKLM\Softwar" in Source: 00000000-00003044.00000000.129665.009C0000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00003044.00000000.129665.009C0000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00003044.00000000.129665.009C0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00003044.00000000.129665.009C0000.00000004.mdmp4d:Ta09,Process yuanbao_v2.371_x64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6148:168:WilStaging_02" Process yuanbao_v2.371_x64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6148:64:WilError_01" Process yuanbao_v2.371_x64.exe created mutex with name "Local\ZonesCacheCounterMutex" Process yuanbao_v2.371_x64.exe created mutex with name "Local\SM0:6148:64:WilError_01" Process yuanbao_v2.371_x64.exe created mutex with name "Local\SM0:6148:168:WilStaging_02" Process yuanbao_v2.371_x64.exe created mutex with name "SM0:6148:64:WilError_01" Process yuanbao_v2.371_x64.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process yuanbao_v2.371_x64.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process yuanbao_v2.371_x64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6148:64:WilError_01" Process yuanbao_v2.371_x64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process yuanbao_v2.371_x64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process irsetup.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5176:168:WilStaging_02" Process irsetup.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5176:64:WilError_01" Process irsetup.exe created mutex with name "SM0:5176:64:WilError_01" Process irsetup.exe created mutex with name "Local\SM0:5176:168:WilStaging_02" Process WebProcess.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6212:168:WilStaging_02" Process WebProcess.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6212:168:WilStaging_02" Process WebProcess.exe created mutex with name "2026. 7.25" Process WebProcess.exe created mutex with name "Local\SM0:6212:168:WilStaging_02" Process WebProcess.exe created mutex with name "eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001" Process WebProcess.exe created mutex with name "SM0:6212:168:WilStaging_02" Process WebProcess.exe created mutex with name "\Sessions\1\BaseNamedObjects\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001" Process WebProcess.exe created mutex with name "\Sessions\1\BaseNamedObjects\2026. 7.25" Process yuanbao_2.77.1.612_x64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6452:168:WilStaging_02" Process yuanbao_2.77.1.612_x64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6452:64:WilError_01"4e:T90e,Antivirus vendors marked dropped file "yuanbao_2.77.1.612_x64.exe" as clean (type is "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 6 sections"), Antivirus vendors marked dropped file "msedgeupdate.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeUpdateSetup.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "ProductHelper.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "psmachine_64.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"), Antivirus vendors marked dropped file "psuser_64.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"), Antivirus vendors marked dropped file "psuser_arm64.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"), Antivirus vendors marked dropped file "psmachine_arm64.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"), Antivirus vendors marked dropped file "psuser.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "psmachine.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeUpdateCore.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "INetC.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeUpdateComRegisterShell64.exe" as clean (type is "PE32+ executable for MS Windows 5.02 (GUI) x86-64 8 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeUpdate.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "MicrosoftEdgeComRegisterShellARM64.exe" as clean (type is "PE32+ executable for MS Windows 10.00 (GUI) ARM64 7 sections"), Antivirus vendors marked dropped file "Web.exe" as clean (type is "Unknown")4f:Tdc9,"msedgeupdate.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "MicrosoftEdgeUpdateSetup.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "report_helper.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "ProductHelper.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "psmachine_64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psuser_64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psuser_arm64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psmachine_arm64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psuser.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "psmachine.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "MicrosoftEdgeUpdateCore.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "INetC.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "MicrosoftEdgeUpdateComRegisterShell64.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MicrosoftEdgeUpdate.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MicrosoftEdgeComRegisterShellARM64.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "libcef.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "WebProcess.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MicrosoftEdgeUpdateOnDemand.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MicrosoftEdgeUpdateBroker.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "msedgeupdateres_ml.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_GUARD_CF50:Tbb39,"SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00001172.00000000.134495.034B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001172.00000000.134495.034B0000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00001172.00000000.134495.034B0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00002400.00000000.132170.02730000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00002400.00000000.132170.02730000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18" in Source: 00000000-00002400.00000000.132170.03BB9000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002400.00000000.132170.04660000.00000004.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00002400.00000001.134088.02730000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00002400.00000001.134088.02730000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18" in Source: 00000000-00002400.00000001.134088.03BB9000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002400.00000001.134088.04660000.00000004.mdmp "Software\Microsoft\" in Source: 00000000-00003044.00000000.129665.009C0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00003044.00000000.129665.009C0000.00000004.mdmp "HKLM\Softwar" in Source: 00000000-00003044.00000000.129665.009C0000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00003044.00000000.129665.009C0000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00003044.00000000.129665.009C0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00003044.00000000.129665.009C0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003044.00000001.131585.009C0000.00000004.mdmp "istry\Machine\Software\Classes\Applications\MicrosoftEdgeUpdate.exe" in Source: 00000000-00003044.00000001.131585.009C0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00003044.00000001.131585.00DD1000.00000020.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003044.00000002.133504.009C0000.00000004.mdmp "istry\Machine\Software\Classes\Applications\MicrosoftEdgeUpdate.exe" in Source: 00000000-00003044.00000002.133504.009C0000.00000004.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003932.00000000.129523.009C0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003932.00000000.129523.009C0000.00000004.mdmp "SOFTWARE\Microsoft\EdgeUpdate" in Source: 00000000-00003932.00000001.131444.00C6C000.00000002.mdmp "Software\OEM\MicrosoftEdge" in Source: 00000000-00003932.00000001.131444.00C6C000.00000002.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003932.00000002.133361.009C0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003932.00000002.133361.009C0000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00004704.00000001.131316.026AF000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00004704.00000001.131316.026AF000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00004704.00000001.131316.026AF000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00004704.00000001.131316.026AF000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "%s\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "Software\Microsoft\Shared Tools\DAO" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "Software\Microsoft\Shared Tools\DAO350" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "Software\Microsoft\Shared Tools\DAO350.dll" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "Software\Microsoft\Shared Tools\DAO360.dll" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "Remove uninstall CP entry from Registry: HKEY_LOCAL_MACHINE\" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\I652R9823\" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "HKEY_LOCAL_MACHINE\" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Fonts" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "Software\Indigo Rose\ACData\" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "Software\" in Source: 00000000-00005176.00000000.128063.00401000.00000040.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005176.00000000.128063.030E0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005176.00000000.128063.030E0000.00000004.mdmp "-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005176.00000000.128063.030E0000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005176.00000000.128063.030E0000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\" in Source: 00000000-00005176.00000000.128063.072C0000.00000004.mdmp "Software\Microsoft\Shared Tools\DAO350.dll" in Source: 00000000-00005176.00000000.128063.072C0000.00000004.mdmp "Software\Microsoft\Shared Tools\DAO" in Source: 00000000-00005176.00000000.128063.072C0000.00000004.mdmp "\Software\Microsoft\Shared Tools\DAO\" in Source: 00000000-00005176.00000000.128063.072C0000.00000004.mdmp "S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005176.00000000.128063.072C0000.00000004.mdmp "\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005176.00000000.128063.072C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "%s\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "Software\Microsoft\Shared Tools\DAO" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "Software\Microsoft\Shared Tools\DAO350" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "Software\Microsoft\Shared Tools\DAO350.dll" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "Software\Microsoft\Shared Tools\DAO360.dll" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "Remove uninstall CP entry from Registry: HKEY_LOCAL_MACHINE\" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\I652R9823\" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "HKEY_LOCAL_MACHINE\" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Fonts" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "Software\Indigo Rose\ACData\" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "Software\" in Source: 00000000-00005176.00000001.128114.00401000.00000040.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005176.00000001.128114.03146000.00000004.mdmp "-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005176.00000001.128114.03186000.00000004.mdmp "Software\Microsoft\Shared Tools\DAO350.dll" in Source: 00000000-00005176.00000001.128114.072E3000.00000004.mdmp "35SOFTWARE\Policies\Microsoft\Copilot" in Source: 00000000-00005904.00000000.130418.55CE0000.00000004.mdmp "\REGISTRY\MACHINE\Software\" in Source: 00000000-00005904.00000000.130418.55CE0000.00000004.mdmp "HHKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00005904.00000000.130418.55CE0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00005904.00000000.130418.55CE0000.00000004.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 00000000-00005904.00000000.130418.79B38000.00000002.mdmp "SOFTWARE\Microsoft\Office\OfficeHub" in Source: 00000000-00005904.00000000.130418.79B38000.00000002.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" in Source: 00000000-00005904.00000000.130418.79B38000.00000002.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" in Source: 00000000-00005904.00000000.130418.79B38000.00000002.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00005904.00000000.130418.79B38000.00000002.mdmp "Software\Classes" in Source: 00000000-00005904.00000000.130418.79B38000.00000002.mdmp "HKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00005904.00000000.130418.79B38000.00000002.mdmp "HKLM\SOFTWARE\Policies\Microsoft\Copilot" in Source: 00000000-00005904.00000000.130418.79B38000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\PackageRepository\Packages" in Source: 00000000-00005904.00000000.130418.79B38000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications" in Source: 00000000-00005904.00000000.130418.79B38000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006148.00000000.127950.02B40000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00006148.00000000.127950.02B40000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006148.00000000.127950.02B40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006148.00000000.127950.02B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00006148.00000000.127950.02B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00006148.00000000.127950.02B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" in Source: 00000000-00006148.00000000.127950.02B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0" in Source: 00000000-00006148.00000000.127950.02B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00006148.00000000.127950.02B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00006148.00000000.127950.02B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2" in Source: 00000000-00006148.00000000.127950.02B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4" in Source: 00000000-00006148.00000000.127950.02B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00006148.00000000.127950.02B40000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00006148.00000000.127950.02B40000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006148.00000001.128123.02B40000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00006148.00000001.128123.02B40000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006148.00000001.128123.02B40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006148.00000001.128123.02B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00006148.00000001.128123.02B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00006148.00000001.128123.02B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" in Source: 00000000-00006148.00000001.128123.02B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0" in Source: 00000000-00006148.00000001.128123.02B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00006148.00000001.128123.02B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00006148.00000001.128123.02B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2" in Source: 00000000-00006148.00000001.128123.02B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4" in Source: 00000000-00006148.00000001.128123.02B40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00006148.00000001.128123.02B40000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006212.00000000.128298.05000000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006212.00000000.128298.05000000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006212.00000000.128298.05000000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006212.00000000.128298.058B0000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006212.00000000.128298.058B0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006212.00000000.128298.058B0000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Drive5" in Source: 00000000-00006212.00000001.130219.01000000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows#" in Source: 00000000-00006212.00000001.130219.01000000.00000004.mdmp "Registry\Machine\Software\MicrosoftE" in Source: 00000000-00006212.00000001.130219.01000000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Drive" in Source: 00000000-00006212.00000001.130219.01000000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006212.00000001.130219.052D0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006212.00000001.130219.052D0000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006212.00000001.130219.052D0000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006212.00000001.130219.068A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" in Source: 00000000-00006212.00000001.130219.06F30000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" in Source: 00000000-00006212.00000001.130219.071D0000.00000004.mdmp "Registry\Machine\Software\MicrosoftE" in Source: 00000000-00006212.00000002.132138.01000000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006212.00000002.132138.04FC0000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006212.00000002.132138.04FC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006212.00000002.132138.04FC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006212.00000002.132138.05000000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006212.00000002.132138.05000000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006212.00000002.132138.05000000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006212.00000002.132138.052D0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006212.00000002.132138.052D0000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006212.00000002.132138.052D0000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006212.00000002.132138.058B0000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006212.00000002.132138.058B0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006212.00000002.132138.058B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006212.00000002.132138.068A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" in Source: 00000000-00006212.00000002.132138.06F30000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" in Source: 00000000-00006212.00000002.132138.071D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00006452.00000000.128421.0049D000.00000002.mdmp "Software\Microsoft\Windows NT\Curr" in Source: 00000000-00006452.00000000.128421.007C0000.00000004.mdmp "Software\Tencent\Yuanbao" in Source: 00000000-00006452.00000000.128421.02AF0000.00000004.mdmp "Software\Classes\SystemFileAssociations\" in Source: 00000000-00006452.00000000.128421.02AF0000.00000004.mdmp "SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00006452.00000000.128421.02AF0000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate" in Source: 00000000-00006452.00000000.128421.02AF0000.00000004.mdmp "SOFTWARE\Microsoft\EdgeUpdate" in Source: 00000000-00006452.00000000.128421.02AF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Yuanbao" in Source: 00000000-00006452.00000000.128421.02AF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006452.00000000.128421.02AF0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\YuanbaoUpdateService\" in Source: 00000000-00006452.00000000.128421.02AF0000.00000004.mdmp "Local Settings\Software\Microsoft\Windows\Shell\MuiCache" in Source: 00000000-00006452.00000000.128421.02AF0000.00000004.mdmp "SOFTWARE\Classes\*\shellex\ContextMenuHandlers\{F57A977F-9921-4E5B-831A-EA3F80DC089F}" in Source: 00000000-00006452.00000000.128421.02AF0000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006452.00000000.128421.07310000.00000004.mdmp "Software\Microsoft\Windows NT\Curr" in Source: 00000000-00006452.00000001.130342.007BF000.00000004.mdmp "Software\Tencent\Yuanbao" in Source: 00000000-00006452.00000001.130342.02AF0000.00000004.mdmp "Software\Classes\SystemFileAssociations\" in Source: 00000000-00006452.00000001.130342.02AF0000.00000004.mdmp "SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00006452.00000001.130342.02AF0000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate" in Source: 00000000-00006452.00000001.130342.02AF0000.00000004.mdmp "SOFTWARE\Microsoft\EdgeUpdate" in Source: 00000000-00006452.00000001.130342.02AF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Yuanbao" in Source: 00000000-00006452.00000001.130342.02AF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006452.00000001.130342.02AF0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\YuanbaoUpdateService\" in Source: 00000000-00006452.00000001.130342.02AF0000.00000004.mdmp "Local Settings\Software\Microsoft\Windows\Shell\MuiCache" in Source: 00000000-00006452.00000001.130342.02AF0000.00000004.mdmp "SOFTWARE\Classes\*\shellex\ContextMenuHandlers\{F57A977F-9921-4E5B-831A-EA3F80DC089F}" in Source: 00000000-00006452.00000001.130342.02AF0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006452.00000001.130342.07382000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00006452.00000001.130342.72341000.00000020.mdmp "Software\Microsoft\Input" in Source: 00000000-00006452.00000001.130342.72341000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00006452.00000001.130342.72341000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00006452.00000001.130342.72341000.00000020.mdmp "Software\Microsoft\Windows NT\Curr" in Source: 00000000-00006452.00000002.132260.007BF000.00000004.mdmp "Software\Tencent\Yuanbao" in Source: 00000000-00006452.00000002.132260.02AF0000.00000004.mdmp "Software\Classes\SystemFileAssociations\" in Source: 00000000-00006452.00000002.132260.02AF0000.00000004.mdmp "SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00006452.00000002.132260.02AF0000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate" in Source: 00000000-00006452.00000002.132260.02AF0000.00000004.mdmp "SOFTWARE\Microsoft\EdgeUpdate" in Source: 00000000-00006452.00000002.132260.02AF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Yuanbao" in Source: 00000000-00006452.00000002.132260.02AF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006452.00000002.132260.02AF0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\YuanbaoUpdateService\" in Source: 00000000-00006452.00000002.132260.02AF0000.00000004.mdmp "Local Settings\Software\Microsoft\Windows\Shell\MuiCache" in Source: 00000000-00006452.00000002.132260.02AF0000.00000004.mdmp "SOFTWARE\Classes\*\shellex\ContextMenuHandlers\{F57A977F-9921-4E5B-831A-EA3F80DC089F}" in Source: 00000000-00006452.00000002.132260.02AF0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006452.00000002.132260.07382000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Capture\" in Source: 00000000-00006452.00000002.132260.7327E000.00000002.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00006452.00000002.132260.7327E000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00006452.00000002.132260.7327E000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00006452.00000002.132260.7327E000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00006452.00000002.132260.7327E000.00000002.mdmp "pdSoftware\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00006516.00000000.130829.12DB0000.00000004.mdmp "\REGISTRY\MACHINE\Software\" in Source: 00000000-00006516.00000000.130829.12DB0000.00000004.mdmp "HHKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00006516.00000000.130829.12DB0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW643" in Source: 00000000-00006516.00000000.130829.12DB0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007664.00000000.129902.003A1000.00000020.mdmp "Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00007672.00000001.133609.02A50000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00007672.00000001.133609.02A50000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007672.00000001.133609.02A50000.00000004.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007672.00000001.133609.02A50000.00000004.mdmp "Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00007672.00000002.135526.02A50000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00007672.00000002.135526.02A50000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007672.00000002.135526.02A50000.00000004.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007672.00000002.135526.02A50000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}" in Source: 00000000-00007672.00000002.135526.02A50000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\CurrentState" in Source: 00000000-00007708.00000000.131868.03470000.00000004.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00007708.00000000.131868.03470000.00000004.mdmp "REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007708.00000000.131868.03470000.00000004.mdmp "HKLM\S" in Source: 00000000-00007708.00000000.131868.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00007708.00000000.131868.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\CurrentState" in Source: 00000000-00007708.00000000.131868.03470000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B31118B2-1F49-48E5" in Source: 00000000-00007708.00000000.131868.03470000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00007708.00000000.131868.03470000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00007708.00000000.131868.03470000.00000004.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007708.00000000.131868.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium" in Source: 00000000-00007708.00000000.131868.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00007708.00000000.131868.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\" in Source: 00000000-00007708.00000000.131868.03470000.00000004.mdmp "Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00007708.00000000.131868.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00007708.00000000.131868.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007708.00000000.131868.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState" in Source: 00000000-00007708.00000000.131868.03470000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\CurrentState" in Source: 00000000-00007708.00000001.133786.03470000.00000004.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00007708.00000001.133786.03470000.00000004.mdmp "REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007708.00000001.133786.03470000.00000004.mdmp "HKLM\S" in Source: 00000000-00007708.00000001.133786.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00007708.00000001.133786.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\CurrentState" in Source: 00000000-00007708.00000001.133786.03470000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B31118B2-1F49-48E5" in Source: 00000000-00007708.00000001.133786.03470000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00007708.00000001.133786.03470000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00007708.00000001.133786.03470000.00000004.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007708.00000001.133786.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium" in Source: 00000000-00007708.00000001.133786.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00007708.00000001.133786.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007708.00000001.133786.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState" in Source: 00000000-00007708.00000001.133786.03470000.00000004.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 00000000-00007708.00000001.133786.71768000.00000002.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" in Source: 00000000-00007708.00000001.133786.71768000.00000002.mdmp "KLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00007708.00000001.133786.71768000.00000002.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" in Source: 00000000-00007708.00000001.133786.71768000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00007708.00000001.133786.71768000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007708.00000001.133786.71768000.00000002.mdmp "HKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00007708.00000001.133786.71768000.00000002.mdmp "HKLM\SOFTWARE\Policies\Microsoft\Copilot" in Source: 00000000-00007708.00000001.133786.71768000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\PackageRepository\Packages" in Source: 00000000-00007708.00000001.133786.71768000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications" in Source: 00000000-00007708.00000001.133786.71768000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\CurrentState" in Source: 00000000-00007708.00000002.135707.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\CurrentState" in Source: 00000000-00007708.00000002.135707.03470000.00000004.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00007708.00000002.135707.03470000.00000004.mdmp "REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007708.00000002.135707.03470000.00000004.mdmp "HKLM\S" in Source: 00000000-00007708.00000002.135707.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00007708.00000002.135707.03470000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B31118B2-1F49-48E5" in Source: 00000000-00007708.00000002.135707.03470000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00007708.00000002.135707.03470000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00007708.00000002.135707.03470000.00000004.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007708.00000002.135707.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium" in Source: 00000000-00007708.00000002.135707.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00007708.00000002.135707.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007708.00000002.135707.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState" in Source: 00000000-00007708.00000002.135707.03470000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007912.00000000.131657.02930000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00007912.00000000.131657.02930000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00007912.00000000.131657.05990000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007912.00000000.131657.05990000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "SOFTWARE\Microsoft\Office\OfficeHub" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "KLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "KLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "Software\Microsoft\%ws\UsageStats\Daily" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKU\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Setup\State" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "KLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\SOFTWARE\Policies\Microsoft\Copilot" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "Software\Microsoft\EdgeUpdate\DownloaderLockout" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\CdpNames\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\AdditionalInstallArgs\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "Software\Classes" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\PackageRepository\Packages" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\Software\Google\Update" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\Software\Google\Update\Clients\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\Software\Google\Update\ClientState\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\%s" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "Software\Microsoft\EdgeUpdate\proxy" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKCR\http\shell\open\command" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKCU\SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKCR\Applications\FIREFOX.EXE\shell\open\command" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKCR\Applications\chrome.exe\shell\open\command" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\Software\Policies\Microsoft\Edge\WebView2\DowngradeVersion" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKCR\CLSID\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "\SOFTWARE\Classes" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKCU\Software\Microsoft\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "HKLM\Software\Microsoft\" in Source: 00000000-00007912.00000000.131657.7209F000.00000002.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00007912.00000001.131811.02930000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007912.00000001.131811.02930000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007912.00000001.131811.02930000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00007912.00000001.131811.02930000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007912.00000001.131811.029E4000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00007912.00000001.131811.029E4000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007912.00000001.131811.029E4000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007912.00000001.131811.029E4000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium" in Source: 00000000-00007912.00000001.131811.029E4000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00007912.00000001.131811.029E4000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00007912.00000001.131811.05990000.00000004.mdmp "Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00007912.00000001.131811.05990000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007912.00000001.131811.05990000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007912.00000001.131811.05990000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients" in Source: 00000000-00007912.00000001.131811.05990000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState" in Source: 00000000-00007912.00000001.131811.05990000.00000004.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00007912.00000001.131811.05990000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007912.00000001.131811.05990000.00000004.mdmp "doSoftware\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00008188.00000000.131244.457C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\U" in Source: 00000000-00008188.00000000.131244.457C0000.00000004.mdmp "HHKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00008188.00000000.131244.457C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW643." in Source: 00000000-00008188.00000000.131244.457C0000.00000004.mdmp51:T5a90,"yuanbao_v2.371_x64.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 733f0000 "yuanbao_v2.371_x64.exe" loaded module "KERNEL32.DLL" at base 77530000 "yuanbao_v2.371_x64.exe" loaded module "ADVAPI32.DLL" at base 74d90000 "yuanbao_v2.371_x64.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ec0000 "yuanbao_v2.371_x64.exe" loaded module "NTDLL.DLL" at base 77a40000 "yuanbao_v2.371_x64.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73960000 "yuanbao_v2.371_x64.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76b10000 "yuanbao_v2.371_x64.exe" loaded module "SHELL32.DLL" at base 75630000 "yuanbao_v2.371_x64.exe" loaded module "RPCRT4.DLL" at base 770e0000 "yuanbao_v2.371_x64.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77530000 "yuanbao_v2.371_x64.exe" loaded module "USER32.DLL" at base 74f80000 "yuanbao_v2.371_x64.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73290000 "yuanbao_v2.371_x64.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75630000 "yuanbao_v2.371_x64.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73d00000 "yuanbao_v2.371_x64.exe" loaded module "MSISO.DLL" at base 73230000 "yuanbao_v2.371_x64.exe" loaded module "SSPICLI.DLL" at base 74370000 "yuanbao_v2.371_x64.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 743a0000 "yuanbao_v2.371_x64.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 742c0000 "yuanbao_v2.371_x64.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 731f0000 "irsetup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 733f0000 "irsetup.exe" loaded module "KERNEL32.DLL" at base 77530000 "irsetup.exe" loaded module "ADVAPI32.DLL" at base 74d90000 "irsetup.exe" loaded module "COMCTL32.DLL" at base 72fd0000 "irsetup.exe" loaded module "COMDLG32.DLL" at base 77800000 "irsetup.exe" loaded module "GDI32.DLL" at base 77310000 "irsetup.exe" loaded module "NETAPI32.DLL" at base 72fb0000 "irsetup.exe" loaded module "OLE32.DLL" at base 76970000 "irsetup.exe" loaded module "OLEAUT32.DLL" at base 76a70000 "irsetup.exe" loaded module "OLEDLG.DLL" at base 72f80000 "irsetup.exe" loaded module "SHELL32.DLL" at base 75630000 "irsetup.exe" loaded module "SHLWAPI.DLL" at base 772a0000 "irsetup.exe" loaded module "URLMON.DLL" at base 73d00000 "irsetup.exe" loaded module "USER32.DLL" at base 74f80000 "irsetup.exe" loaded module "VERSION.DLL" at base 740e0000 "irsetup.exe" loaded module "WINMM.DLL" at base 72ee0000 "irsetup.exe" loaded module "WINSPOOL.DRV" at base 72f10000 "irsetup.exe" loaded module "UXTHEME.DLL" at base 73ec0000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ec0000 "irsetup.exe" loaded module "RPCRT4.DLL" at base 770e0000 "irsetup.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74f80000 "irsetup.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74f80000 "irsetup.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74650000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75350000 "irsetup.exe" loaded module "NTDLL.DLL" at base 77a40000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73960000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76b10000 "irsetup.exe" loaded module "COMCTL32" at base 72fd0000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76970000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 742c0000 "WebProcess.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 733f0000 "WebProcess.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 728a0000 "WebProcess.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 77760000 "WebProcess.exe" loaded module "KERNEL32.DLL" at base 77530000 "WebProcess.exe" loaded module "USER32.DLL" at base 74f80000 "WebProcess.exe" loaded module "ADVAPI32.DLL" at base 74d90000 "WebProcess.exe" loaded module "WS2_32.DLL" at base 77900000 "WebProcess.exe" loaded module "WINMM.DLL" at base 72ee0000 "WebProcess.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 736f0000 "WebProcess.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 72880000 "WebProcess.exe" loaded module "RPCRT4.DLL" at base 770e0000 "WebProcess.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 72860000 "WebProcess.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 72840000 "WebProcess.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 72830000 "WebProcess.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 727e0000 "WebProcess.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 727d0000 "WebProcess.exe" loaded module "NTDLL" at base 77a40000 "WebProcess.exe" loaded module "GDI32.DLL" at base 77310000 "WebProcess.exe" loaded module "SHELL32.DLL" at base 75630000 "WebProcess.exe" loaded module "OLE32.DLL" at base 76970000 "WebProcess.exe" loaded module "OLEAUT32.DLL" at base 76a70000 "WebProcess.exe" loaded module "GDIPLUS.DLL" at base 740f0000 "WebProcess.exe" loaded module "DXGI.DLL" at base 72cf0000 "WebProcess.exe" loaded module "PSAPI.DLL" at base 777c0000 "WebProcess.exe" loaded module "DINPUT8.DLL" at base 72cb0000 "WebProcess.exe" loaded module "EXT-MS-WIN-MININPUT-INPUTHOST-L1-1-1.DLL" at base 72c80000 "WebProcess.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74f80000 "WebProcess.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74650000 "WebProcess.exe" loaded module "EXT-MS-WIN-MININPUT-INPUTHOST-L1-1-0.DLL" at base 72c80000 "WebProcess.exe" loaded module "NTDLL.DLL" at base 77a40000 "WebProcess.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 72b00000 "WebProcess.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ec0000 "WebProcess.exe" loaded module "%WINDIR%\SYSWOW64\DEVENUM.DLL" at base 72b00000 "WebProcess.exe" loaded module "SETUPAPI.DLL" at base 748a0000 "WebProcess.exe" loaded module "MSDMO.DLL" at base 72f10000 "WebProcess.exe" loaded module "IMM32.DLL" at base 777d0000 "WebProcess.exe" loaded module "AVICAP32.DLL" at base 72ae0000 "WebProcess.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 743a0000 "WebProcess.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72af0000 "WebProcess.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72a70000 "WebProcess.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 724d0000 "WebProcess.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 743a0000 "WebProcess.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 743a0000 "WebProcess.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 743a0000 "WebProcess.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 743a0000 "WebProcess.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 743a0000 "WebProcess.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 743a0000 "WebProcess.exe" loaded module "KERNEL32" at base 77530000 "WebProcess.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 743a0000 "WebProcess.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 743a0000 "WebProcess.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 743a0000 "WebProcess.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 738d0000 "WebProcess.exe" loaded module "SSPICLI.DLL" at base 74370000 "WebProcess.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 740f0000 "WebProcess.exe" loaded module "WINDOWSCODECS.DLL" at base 73550000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 733f0000 "yuanbao_2.77.1.612_x64.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 743a0000 "yuanbao_2.77.1.612_x64.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 743a0000 "yuanbao_2.77.1.612_x64.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 743a0000 "yuanbao_2.77.1.612_x64.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 743a0000 "yuanbao_2.77.1.612_x64.exe" loaded module "KERNEL32" at base 77530000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ec0000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 733c0000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 748a0000 "yuanbao_2.77.1.612_x64.exe" loaded module "NTDLL.DLL" at base 77a40000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 742c0000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73960000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 734f0000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 74360000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 73360000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 74ea0000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 73330000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 740e0000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73320000 "yuanbao_2.77.1.612_x64.exe" loaded module "KERNEL32.DLL" at base 77530000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 732b0000 "yuanbao_2.77.1.612_x64.exe" loaded module "%TEMP%\NSW9161.TMP\SYSTEM.DLL" at base 732a0000 "yuanbao_2.77.1.612_x64.exe" loaded module "%TEMP%\NSW9161.TMP\PRODUCTHELPER.DLL" at base 73220000 "yuanbao_2.77.1.612_x64.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 743a0000 "yuanbao_2.77.1.612_x64.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 743a0000 "yuanbao_2.77.1.612_x64.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 743a0000 "yuanbao_2.77.1.612_x64.exe" loaded module "RPCRT4.DLL" at base 770e0000 "yuanbao_2.77.1.612_x64.exe" loaded module "SSPICLI.DLL" at base 74370000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSWOW64\FIREWALLAPI.DLL" at base 72e50000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 728a0000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 75300000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 754a0000 "yuanbao_2.77.1.612_x64.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77530000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 77760000 "yuanbao_2.77.1.612_x64.exe" loaded module "CRYPT32.DLL" at base 754a0000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 72450000 "yuanbao_2.77.1.612_x64.exe" loaded module "COMCTL32.DLL" at base 72fd0000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75350000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76970000 "yuanbao_2.77.1.612_x64.exe" loaded module "OLEAUT32.DLL" at base 76a70000 "yuanbao_2.77.1.612_x64.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74f80000 "yuanbao_2.77.1.612_x64.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74f80000 "yuanbao_2.77.1.612_x64.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74650000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75630000 "yuanbao_2.77.1.612_x64.exe" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 72340000 "yuanbao_2.77.1.612_x64.exe" loaded module "%TEMP%\NSW9161.TMP\INETC.DLL" at base 72300000 "yuanbao_2.77.1.612_x64.exe" loaded module "WINHTTP.DLL" at base 72f20000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 722e0000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 736f0000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 727d0000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 727e0000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72210000 "yuanbao_2.77.1.612_x64.exe" loaded module "MSKEYPROTECT.DLL" at base 72200000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 72190000 "yuanbao_2.77.1.612_x64.exe" loaded module "WS2_32.DLL" at base 77900000 "report_helper.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 733f0000 "report_helper.exe" loaded module "SECUR32.DLL" at base 72f10000 "report_helper.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 736f0000 "report_helper.exe" loaded module "KERNEL32.DLL" at base 77530000 "report_helper.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 727d0000 "report_helper.exe" loaded module "RPCRT4.DLL" at base 770e0000 "report_helper.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 727e0000 "report_helper.exe" loaded module "SSPICLI.DLL" at base 74370000 "report_helper.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72d90000 "MicrosoftEdgeWebview2Setup_908350031_1.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 733f0000 "MicrosoftEdgeWebview2Setup_908350031_1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 743a0000 "MicrosoftEdgeWebview2Setup_908350031_1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 743a0000 "MicrosoftEdgeWebview2Setup_908350031_1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 743a0000 "MicrosoftEdgeWebview2Setup_908350031_1.exe" loaded module "KERNEL32" at base 77530000 "MicrosoftEdgeWebview2Setup_908350031_1.exe" loaded module "SHLWAPI.DLL" at base 772a0000 "MicrosoftEdgeWebview2Setup_908350031_1.exe" loaded module "KERNEL32.DLL" at base 77530000 "MicrosoftEdgeWebview2Setup_908350031_1.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ec0000 "MicrosoftEdgeWebview2Setup_908350031_1.exe" loaded module "NTDLL.DLL" at base 77a40000 "MicrosoftEdgeWebview2Setup_908350031_1.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 742c0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 733f0000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 743a0000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 743a0000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 743a0000 "MicrosoftEdgeUpdate.exe" loaded module "SHELL32.DLL" at base 75630000 "MicrosoftEdgeUpdate.exe" loaded module "KERNEL32" at base 77530000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 743a0000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 743a0000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 743a0000 "MicrosoftEdgeUpdate.exe" loaded module "SHLWAPI.DLL" at base 772a0000 "MicrosoftEdgeUpdate.exe" loaded module "KERNEL32.DLL" at base 77530000 "MicrosoftEdgeUpdate.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\TEMP\EUD2A0.TMP\MSEDGEUPDATE.DLL" at base 71f30000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 77530000 "MicrosoftEdgeUpdate.exe" loaded module "ADVAPI32.DLL" at base 74d90000 "MicrosoftEdgeUpdate.exe" loaded module "RPCRT4.DLL" at base 770e0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 71ef0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NETAPI32.DLL" at base 72320000 "MicrosoftEdgeUpdate.exe" loaded module "NETAPI32.DLL" at base 72320000 "MicrosoftEdgeUpdate.exe" loaded module "USER32.DLL" at base 74f80000 "MicrosoftEdgeUpdate.exe" loaded module "OLE32.DLL" at base 76970000 "MicrosoftEdgeUpdate.exe" loaded module "GDI32.DLL" at base 77310000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\MSXML6.DLL" at base 71c30000 "MicrosoftEdgeUpdate.exe" loaded module "KERNELBASE.DLL" at base 743a0000 "MicrosoftEdgeUpdate.exe" loaded module "NTDLL.DLL" at base 77a40000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 742c0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 738d0000 "MicrosoftEdgeUpdate.exe" loaded module "OLEAUT32.DLL" at base 76a70000 "MicrosoftEdgeUpdate.exe" loaded module "SSPICLI.DLL" at base 74370000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NTDLL.DLL" at base 77a40000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WLDP.DLL" at base 71c10000 "MicrosoftEdgeUpdate.exe" loaded module "COMCTL32.DLL" at base 72fd0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ec0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75350000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73960000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77530000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 71b60000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75630000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76b10000 "MicrosoftEdgeUpdate.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEUPDATE\1.3.251.23\MSEDGEUPDATE.DLL" at base 71f30000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 71bf0000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74640000 "MicrosoftEdgeUpdate.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEUPDATE\1.3.251.23\PSMACHINE.DLL" at base 71bd0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 71b90000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff936070000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 7ff9398e0000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "%WINDIR%\SYSTEM32\NETAPI32.DLL" at base 7ff94caa0000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "OLE32.DLL" at base 13557e60000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "USER32.DLL" at base 7ff956160000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "RPCRT4.DLL" at base 7ff956010000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff954dd0000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff9362a0000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "OLE32.DLL" at base 1d414ee0000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "OLE32.DLL" at base 1d947880000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 71b20000 "MicrosoftEdgeUpdate.exe" loaded module "IPHLPAPI.DLL" at base 74290000 "MicrosoftEdgeUpdate.exe" loaded module "WININET.DLL" at base 71890000 "MicrosoftEdgeUpdate.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 71870000 "MicrosoftEdgeUpdate.exe" loaded module "WINHTTP.DLL" at base 72f20000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 71870000 "MicrosoftEdgeUpdate.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 74d90000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 736f0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 71840000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 71830000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WINHTTP" at base 72f20000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 727d0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 727e0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72210000 "MicrosoftEdgeUpdate.exe" loaded module "MSKEYPROTECT.DLL" at base 72200000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 72190000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 77760000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 728a0000 "MicrosoftEdgeUpdate.exe" loaded module "MSISO.DLL" at base 717d0000 "MicrosoftEdgeUpdate.exe" loaded module "WS2_32.DLL" at base 77900000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 77900000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 75300000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 717a0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\CRYPTNET.DLL" at base 717a0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 754a0000 "MicrosoftEdgeUpdate.exe" loaded module "CRYPTNET.DLL" at base 717a0000 "MicrosoftEdgeUpdate.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEUPDATE\1.3.251.23\PSMACHINE.DLL" at base 71740000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 71830000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 76a70000 "MicrosoftEdgeUpdate.exe" loaded module "ATLTHUNK.DLL" at base 71860000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 71760000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WLDP.DLL" at base 71840000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WTSAPI32.DLL" at base 73f70000 "MicrosoftEdgeUpdate.exe" loaded module "SLWGA.DLL" at base 71840000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WLDP.DLL" at base 71b40000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 71810000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 71800000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 71890000 "MicrosoftEdgeUpdate.exe" loaded module "MSISO.DLL" at base 717a0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 716f0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSWOW64\CRYPTNET.DLL" at base 716f0000 "MicrosoftEdgeUpdate.exe" loaded module "CRYPTNET.DLL" at base 716f0000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MDMREGISTRATION.DLL" at base 716b000052:T53f,"yuanbao_v2.371_x64.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77760000 "yuanbao_v2.371_x64.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 737C0000 "irsetup.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77760000 "irsetup.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 737C0000 "WebProcess.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77760000 "WebProcess.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 737C0000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77760000 "yuanbao_2.77.1.612_x64.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 737C0000 "report_helper.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77760000 "report_helper.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 737C0000 "MicrosoftEdgeWebview2Setup_908350031_1.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77760000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77760000 "MicrosoftEdgeUpdate.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 737C0000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 55AF0000 "MicrosoftEdgeUpdateComRegisterShell64.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 548E000053:T1cd0,"yuanbao_v2.371_x64.exe" was detected as "Setup Factory" and name: "Installer" "yuanbao_v2.371_x64.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "yuanbao_v2.371_x64.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "yuanbao_v2.371_x64.exe" was detected as "Microsoft Linker" and name: "Linker" "msedgeupdate.dll" was detected as "Setup Factory" and name: "Installer" "msedgeupdate.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "msedgeupdate.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "msedgeupdate.dll" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeUpdateSetup.exe" was detected as "Setup Factory" and name: "Installer" "MicrosoftEdgeUpdateSetup.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "MicrosoftEdgeUpdateSetup.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MicrosoftEdgeUpdateSetup.exe" was detected as "Microsoft Linker" and name: "Linker" "report_helper.exe" was detected as "Setup Factory" and name: "Installer" "report_helper.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "report_helper.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "report_helper.exe" was detected as "Microsoft Linker" and name: "Linker" "irsetup.exe" was detected as "Setup Factory" and name: "Installer" "irsetup.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "irsetup.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "irsetup.exe" was detected as "Microsoft Linker" and name: "Linker" "ProductHelper.dll" was detected as "Setup Factory" and name: "Installer" "ProductHelper.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ProductHelper.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ProductHelper.dll" was detected as "Microsoft Linker" and name: "Linker" "psmachine_64.dll" was detected as "Setup Factory" and name: "Installer" "psmachine_64.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "psmachine_64.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "psmachine_64.dll" was detected as "Microsoft Linker" and name: "Linker" "psuser_64.dll" was detected as "Setup Factory" and name: "Installer" "psuser_64.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "psuser_64.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "psuser_64.dll" was detected as "Microsoft Linker" and name: "Linker" "psuser_arm64.dll" was detected as "Setup Factory" and name: "Installer" "psuser_arm64.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "psuser_arm64.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "psuser_arm64.dll" was detected as "Microsoft Linker" and name: "Linker" "psmachine_arm64.dll" was detected as "Setup Factory" and name: "Installer" "psmachine_arm64.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "psmachine_arm64.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "psmachine_arm64.dll" was detected as "Microsoft Linker" and name: "Linker" "psuser.dll" was detected as "Setup Factory" and name: "Installer" "psuser.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "psuser.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "psuser.dll" was detected as "Microsoft Linker" and name: "Linker" "psmachine.dll" was detected as "Setup Factory" and name: "Installer" "psmachine.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "psmachine.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "psmachine.dll" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeUpdateCore.exe" was detected as "Setup Factory" and name: "Installer" "MicrosoftEdgeUpdateCore.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "MicrosoftEdgeUpdateCore.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MicrosoftEdgeUpdateCore.exe" was detected as "Microsoft Linker" and name: "Linker" "INetC.dll" was detected as "Setup Factory" and name: "Installer" "INetC.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "INetC.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "INetC.dll" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeUpdateComRegisterShell64.exe" was detected as "Setup Factory" and name: "Installer" "MicrosoftEdgeUpdateComRegisterShell64.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "MicrosoftEdgeUpdateComRegisterShell64.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MicrosoftEdgeUpdateComRegisterShell64.exe" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeUpdate.exe" was detected as "Setup Factory" and name: "Installer" "MicrosoftEdgeUpdate.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "MicrosoftEdgeUpdate.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MicrosoftEdgeUpdate.exe" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeComRegisterShellARM64.exe" was detected as "Setup Factory" and name: "Installer" "MicrosoftEdgeComRegisterShellARM64.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "MicrosoftEdgeComRegisterShellARM64.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MicrosoftEdgeComRegisterShellARM64.exe" was detected as "Microsoft Linker" and name: "Linker" "libcef.dll" was detected as "Setup Factory" and name: "Installer" "libcef.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "libcef.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libcef.dll" was detected as "Microsoft Linker" and name: "Linker" "WebProcess.exe" was detected as "Setup Factory" and name: "Installer" "WebProcess.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "WebProcess.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "WebProcess.exe" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeUpdateOnDemand.exe" was detected as "Setup Factory" and name: "Installer" "MicrosoftEdgeUpdateOnDemand.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "MicrosoftEdgeUpdateOnDemand.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MicrosoftEdgeUpdateOnDemand.exe" was detected as "Microsoft Linker" and name: "Linker" "MicrosoftEdgeUpdateBroker.exe" was detected as "Setup Factory" and name: "Installer" "MicrosoftEdgeUpdateBroker.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "MicrosoftEdgeUpdateBroker.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MicrosoftEdgeUpdateBroker.exe" was detected as "Microsoft Linker" and name: "Linker" "msedgeupdateres_ml.dll" was detected as "Setup Factory" and name: "Installer" "msedgeupdateres_ml.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "msedgeupdateres_ml.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "msedgeupdateres_ml.dll" was detected as "Microsoft Linker" and name: "Linker"54:T115d,"yuanbao_v2.371_x64.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "yuanbao_v2.371_x64.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "yuanbao_v2.371_x64.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "yuanbao_v2.371_x64.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "yuanbao_v2.371_x64.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "yuanbao_v2.371_x64.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "yuanbao_v2.371_x64.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "yuanbao_v2.371_x64.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "yuanbao_v2.371_x64.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "yuanbao_v2.371_x64.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "yuanbao_v2.371_x64.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "irsetup.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "WebProcess.exe" touched "System Device Enumerator" (Path: "HKCU\WOW6432NODE\CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}") "WebProcess.exe" touched "VFW Capture Class Manager" (Path: "HKCU\WOW6432NODE\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\TREATAS") "WebProcess.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WebProcess.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WebProcess.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "WebProcess.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "WebProcess.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WebProcess.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "WebProcess.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS") "yuanbao_2.77.1.612_x64.exe" touched "HNetCfg.FwMgr" (Path: "HKCU\WOW6432NODE\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\TREATAS") "yuanbao_2.77.1.612_x64.exe" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TREATAS") "yuanbao_2.77.1.612_x64.exe" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "yuanbao_2.77.1.612_x64.exe" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "yuanbao_2.77.1.612_x64.exe" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "MicrosoftEdgeUpdate.exe" touched "XML DOM Document 6.0" (Path: "HKCU\WOW6432NODE\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}") "MicrosoftEdgeUpdate.exe" touched "NetworkListManager" (Path: "HKCU\WOW6432NODE\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "MicrosoftEdgeUpdate.exe" touched "Network List Manager" (Path: "HKCU\WOW6432NODE\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS") "MicrosoftEdgeUpdate.exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "MicrosoftEdgeUpdate.exe" touched "Wininet Cache task object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0358B920-0AC7-461F-98F4-58E32CD89148}\TREATAS")55:T559,"msedgeupdate.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MicrosoftEdgeUpdateSetup.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "ProductHelper.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "psmachine_64.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "psuser_64.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "psuser_arm64.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "psmachine_arm64.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "psuser.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "psmachine.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MicrosoftEdgeUpdateCore.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "INetC.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MicrosoftEdgeUpdateComRegisterShell64.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MicrosoftEdgeUpdate.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MicrosoftEdgeComRegisterShellARM64.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MicrosoftEdgeUpdateOnDemand.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MicrosoftEdgeUpdateBroker.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "msedgeupdateres_ml.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"56:T604,"yuanbao_v2.371_x64.exe" has an executable section named ".text" "msedgeupdate.dll" has an executable section named ".text" "MicrosoftEdgeUpdateSetup.exe" has an executable section named ".text" "report_helper.exe" has an executable section named ".text" "irsetup.exe" has an executable section named "UPX0" "irsetup.exe" has an executable section named "UPX1" "ProductHelper.dll" has an executable section named ".text" "psmachine_64.dll" has an executable section named ".text" "psmachine_64.dll" has an executable section named ".orpc" "psuser_64.dll" has an executable section named ".text" "psuser_64.dll" has an executable section named ".orpc" "psuser_arm64.dll" has an executable section named ".text" "psuser_arm64.dll" has an executable section named ".orpc" "psmachine_arm64.dll" has an executable section named ".text" "psmachine_arm64.dll" has an executable section named ".orpc" "psuser.dll" has an executable section named ".text" "psuser.dll" has an executable section named ".orpc" "psmachine.dll" has an executable section named ".text" "psmachine.dll" has an executable section named ".orpc" "MicrosoftEdgeUpdateCore.exe" has an executable section named ".text" "INetC.dll" has an executable section named ".text" "MicrosoftEdgeUpdateComRegisterShell64.exe" has an executable section named ".text" "MicrosoftEdgeUpdate.exe" has an executable section named ".text" "MicrosoftEdgeComRegisterShellARM64.exe" has an executable section named ".text" "libcef.dll" has an executable section named ".text"57:T5c8,"yuanbao_v2.371_x64.exe" has an writable section named ".data" "msedgeupdate.dll" has an writable section named ".data" "msedgeupdate.dll" has an writable section named ".didat" "MicrosoftEdgeUpdateSetup.exe" has an writable section named ".data" "MicrosoftEdgeUpdateSetup.exe" has an writable section named ".didat" "report_helper.exe" has an writable section named ".data" "irsetup.exe" has an writable section named "UPX0" "irsetup.exe" has an writable section named "UPX1" "irsetup.exe" has an writable section named ".rsrc" "ProductHelper.dll" has an writable section named ".data" "ProductHelper.dll" has an writable section named ".fptable" "psmachine_64.dll" has an writable section named ".data" "psmachine_64.dll" has an writable section named ".didat" "psuser_64.dll" has an writable section named ".data" "psuser_64.dll" has an writable section named ".didat" "psuser_arm64.dll" has an writable section named ".data" "psuser_arm64.dll" has an writable section named ".didat" "psmachine_arm64.dll" has an writable section named ".data" "psmachine_arm64.dll" has an writable section named ".didat" "psuser.dll" has an writable section named ".data" "psuser.dll" has an writable section named ".didat" "psmachine.dll" has an writable section named ".data" "psmachine.dll" has an writable section named ".didat" "MicrosoftEdgeUpdateCore.exe" has an writable section named ".data" "MicrosoftEdgeUpdateCore.exe" has an writable section named ".didat"58:T330a,"yuanbao_v2.371_x64.exe" file has an entrypoint instructions - "call 0x405f79,jmp 0x402e99,push ebp,mov ebp, esp,sub esp, 4,mov dword ptr [ebp - 4], edi,mov edi, dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0xc],shr ecx, 7,pxor xmm0, xmm0,jmp 0x4030a3,lea esp, [esp],nop ,movdqa xmmword ptr [edi], xmm0,movdqa xmmword ptr [edi + 0x10], xmm0,movdqa xmmword ptr [edi + 0x20], xmm0,movdqa xmmword ptr [edi + 0x30], xmm0,movdqa xmmword ptr [edi + 0x40], xmm0,movdqa xmmword ptr [edi + 0x50], xmm0,movdqa xmmword ptr [edi + 0x60], xmm0,movdqa xmmword ptr [edi + 0x70], xmm0,lea edi, [edi + 0x80],dec ecx,jne 0x4030a3,mov edi, dword ptr [ebp - 4],mov esp, ebp,pop ebp,ret ,push ebp,mov ebp, esp," "msedgeupdate.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1812b9ee,call 0x1812c062,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1812b8aa,add esp, 0xc,pop ebp,ret 0xc,jmp 0x1812b153,push ebp,mov ebp, esp,jmp 0x1812ba1a,push dword ptr [ebp + 8],call 0x181511a7,pop ecx,test eax, eax,je 0x1812ba29,push dword ptr [ebp + 8],call 0x181480b8,pop ecx,test eax, eax,je 0x1812ba0d,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x1812c25a,jmp 0x1812c23d,push ebp,mov ebp, esp,pop ebp,jmp 0x1812ba08,push ebp,mov ebp, esp," "MicrosoftEdgeUpdateSetup.exe" file has an entrypoint instructions - "call 0x4086a8,jmp 0x408282,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x408445,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40843e,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40844a,add edx, 0x28,cmp edx, esi,jne 0x40842f,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x408447,push esi,call 0x408bf9,test eax, eax,je 0x408478,mov eax, dword ptr fs:[0x18],mov esi, 0x42692c," "report_helper.exe" file has an entrypoint instructions - "call 0x46ac25,jmp 0x45e5dd,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x20,push ebx,push edi,xor ebx, ebx,push 7,xor eax, eax,pop ecx,lea edi, [ebp - 0x1c],mov dword ptr [ebp - 0x20], ebx,rep stosd dword ptr es:[edi], eax,cmp dword ptr [ebp + 0xc], ebx,jne 0x45e77b,call 0x459b7c,mov dword ptr [eax], 0x16,call 0x45f5f0,or eax, 0xffffffff,jmp 0x45e7c8,mov eax, dword ptr [ebp + 8],cmp eax, ebx,je 0x45e766,push esi,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x20], eax,lea eax, [ebp + 0x10],push eax,push ebx,push dword ptr [ebp + 0xc],lea eax, [ebp - 0x20],push eax,mov dword ptr [ebp - 0x1c], 0x7fffffff," "irsetup.exe" file has an entrypoint instructions - "pushal ,mov esi, 0x4f3000,lea edi, [esi - 0xf2000],push edi,jmp 0x5784ca,nop ,mov al, byte ptr [esi],inc esi,mov byte ptr [edi], al,inc edi,add ebx, ebx,jne 0x5784d1,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,jb 0x5784c0,mov eax, 1,add ebx, ebx,jne 0x5784e3,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,adc eax, eax,add ebx, ebx,jae 0x5784f4,jne 0x578513,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,jb 0x578513,dec eax,add ebx, ebx,jne 0x578500,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,adc eax, eax,jmp 0x5784d8,add ebx, ebx,jne 0x57850f,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,adc ecx, ecx,jmp 0x578565," "ProductHelper.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10034d7f,call 0x10035662,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10034c38,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,or dword ptr [0x10075398], 1,sub esp, 0x28,mov dword ptr [0x10077450], 0,push 0xa,call dword ptr [0x1005e260],test eax, eax,je 0x100350b6,push ebx,push esi,push edi,xor eax, eax,lea edi, [ebp - 0x28],xor ecx, ecx,push ebx,cpuid ," "psmachine_64.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180018141,call 0x1800184a8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180017fec,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,jmp 0x18001817a,mov rcx, rbx,call 0x180020b68,test eax, eax,je 0x18001818a,mov rcx, rbx,call 0x18001d224,test rax, rax,je 0x18001816b," "psuser_64.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180018141,call 0x1800184a8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180017fec,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,jmp 0x18001817a,mov rcx, rbx,call 0x180020b68,test eax, eax,je 0x18001818a,mov rcx, rbx,call 0x18001d224,test rax, rax,je 0x18001816b," "psuser_arm64.dll" file has an entrypoint instructions - "jg 0x8001bc95,add edx, ebp,push ebx,mov esi, 0xbf5a9,stc ,std ,jnp 0x8001bc3e,test eax, 0x910003fd,add eax, dword ptr [ecx],sub bh, byte ptr [edi + 6],add byte ptr [ecx - 0xc], dh,add eax, dword ptr [eax],stosb byte ptr es:[edi], al,cmc ,add eax, dword ptr [edx],stosb byte ptr es:[edi], al,inc ecx,add byte ptr [eax], al,push esp,sub byte ptr [eax], al,add byte ptr [edx - 0x1e55eafd], dl,add edx, dword ptr [ebx],sub ah, al,add edx, dword ptr [edx + ebp*4],mov bh, bh,call dword ptr [edi - 0x573e8403],cmc ,or eax, dword ptr [eax - 7],push ebx,ret 0xffa8,and eax, dword ptr [ebx],aad 0xc0,add ebx, dword ptr [edi - 0x2a],jg 0x8001bce5,add edx, ebp,nop eax,std ,jnp 0x8001bc8a,test eax, 0x910003fd,add eax, dword ptr [eax],stosb byte ptr es:[edi], al," "psmachine_arm64.dll" file has an entrypoint instructions - "jg 0x8001bc95,add edx, ebp,push ebx,mov esi, 0xbf5a9,stc ,std ,jnp 0x8001bc3e,test eax, 0x910003fd,add eax, dword ptr [ecx],sub bh, byte ptr [edi + 6],add byte ptr [ecx - 0xc], dh,add eax, dword ptr [eax],stosb byte ptr es:[edi], al,cmc ,add eax, dword ptr [edx],stosb byte ptr es:[edi], al,inc ecx,add byte ptr [eax], al,push esp,sub byte ptr [eax], al,add byte ptr [edx - 0x1e55eafd], dl,add edx, dword ptr [ebx],sub ah, al,add edx, dword ptr [edx + ebp*4],mov bh, bh,call dword ptr [edi - 0x573e8403],cmc ,or eax, dword ptr [eax - 7],push ebx,ret 0xffa8,and eax, dword ptr [ebx],aad 0xc0,add ebx, dword ptr [edi - 0x2a],jg 0x8001bce5,add edx, ebp,nop eax,std ,jnp 0x8001bc8a,test eax, 0x910003fd,add eax, dword ptr [eax],stosb byte ptr es:[edi], al," "psuser.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100126be,call 0x10012aa2,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1001257a,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,jmp 0x100126e5,push dword ptr [ebp + 8],call 0x1001a787,pop ecx,test eax, eax,je 0x100126f4,push dword ptr [ebp + 8],call 0x100173e0,pop ecx,test eax, eax,je 0x100126d8,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x10012c9a,jmp 0x10012c7d,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17," "psmachine.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100126be,call 0x10012aa2,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1001257a,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,jmp 0x100126e5,push dword ptr [ebp + 8],call 0x1001a787,pop ecx,test eax, eax,je 0x100126f4,push dword ptr [ebp + 8],call 0x100173e0,pop ecx,test eax, eax,je 0x100126d8,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x10012c9a,jmp 0x10012c7d,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17," "MicrosoftEdgeUpdateCore.exe" file has an entrypoint instructions - "call 0x40de27,jmp 0x40d6e2,push ebp,mov ebp, esp,push 0,call dword ptr [0x4220f4],push dword ptr [ebp + 8],call dword ptr [0x4220f0],push 0xc0000409,call dword ptr [0x4220f8],push eax,call dword ptr [0x4220fc],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call dword ptr [0x422100],test eax, eax,je 0x40d8ac,push 2,pop ecx,int 0x29,mov dword ptr [0x43ee48], eax,mov dword ptr [0x43ee44], ecx,mov dword ptr [0x43ee40], edx,mov dword ptr [0x43ee3c], ebx," "INetC.dll" file has an entrypoint instructions - "jmp 0x10001d2a,jmp 0x10002339,jmp 0x10002218,jmp 0x100024ff,jmp 0x10001961,jmp 0x1000205e,jmp 0x100011ad,jmp 0x10001278,jmp 0x10001f54,jmp 0x1000191a,jmp 0x10001f87,jmp 0x10002118,jmp 0x10001227,jmp 0x10002375,jmp 0x10001d40,jmp 0x10002600,jmp 0x10002247,jmp 0x1000246c,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ," "MicrosoftEdgeUpdateComRegisterShell64.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1400066e8,add rsp, 0x28,jmp 0x140005cfc,int3 ,int3 ,jmp 0x140006400,int3 ,int3 ,int3 ,sub rsp, 0x28,call 0x140006c98,test eax, eax,je 0x140005eba,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],jmp 0x140005ead,cmp rcx, rax,je 0x140005ec1,xor eax, eax,lock cmpxchg qword ptr [rip + 0x2e128], rcx,jne 0x140005ea8,xor al, al,add rsp, 0x28,ret ,mov al, 1,jmp 0x140005ebc,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20," "MicrosoftEdgeUpdate.exe" file has an entrypoint instructions - "call 0x40bcc0,jmp 0x40b742,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x40b950,mov dword ptr [esi], 0x40133c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x401344,mov dword ptr [ecx], 0x40133c,ret ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x40b950,mov dword ptr [esi], 0x401358," "MicrosoftEdgeComRegisterShellARM64.exe" file has an entrypoint instructions - "jg 0x40007d15,add edx, ebp,std ,jnp 0x40007cb6,test eax, 0x910003fd,push edi,add dword ptr [eax], eax,xchg esp, eax," "libcef.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10008583,call 0x1000e039,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x1000847d,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,push ecx,push ebx,push esi,mov esi, dword ptr [0x1001a078],push edi,push dword ptr [0x10023988],call esi,push dword ptr [0x10023984],mov ebx, eax,mov dword ptr [ebp - 4], ebx,call esi,mov esi, eax,cmp esi, ebx,jb 0x10008645,mov edi, esi,sub edi, ebx,lea eax, [edi + 4],cmp eax, 4,jb 0x10008645,push ebx,call 0x1000e0d4," "WebProcess.exe" file has an entrypoint instructions - "call 0x41b631,jmp 0x41b01f,jmp dword ptr [0x41d0b0],int3 ,int3 ,int3 ,int3 ,jmp dword ptr [0x41d0b4],jmp dword ptr [0x41d0b8],push ebp,mov ebp, esp,call dword ptr [0x41d018],push 1,mov dword ptr [0x4216dc], eax,call 0x41b744,push dword ptr [ebp + 8],call 0x41b74a,cmp dword ptr [0x4216dc], 0,pop ecx,pop ecx,jne 0x41b21c,push 1,call 0x41b744,pop ecx,push 0xc0000409,call 0x41b750,pop ecx,pop ebp,ret ,push ebp,mov ebp, esp," "MicrosoftEdgeUpdateOnDemand.exe" file has an entrypoint instructions - "call 0x401771,jmp 0x401332,cmp ecx, dword ptr [0x413010],jne 0x4014c3,ret ,jmp 0x401b1d,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,ret 0,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x40150e,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x401507,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x401513,add edx, 0x28,cmp edx, esi,jne 0x4014f8,xor eax, eax,pop esi,pop ebp,ret ," "MicrosoftEdgeUpdateBroker.exe" file has an entrypoint instructions - "call 0x401771,jmp 0x401332,cmp ecx, dword ptr [0x413010],jne 0x4014c3,ret ,jmp 0x401b1d,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,ret 0,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x40150e,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x401507,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x401513,add edx, 0x28,cmp edx, esi,jne 0x4014f8,xor eax, eax,pop esi,pop ebp,ret ," "msedgeupdateres_ml.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x19001302,push dword ptr [ebp + 8],call dword ptr [0x19003000],xor eax, eax,inc eax,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,ret 0,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,add byte ptr [eax], al,add byte ptr [eax], al,"59:T5f4,Process "irsetup.exe" (UID: 00000000-00005176) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "irsetup.exe" (UID: 00000000-00005176) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "MicrosoftEdgeUpdate.exe" (UID: 00000000-00007708) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, USERNAME, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles, NUMBER_OF_PROCESSORS" Process "MicrosoftEdgeUpdate.exe" (UID: 00000000-00007708) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, USERDNSDOMAIN, PROCESSOR_ARCHITEW6432, HOMEPATH, HOMEDRIVE" Process "MicrosoftEdgeUpdate.exe" (UID: 00000000-00002400) was launched with new environment variables: "USERDNSDOMAIN="WORKGROUP", PROCESSOR_ARCHITEW6432="AMD64"" Process "MicrosoftEdgeUpdate.exe" (UID: 00000000-00002400) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "MicrosoftEdgeUpdate.exe" (UID: 00000000-00001172) was launched with new environment variables: "SSLKEYLOGFILE="%TEMP%\sslkey.txt", SESSIONNAME="Console", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer"" Process "MicrosoftEdgeUpdate.exe" (UID: 00000000-00001172) was launched with modified environment variables: "Path"5a:T787,"yuanbao_v2.371_x64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "yuanbao_v2.371_x64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "yuanbao_v2.371_x64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "irsetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "irsetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "irsetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "irsetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "WebProcess.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "WebProcess.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "WebProcess.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "WebProcess.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "WebProcess.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "yuanbao_2.77.1.612_x64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "yuanbao_2.77.1.612_x64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "yuanbao_2.77.1.612_x64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "yuanbao_2.77.1.612_x64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "report_helper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "report_helper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "report_helper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "report_helper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")5b:T98c,Observed system executable string:"%WINDIR%\SYSTEM32\DINPUT8.dll" [Source: 00000000-00006212-0000044E-20722387382] Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00006452-00000C2B-1005260608] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00006452-00000C2B-1005359564] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00006452-00000C2B-1005386035] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00006452-00000C2B-1005663546] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00006452-00000C2B-1005687020] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00006452-00000C2B-1005719596] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00006452-00000C2B-1005742179] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00006452-00000C2B-1005802609] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00006452-00000C2B-1005824644] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00006452-00000C2B-1005864874] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00006452-00000C2B-1005887531] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00006452-00000C2B-1005930612] Observed system executable string:"@%WINDIR%\SysWOW64\FirewallControlPanel.dll,-12122" [Source: 00000000-00006452-00000BC1-1007295410] Observed system executable string:"%WINDIR%\system32\RichEd20.dll" [Source: 00000000-00006452-00000C2B-1013232221] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00003044-00000C2B-1025711109] Observed system executable string:"%WINDIR%\system32\MDMRegistration.dll" [Source: 00000000-00003044-00000C2B-1026129698] Observed system executable string:"%WINDIR%\system32\NetApi32.dll" [Source: 00000000-00003044-00000C2B-1026305331] Observed system executable string:"%WINDIR%\system32\ntdll.dll" [Source: 00000000-00003044-00000C2B-1054814366] Observed system executable string:"%WINDIR%\system32\wldp.dll" [Source: 00000000-00003044-00000C2B-1055027635] Observed system executable string:"%WINDIR%\system32\wtsapi32.dll" [Source: 00000000-00007708-00000C2B-1062012240]5c:T724,Spawned process "irsetup.exe" with commandline "__IRAOFF:641570 "__IRAFN:C:\\yuanbao_v2.371_x64.exe" "__IRCT:2" ..." (UID: 00000000-00005176) Spawned process "WebProcess.exe" (UID: 00000000-00006212) Spawned process "yuanbao_2.77.1.612_x64.exe" (UID: 00000000-00006452) Spawned process "report_helper.exe" with commandline "--connect-timeout 3 --location --request POST "https://otheve.be ..." (UID: 00000000-00001308), Spawned process "MicrosoftEdgeWebview2Setup_908350031_1.exe" with commandline "/silent /install" (UID: 00000000-00003932), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} ..." (UID: 00000000-00003044) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regsvc" (UID: 00000000-00007664) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regserver" (UID: 00000000-00004704) Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00005904) Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00006516) Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00008188) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdW ..." (UID: 00000000-00007912) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname ..." (UID: 00000000-00007672), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/svc" (UID: 00000000-00007708), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdW ..." (UID: 00000000-00002400), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ua /installsource scheduler" (UID: 00000000-00001172)5d:T724,Spawned process "irsetup.exe" with commandline "__IRAOFF:641570 "__IRAFN:C:\\yuanbao_v2.371_x64.exe" "__IRCT:2" ..." (UID: 00000000-00005176) Spawned process "WebProcess.exe" (UID: 00000000-00006212) Spawned process "yuanbao_2.77.1.612_x64.exe" (UID: 00000000-00006452) Spawned process "report_helper.exe" with commandline "--connect-timeout 3 --location --request POST "https://otheve.be ..." (UID: 00000000-00001308), Spawned process "MicrosoftEdgeWebview2Setup_908350031_1.exe" with commandline "/silent /install" (UID: 00000000-00003932), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} ..." (UID: 00000000-00003044) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regsvc" (UID: 00000000-00007664) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regserver" (UID: 00000000-00004704) Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00005904) Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00006516) Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00008188) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdW ..." (UID: 00000000-00007912) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname ..." (UID: 00000000-00007672), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/svc" (UID: 00000000-00007708), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdW ..." (UID: 00000000-00002400), Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ua /installsource scheduler" (UID: 00000000-00001172)5e:T569,"yuanbao_v2.371_x64.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdate.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MicrosoftEdgeUpdateSetup.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "report_helper.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "irsetup.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "ProductHelper.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "psuser.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "psmachine.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MicrosoftEdgeUpdateCore.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "INetC.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MicrosoftEdgeUpdate.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "libcef.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "WebProcess.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MicrosoftEdgeUpdateOnDemand.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MicrosoftEdgeUpdateBroker.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdateres_ml.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE5f:T440,"MicrosoftEdgeUpdate.exe" create file "C:\Windows\SysWOW64\config\systemprofile" "MicrosoftEdgeUpdate.exe" create file "C:\Windows\SysWOW64\config\systemprofile\AppData\Local" "MicrosoftEdgeUpdate.exe" create file "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache" "MicrosoftEdgeUpdate.exe" create file "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies" "MicrosoftEdgeUpdate.exe" create file "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History" "MicrosoftEdgeUpdate.exe" create file "%WINDIR%\SysWOW64\config\systemprofile" "MicrosoftEdgeUpdate.exe" create file "%WINDIR%\SysWOW64\config\systemprofile\AppData\Local" "MicrosoftEdgeUpdate.exe" create file "%WINDIR%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache" "MicrosoftEdgeUpdate.exe" create file "%WINDIR%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies" "MicrosoftEdgeUpdate.exe" create file "%WINDIR%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History"60:T6440,"yuanbao_2.77.1.612_x64.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 6 sections"- Location: [%PROGRAMFILES%\(x86)\upload\uploa\yuanbao_2.77.1.612_x64.exe]- [targetUID: 00000000-00005176] "msedgeupdate.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdate.dll]- [targetUID: 00000000-00004704] "MicrosoftEdgeUpdateSetup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateSetup.exe]- [targetUID: 00000000-00003932] "report_helper.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 5 sections"- Location: [%WINDIR%\Temp\report_helper.exe]- [targetUID: 00000000-00001308] "irsetup.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%TEMP%\_ir_sf_temp_0\irsetup.exe]- [targetUID: 00000000-00006148] "ProductHelper.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\nsw9161.tmp\ProductHelper.dll]- [targetUID: 00000000-00006452] "psmachine_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\psmachine_64.dll]- [targetUID: 00000000-00008188] "psuser_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\psuser_64.dll]- [targetUID: 00000000-00003932] "psuser_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\psuser_arm64.dll]- [targetUID: 00000000-00003932] "psmachine_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\psmachine_arm64.dll]- [targetUID: 00000000-00003932] "psuser.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\psuser.dll]- [targetUID: 00000000-00003932] "psmachine.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\psmachine.dll]- [targetUID: 00000000-00004704] "MicrosoftEdgeUpdateCore.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateCore.exe]- [targetUID: 00000000-00003932] "INetC.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\nsw9161.tmp\INetC.dll]- [targetUID: 00000000-00006452] "MicrosoftEdgeUpdateComRegisterShell64.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe]- [targetUID: 00000000-00004704] "MicrosoftEdgeUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe]- [targetUID: 00000000-00004704] "MicrosoftEdgeComRegisterShellARM64.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) ARM64 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeComRegisterShellARM64.exe]- [targetUID: 00000000-00003932] "libcef.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\upload\uploa\libcef.dll]- [targetUID: 00000000-00005176] "WebProcess.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\upload\uploa\WebProcess.exe]- [targetUID: 00000000-00005176] "Web.exe" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\upload\uploa\Web.exe]- [targetUID: 00000000-00005176] "MicrosoftEdgeUpdateOnDemand.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateOnDemand.exe]- [targetUID: 00000000-00003932] "MicrosoftEdgeUpdateBroker.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateBroker.exe]- [targetUID: 00000000-00003932] "msedgeupdateres_ml.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ml.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_el.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_el.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_de.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_de.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_lb.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_lb.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_pl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_pl.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ca.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ca.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_fr-CA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_fr-CA.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_gd.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_gd.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ca-Es-VALENCIA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ca-Es-VALENCIA.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_fr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_fr.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_it.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_it.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_nl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_nl.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_fil.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_fil.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_or.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_or.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_bg.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_bg.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ka.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ka.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_bn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_bn.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_es-419.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_es-419.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_kn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_kn.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_sl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sl.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_hr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_hr.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_hu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_hu.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_sr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sr.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_bn-IN.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_bn-IN.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_mt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_mt.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_mk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_mk.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ro.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ro.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_az.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_az.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_af.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_af.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_sr-Cyrl-BA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sr-Cyrl-BA.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_gl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_gl.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_uk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_uk.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_eu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_eu.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_es.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_es.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ne.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ne.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_pa.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_pa.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_da.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_da.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ga.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ga.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_sr-Latn-RS.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sr-Latn-RS.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_nn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_nn.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_sv.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sv.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_gu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_gu.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ta.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ta.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_bs.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_bs.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_hi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_hi.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_lv.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_lv.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_pt-BR.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_pt-BR.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_te.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_te.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ur.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ur.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_as.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_as.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_sr-Cyrl-RS.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sr-Cyrl-RS.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_pt-PT.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_pt-PT.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_tr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_tr.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ru.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ru.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_fi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_fi.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_cy.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_cy.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ms.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ms.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_kk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_kk.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_mi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_mi.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_quz.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_quz.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_cs.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_cs.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_nb.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_nb.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_vi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_vi.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_mr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_mr.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_kok.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_kok.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_is.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_is.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_sq.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sq.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_sk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sk.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_lt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_lt.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_tt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_tt.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_et.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_et.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_id.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_id.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_fa.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_fa.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_th.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_th.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_en.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_en.dll]- [targetUID: 00000000-00007708] "msedgeupdateres_lo.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_lo.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_km.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_km.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_en-GB.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_en-GB.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ug.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ug.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ar.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ar.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_iw.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_iw.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_am.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_am.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ja.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ja.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ko.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ko.dll]- [targetUID: 00000000-00003932] "CopilotUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\CopilotUpdate.exe]- [targetUID: 00000000-00003932] "msedgeupdateres_zh-CN.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_zh-CN.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_zh-TW.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_zh-TW.dll]- [targetUID: 00000000-00003932] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsw9161.tmp\System.dll]- [targetUID: 00000000-00006452] "MicrosoftEdgeUpdate.log" has type "Unknown"- Location: [%ALLUSERSPROFILE%\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log]- [targetUID: 00000000-00004704] "irsetup.dat" has type "Unknown"- Location: [%TEMP%\_ir_sf_temp_0\irsetup.dat]- [targetUID: 00000000-00005176] "IRIMG2.JPG" has type "JPEG image data JFIF standard 1.02 aspect ratio density 100x100 segment length 16 progressive precision 8 166x312 components 3"- Location: [%TEMP%\_ir_sf_temp_0\IRIMG2.JPG]- [targetUID: 00000000-00005176] "modern-wizard.bmp" has type "PC bitmap Windows 3.x format 164 x 314 x 4 image size 26376 resolution 2834 x 2834 px/m cbSize 26494 bits offset 118"- Location: [%TEMP%\nsw9161.tmp\modern-wizard.bmp]- [targetUID: 00000000-00006452] "IRIMG1.JPG" has type "JPEG image data JFIF standard 1.02 aspect ratio density 100x100 segment length 16 progressive precision 8 111x63 components 3"- Location: [%TEMP%\_ir_sf_temp_0\IRIMG1.JPG]- [targetUID: 00000000-00005176] "af397ef28e484961ba48646a5d38cf54.db.ses" has type "Unknown"- Location: [%TEMP%\af397ef28e484961ba48646a5d38cf54.db.ses]- [targetUID: 00000000-00007912] "af397ef28e484961ba48646a5d38cf54.db.ses" has type "Unknown"- Location: [%WINDIR%\Temp\af397ef28e484961ba48646a5d38cf54.db.ses]- [targetUID: 00000000-00007912] "Process.JSON" has type "data"- Location: [%PROGRAMFILES%\(x86)\upload\uploa\Process.JSON]- [targetUID: 00000000-00005176] "urlref_httpsotheve.beacon.qq.comanalyticsv2_upload" has type "JSON text data"- [targetUID: N/A] "MicrosoftEdgeWebview2Setup_908350031_1.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%TEMP%\MicrosoftEdgeWebview2Setup_908350031_1.exe]- [targetUID: 00000000-00003932] "MicrosoftEdgeUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdate.exe]- [targetUID: 00000000-00004704] "CopilotUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\CopilotUpdate.exe]- [targetUID: 00000000-00003932]61:T64b,"yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\DLLNXOPTIONS"; Key: ""; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")62:T1443,"msedgeupdate.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdate.dll]- [targetUID: 00000000-00004704] "ProductHelper.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\nsw9161.tmp\ProductHelper.dll]- [targetUID: 00000000-00006452] "psmachine_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\psmachine_64.dll]- [targetUID: 00000000-00008188] "psuser_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\psuser_64.dll]- [targetUID: 00000000-00003932] "psuser_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\psuser_arm64.dll]- [targetUID: 00000000-00003932] "psmachine_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\psmachine_arm64.dll]- [targetUID: 00000000-00003932] "psuser.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\psuser.dll]- [targetUID: 00000000-00003932] "psmachine.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\psmachine.dll]- [targetUID: 00000000-00004704] "INetC.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\nsw9161.tmp\INetC.dll]- [targetUID: 00000000-00006452] "libcef.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\upload\uploa\libcef.dll]- [targetUID: 00000000-00005176] "msedgeupdateres_ml.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ml.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_el.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_el.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_de.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_de.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_lb.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_lb.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_pl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_pl.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ca.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ca.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_fr-CA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_fr-CA.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_gd.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_gd.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ca-Es-VALENCIA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ca-Es-VALENCIA.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_fr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_fr.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_it.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_it.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_nl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_nl.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_fil.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_fil.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_or.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_or.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_bg.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_bg.dll]- [targetUID: 00000000-00003932]63:Tc48,"yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "YUANBAO_V2.371_X64.EXE"; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "YUANBAO_V2.371_X64"; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "")64:T540,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Able to identify sandbox environment running process Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Calls an API typically used to find device information Matched sigs: Possibly tries to evade analysis by sleeping multiple times Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to query volume size Matched sigs: Contains ability to detect virtual environment (API)65:Tb12,"irsetup.exe" touched file "C:\Program Files (x86)\upload\uploa\libcef.dll" "irsetup.exe" touched file "C:\Program Files (x86)\upload\uploa\msvcp120.dll" "irsetup.exe" touched file "C:\Program Files (x86)\upload\uploa\msvcr120.dll" "irsetup.exe" touched file "C:\Program Files (x86)\upload\uploa\Process.JSON" "irsetup.exe" touched file "C:\Program Files (x86)\upload\uploa\Web.exe" "irsetup.exe" touched file "C:\Program Files (x86)\upload\uploa\WebProcess.exe" "irsetup.exe" touched file "C:\Program Files (x86)\upload\uploa\yuanbao_2.77.1.612_x64.exe" "MicrosoftEdgeWebview2Setup_908350031_1.exe" touched file "C:\Program Files (x86)\Microsoft" "MicrosoftEdgeWebview2Setup_908350031_1.exe" touched file "C:\Program Files (x86)\Microsoft\Temp" "MicrosoftEdgeWebview2Setup_908350031_1.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp" "MicrosoftEdgeWebview2Setup_908350031_1.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdate.exe" "MicrosoftEdgeWebview2Setup_908350031_1.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\CopilotUpdate.exe" "MicrosoftEdgeWebview2Setup_908350031_1.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdate.dll" "MicrosoftEdgeWebview2Setup_908350031_1.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateBroker.exe" "MicrosoftEdgeWebview2Setup_908350031_1.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateOnDemand.exe" "MicrosoftEdgeWebview2Setup_908350031_1.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe" "MicrosoftEdgeWebview2Setup_908350031_1.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeComRegisterShellARM64.exe" "MicrosoftEdgeWebview2Setup_908350031_1.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\psmachine.dll" "MicrosoftEdgeWebview2Setup_908350031_1.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\psmachine_64.dll" "MicrosoftEdgeWebview2Setup_908350031_1.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\psmachine_arm64.dll" "MicrosoftEdgeWebview2Setup_908350031_1.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\psuser.dll" "MicrosoftEdgeWebview2Setup_908350031_1.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\psuser_64.dll" "MicrosoftEdgeWebview2Setup_908350031_1.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\psuser_arm64.dll" "MicrosoftEdgeWebview2Setup_908350031_1.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\NOTICE.TXT" "MicrosoftEdgeWebview2Setup_908350031_1.exe" touched file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\EdgeUpdate.dat"66:T78d,"yuanbao_v2.371_x64.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "yuanbao_v2.371_x64.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "irsetup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "irsetup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "yuanbao_2.77.1.612_x64.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "yuanbao_2.77.1.612_x64.exe" touched file "C:\Windows\Temp" "yuanbao_2.77.1.612_x64.exe" touched file "C:\Windows\Temp\report_helper.exe" "yuanbao_2.77.1.612_x64.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "MicrosoftEdgeUpdate.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "MicrosoftEdgeUpdate.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "MicrosoftEdgeUpdate.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "MicrosoftEdgeUpdate.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "MicrosoftEdgeUpdate.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "MicrosoftEdgeUpdate.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "MicrosoftEdgeUpdate.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "MicrosoftEdgeUpdate.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "MicrosoftEdgeUpdate.exe" touched file "C:\Windows\Temp\af397ef28e484961ba48646a5d38cf54.db.ses" "MicrosoftEdgeUpdate.exe" touched file "C:\Windows\SysWOW64\config\systemprofile" "MicrosoftEdgeUpdate.exe" touched file "C:\Windows\SysWOW64\config\systemprofile\AppData\Local" "MicrosoftEdgeUpdate.exe" touched file "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache" "MicrosoftEdgeUpdate.exe" touched file "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies"67:T725,"yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\MSVCP140.DLL" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\FLTLIB.DLL" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\CLDAPI.DLL" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\CLDAPI.dll" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\AEPIC.DLL" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\AEPIC.dll" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\BCRYPT.DLL" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\bcrypt.dll" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\PROPSYS.DLL" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\PROPSYS.dll" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\EDPUTIL.DLL" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\edputil.dll" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\URLMON.DLL" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\urlmon.dll" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\iertutil.dll" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\MPR.DLL" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\MPR.dll"68:Ta09,"yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_IR_SF_TEMP_0" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe:ZONE.IDENTIFIER" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe:Zone.Identifier" "yuanbao_v2.371_x64.exe" trying to access non-existent file "C:\Windows\WinSxS\FileMaps\USERS_%OSUSER%_APPDATA_LOCAL_TEMP_IR_SF_TEMP_0_5EF253146017F52C.CDF-MS" "yuanbao_v2.371_x64.exe" trying to access non-existent file "\SystemRoot\WinSxS\FileMaps\users_%OSUSER%_appdata_local_temp_ir_sf_temp_0_5ef253146017f52c.cdf-ms" "irsetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\IRSETUP.EXE.LOCAL" "irsetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\WINSPOOL.DRV" "irsetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\IRSETUP.EXE.2.MANIFEST" "irsetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\IRSETUP.EXE.3.MANIFEST" "irsetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\IRSETUP.EXE.CONFIG" "irsetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\IRSETUP.DAT" "irsetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG" "irsetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.JPG" "irsetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "irsetup.exe" trying to access non-existent file "C:\ProgramData\Microsoft\DESKTOP.INI" "irsetup.exe" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "irsetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe.Local\" "irsetup.exe" trying to access non-existent file "C:\Program Files (x86)\UPLOAD" "irsetup.exe" trying to access non-existent file "C:\Program Files (x86)\upload\UPLOA" "irsetup.exe" trying to access non-existent file "C:\Program Files (x86)\upload\uploa\PROCESS.JSON" "irsetup.exe" trying to access non-existent file "C:\Program Files (x86)\upload\uploa\Process.JSON"69:T4d0,Observed import api "GetComputerNameExW" which can be "used to retrieve NetBIOS or DNS name associated of the local computer" [Source: msedgeupdate.dll] Observed import api "GetComputerNameExW" which can be "used to retrieve NetBIOS or DNS name associated of the local computer" [Source: psmachine_64.dll] Observed import api "GetComputerNameExW" which can be "used to retrieve NetBIOS or DNS name associated of the local computer" [Source: psuser_64.dll] Observed import api "GetComputerNameExW" which can be "used to retrieve NetBIOS or DNS name associated of the local computer" [Source: psuser_arm64.dll] Observed import api "GetComputerNameExW" which can be "used to retrieve NetBIOS or DNS name associated of the local computer" [Source: psmachine_arm64.dll] Observed import api "GetComputerNameExW" which can be "used to retrieve NetBIOS or DNS name associated of the local computer" [Source: psuser.dll] Observed import api "GetComputerNameExW" which can be "used to retrieve NetBIOS or DNS name associated of the local computer" [Source: psmachine.dll] Observed import api "GetComputerNameExW" which can be "used to retrieve NetBIOS or DNS name associated of the local computer" [Source: MicrosoftEdgeUpdateCore.exe]6a:Tc76,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found reference to API "CInternetConnection" (Indicator: "InternetConnect"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found reference to API ".?AVCInternetConnection@@" (Indicator: "InternetConnect"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00006452-00000C2C-1020125616") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00007912-00000C2C-1058331490") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00007912-00000C2C-1058849115") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00007912-00000C2C-1058849281") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00007912-00000C2C-1058849299") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00007912-00000C2C-1058849299") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00007912-00000C2C-1058849299") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00007912-00000C2C-1058849361") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00007912-00000C2C-1058849398") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00007912-00000C2C-1058849456") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00007912-00000C2C-1058849456") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00007912-00000C2C-1059500907") Found reference to API "WSAStartup failed (%d)" (Indicator: "WSAStartup"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "WSAStartup failed (%d)" (Indicator: "WSAStartup"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found reference to API "55596,6088,3237,,InternetReadFile,Wininet.dll,"00:34:24.234",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00002400.00000000.132170.04660000.00000004.mdmp")6b:T1cfa,Observed string: "curl: try 'curl --help' or 'curl --manual' for more information" (Indicator: "curl -") in Source: 60270-1308-00DFB2B0 Observed string: "curl 7.64.1 (i386-pc-win32) %s" (Indicator: "curl ") in Source: 60270-1344-00DFA920 Observed string: "IMAPS, LDAP, LDAPS, POP3, POP3S, RTMP, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET and TFTP). The command is designed to work without user interaction. curl offers a busload of useful tricks like proxy support, user" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "curl is powered by libcurl for all transfer-related features. See libcurl(3) for details.URL The URL syntax is protocol-dependent. You'll find a detailed descrip- tion in RFC 3986. You can specify multiple URL" (Indicator: "curl ") in Source: 60270-1345-00DF1000 Observed string: "try other protocols based on often-used host name prefixes. For exam- ple, for host names starting with "ftp." curl will assume you want to speak FTP. curl will do its best to use what you pass to it as a URL. It is not" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "left, etc. The progress meter displays number of bytes and the speeds are in bytes per second. The suffixes (k, M, G, T, P) are 1024 based. For example 1k is 1024 bytes. 1M is 1048576 bytes. curl displays this data to the" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "ter a completed transfer, the cache will be saved to the file name again if it has been modified. Specifiy a "" file name (zero length) to avoid loading/saving and make curl just handle the ca" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "(HTTP) Tells curl to figure out authentication method by itself, and use the most secure one the remote site claims to support. This is done by first doing a request and checking the response- head" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "(FTP SFTP) When used in an upload, this makes curl append to the target file instead of overwriting it. If the remote file doesn't exist, it will be created. Note that this flag is ig- nore" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "certificate(s) must be in PEM format. Normally curl is built to use a default file for this, so this option is typically used to alter that default file. curl recognizes the environment variable na" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "certs file named 'curl-ca-bundle.crt', either in the same direc- tory as curl.exe, or in the Current Working Directory, or in any folder along your PATH. If curl is built against the NSS SSL" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "then this option is supported for backward compatibility with other SSL engines, but it should not be set. If the option is not set, then curl will use the certificates in the system and user" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "verify the peer. Multiple paths can be provided by separating them with ":" (e.g. "path1:path2:path3"). The certificates must be in PEM format, and if curl is built against OpenSSL, the di- rect" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "(TLS) Tells curl what type the provided client certificate is using. PEM, DER, ENG and P12 are recognized types. If not spec- ified, PEM is assumed. If this option is used several times, the las" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "See -E, --cert and --key to specify them independently. If curl is built against the NSS SSL library then this option can tell curl the nickname of the certificate to use within the NSS databas" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "If curl is built against OpenSSL library, and the engine pkcs11 is available, then a PKCS#11 URI (RFC 7512) can be used to spec- ify a certificate located in a PKCS#11 device. A string begin- ning" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "set as "ENG" if none was provided. (iOS and macOS only) If curl is built against Secure Transport, then the certificate string can either be the name of a certifi- cate/private key in the system o" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "Specify a text file to read curl arguments from. The command line arguments found in the text file will be used as if they were provided on the command line. Options and their parameters mus" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "fig file is checked for in the following places in this order: 1) curl tries to find the "home dir": It first checks for the CURL_HOME and then the HOME environment variables. Failing that, it u" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "PROFILE%\Application Data'. 2) On windows, if there is no _curlrc file in the home dir, it checks for one in the same dir the curl executable is placed. On Unix-like systems, it will simply try to" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "take. This only limits the connection phase, so if curl con- nects within the given period it will continue - if not it will exit. Since version 7.32.0, this option accepts decimal values. If t" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "FTP server command SIZE will not be used by curl. Use "-C -" to tell curl to automatically find out where/how to resume the transfer. It then uses the given output/input files to figure that out" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "after a completed operation. Curl writes all cookies from its in-memory cookie storage to the given file at the end of opera- tions. If no cookies are known, no data will be written. The file" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "This command line option will activate the cookie engine that makes curl record and use cookies. Another way to activate it is to use the -b, --cookie option. If the cookie jar can't be created o" (Indicator: " curl ") in Source: 60270-1345-00DF1000 Observed string: "transfers on the same invoke. If the file name is exactly a mi- nus ("-"), curl will instead the contents from stdin. The file format of the file to read cookies from should be plain HTTP headers" (Indicator: " curl ") in Source: 60270-1345-00DF10006c:T10da,Found string "smtp." (Indicator: "smtp"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "Got unexpected smtp-server response: %d" (Indicator: "smtp"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "IMAPS, LDAP, LDAPS, POP3, POP3S, RTMP, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET and TFTP). The command is designed to work without user interaction. curl offers a busload of useful tricks like proxy support, user" (Indicator: "smtp"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "--form-string (HTTP SMTP IMAP) Similar to -F, --form except that the value string for the named parameter is used literally. Leading '@' and '<' characters, and the ';type=' string in t" (Indicator: "smtp"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "See also -F, --form. -F, --form (HTTP SMTP IMAP) For HTTP protocol family, this lets curl emu- late a filled-in form in which a user has pressed the submit button. This c" (Indicator: "smtp"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "sage and a base64 attached file: curl -F '=text message;encoder=quoted-printable' \ -F '=@localfile;encoder=base64' ... smtp://example.com See further examples and details in the MANUAL." (Indicator: "smtp"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "that: --post301, --post302 and --post303. --login-options (IMAP POP3 SMTP) Specify the login options to use during server authentication. You can use the login options to specif" (Indicator: "smtp"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "about the login options please see RFC 2384, RFC 5092 and IETF draft draft-earhart-url-smtp-00.txt If this option is used several times, the last one will be used. Added in 7.34.0. --mail" (Indicator: "smtp"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "See also --mail-rcpt and --mail-from. Added in 7.25.0. --mail-from

(SMTP) Specify a single address that the given mail should get sent from. See also --mail-rcpt and --mail-auth." (Indicator: "smtp"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "(IMAP POP3 SMTP) Specify the Bearer Token for OAUTH 2.0 server authentication. The Bearer Token is used in conjunction with the user name which can be specified as part of the --url or -u, --us" (Indicator: "smtp"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "(Added in 7.30.0) (SMTP) Specifies a custom SMTP command to use instead of HELP or VRFY. (Added in 7.34.0) If this option is used several times, the last one will be used. --resolve [:port] Sets the proxy server to use if no protocol-specific prox" (Indicator: "smtp"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp")6d:T10c5,Found reference to API "-- Call this function at the end after all other On Shutdown actions.-- This will cause the system to be rebooted, if needed.-- Defined in _SUF70_Global_Functions.lua-- Do not edit this script unless you know what your are doingg_HandleSystemReb" (Indicator: " shutdown "; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found reference to API "gethostname" (Indicator: "gethostname"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found reference to API "-- Call this function at the end after all other On Shutdown actions.-- This will cause the system to be rebooted, if needed.-- Defined in _SUF70_Global_Functions.lua-- Do not edit this script unless you know what your are doingg_HandleSystemReboot();" (Indicator: " shutdown "; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found reference to API "d to send message." (Indicator: " send "; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found reference to API "Failed to send SSPI authentication token." (Indicator: " send "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "Failed to send SSPI authentication request." (Indicator: " send "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "Failed to send SSPI encryption type." (Indicator: " send "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "Failed to send SSPI encryption request." (Indicator: " send "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "allocate connect buffer!" (Indicator: " connect "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "Failed sending CONNECT to proxy" (Indicator: " connect "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "Ignoring Content-Length in CONNECT %03d response" (Indicator: " connect "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "Ignoring Transfer-Encoding in CONNECT %03d response" (Indicator: " connect "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "Proxy CONNECT connection closed" (Indicator: " connect "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "Proxy CONNECT aborted" (Indicator: " connect "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "Proxy CONNECT aborted due to timeout" (Indicator: " connect "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "Proxy replied %d to CONNECT request" (Indicator: " connect "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "Ready to accept data connection from server" (Indicator: " accept "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "After %ldms connect time, move on!" (Indicator: " connect "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "Failed to connect to %s port %ld: %s" (Indicator: " connect "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "SOCKS4 connect to IPv4 %s (locally resolved)" (Indicator: " connect "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "Failed to send SOCKS4 connect request." (Indicator: " connect "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found reference to API "Failed to send SOCKS4 connect request." (Indicator: " send "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp")6e:T10d0,Found string "HTTP/1.0" (Indicator: "HTTP/1.0"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found string "HTTP/1.0 proxy connection set to keep alive!" (Indicator: "HTTP/1.0"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "HTTP/1.1 proxy connection set close!" (Indicator: "HTTP/1.1"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "HTTP/1.0 connection set to keep alive!" (Indicator: "HTTP/1.0"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "Forcing HTTP/1.1 for NTLM" (Indicator: "HTTP/1.1"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "HTTP/2 without HTTP/1.1 Upgrade. It requires prior knowledge that the server supports HTTP/2 straight away. HTTPS requests will still do HTTP/2 the standard way with negotiated protocol vers" (Indicator: "HTTP/1.1"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "for SSL connections. See also the --egd-file option. -r, --range (HTTP FTP SFTP FILE) Retrieve a byte range (i.e. a partial docu- ment) from an HTTP/1.1, FTP or SFTP server or a local FILE." (Indicator: "HTTP/1.1"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00001172.00000000.134495.034B0000.00000004.mdmp, 00000000-00001172.00000000.134495.05150000.00000004.mdmp") Found string "POST /OneCollector/1.0/ HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001172.00000000.134495.05150000.00000004.mdmp") Found string "Content-Length1746POST /OneCollector/1.0/ HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001172.00000000.134495.05150000.00000004.mdmp") Found string "eCollector/1.0/ HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001172.00000000.134495.05150000.00000004.mdmp") Found string "You should also be aware that many HTTP/1.1 servers do not have" (Indicator: "HTTP/1.1"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "ment) from an HTTP/1.1, FTP or SFTP server or a local FILE." (Indicator: "HTTP/1.1"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "HTTP/2 without HTTP/1.1 Upgrade. It requires prior knowledge" (Indicator: "HTTP/1.1"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "at least HTTP/1.0 unless this option is used." (Indicator: "HTTP/1.0"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "Use HTTP/1.0 proxy on given port" (Indicator: "HTTP/1.0"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "Use HTTP 2 without HTTP/1.1 Upgrade" (Indicator: "HTTP/1.1"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "Forcing HTTP/1.1 for NTLM" (Indicator: "HTTP/1.1"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "HTTP/1.0 connection set to keep alive!" (Indicator: "HTTP/1.0"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "HTTP/1.1 proxy connection set close!" (Indicator: "HTTP/1.1"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "HTTP/1.0 proxy connection set to keep alive!" (Indicator: "HTTP/1.0"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00002400.00000000.132170.02730000.00000004.mdmp, 00000000-00002400.00000000.132170.04660000.00000004.mdmp, 00000000-00002400.00000001.134088.027E1000.00000004.mdmp, 00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "POST /OneCollector/1.0/ HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002400.00000000.132170.04660000.00000004.mdmp") Found string "Content-Length1746POST /OneCollector/1.0/ HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002400.00000000.132170.04660000.00000004.mdmp") Found string "HTTP/1.1 200 OKO" (Indicator: "HTTP/1.1"; Source: "00000000-00002400.00000000.132170.04660000.00000004.mdmp, 00000000-00002400.00000001.134088.04660000.00000004.mdmp")6f:Tf98,Found string "# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "## Fatal libcurl error" (Indicator: "libcurl"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision." (Indicator: "libcurl"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "A libcurl function was given a bad argument" (Indicator: "libcurl"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "An unknown option was passed in to libcurl" (Indicator: "libcurl"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "CLIENT libcurl 7.64.1%sQUIT" (Indicator: "libcurl"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "CLIENT libcurl 7.64.1DEFINE %s %sQUIT" (Indicator: "libcurl"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "CLIENT libcurl 7.64.1MATCH %s %s %sQUIT" (Indicator: "libcurl"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "Unrecognized content encoding type. libcurl understands %s content encodings." (Indicator: "libcurl"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support." (Indicator: "libcurl"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "Protocol "%s" not supported or disabled in libcurl" (Indicator: "libcurl"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "curl_easy_setopt(hnd, %s, slist%d);" (Indicator: "curl_easy_setopt"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "slist%d = curl_slist_append(slist%d, "%s");" (Indicator: "curl_slist_append"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "curl_easy_setopt(hnd, %s, mime%d);" (Indicator: "curl_easy_setopt"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "part%d = curl_mime_addpart(mime%d);" (Indicator: "curl_mime_addpart"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "curl_easy_setopt(hnd, %s," (Indicator: "curl_easy_setopt"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "curl_easy_setopt(hnd, %s, %ldL);" (Indicator: "curl_easy_setopt"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "curl_easy_setopt(hnd, %s, (long)%s);" (Indicator: "curl_easy_setopt"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "the installed libcurl version doesn't support this" (Indicator: "libcurl"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "a specified protocol is unsupported by libcurl" (Indicator: "libcurl"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "Illegal date format for -z, --time-cond (and not a file name). Disabling time condition. See curl_getdate(3) for valid date syntax." (Indicator: "curl_getdate"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "Failed to open %s to write libcurl code!" (Indicator: "libcurl"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "ignoring %s, not supported by libcurl" (Indicator: "libcurl"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "curl_easy_setopt(hnd, %s, "%s");" (Indicator: "curl_easy_setopt"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "curl_easy_setopt(hnd, %s, %s);" (Indicator: "curl_easy_setopt"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp")70:Ta87,Found string "SSL peer certificate or SSH remote key was not OK" (Indicator: " ssh "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "Error in the SSH layer" (Indicator: " ssh "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "(SCP SFTP) Enables built-in SSH compression. This is a request, not an order; the server may or may not do it. Added in 7.56.0. --compressed (HTTP) Request a compressed response using one o" (Indicator: " ssh "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "Usage help. This lists all current command line options with a short description. --hostpubmd5 (SFTP SCP) Pass a string containing 32 hexadecimal digits. The string should be the 1" (Indicator: "--host"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "51 The peer's SSL certificate or SSH MD5 fingerprint was not OK. 52 The server didn't reply anything, which here is considered an error. 53 SSL crypto engine not found. 54 Cannot set SSL cryp" (Indicator: " ssh "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "78 The resource referenced in the URL does not exist. 79 An unspecified error occurred during the SSH session. 80 Failed to shut down the SSL connection. 82 Could not load CRL file, missing or wrong forma" (Indicator: " ssh "; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "79 An unspecified error occurred during the SSH session." (Indicator: " ssh "; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "51 The peer's SSL certificate or SSH MD5 fingerprint was not OK." (Indicator: " ssh "; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "--hostpubmd5 " (Indicator: "--host"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "(SCP SFTP) Enables built-in SSH compression. This is a request," (Indicator: " ssh "; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "Enable SSH compression" (Indicator: " ssh "; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "Error in the SSH layer" (Indicator: " ssh "; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "SSL peer certificate or SSH remote key was not OK" (Indicator: " ssh "; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp")71:Tbce,Observed string: "libcurl to be linked against a copy of libssh2 1.2.8 or higher that is itself linked against OpenSSL.) -Q, --quote (FTP SFTP) Send an arbitrary command to the remote FTP or SFTP server." (Indicator: " sftp ") in Source: 60270-1345-00DF1000 Observed string: "rect FTP commands as RFC 959 defines to FTP servers, or one of the commands listed below to SFTP servers. This option can be used multiple times. When speaking to an FTP server, prefix the com" (Indicator: " sftp ") in Source: 60270-1345-00DF1000 Observed string: "quote commands itself before sending them to the server. File names may be quoted shell-style to embed spaces or special char- acters. Following is the list of all supported SFTP quote com- mand" (Indicator: " sftp ") in Source: 60270-1345-00DF1000 Observed string: "for SSL connections. See also the --egd-file option. -r, --range (HTTP FTP SFTP FILE) Retrieve a byte range (i.e. a partial docu- ment) from an HTTP/1.1, FTP or SFTP server or a local FILE." (Indicator: " sftp ") in Source: 60270-1345-00DF1000 Observed string: "FTP and SFTP range downloads only support the simple 'start- stop' syntax (optionally with one of the numbers omitted). FTP use depends on the extended FTP command SIZE. If this option is used" (Indicator: " sftp ") in Source: 60270-1345-00DF1000 Observed string: "FTP and SFTP range downloads only support the simple 'start-" (Indicator: " sftp ") in Source: 00000000-00001308.00000000.128651.00E63000.00000002.mdmp Observed string: "(HTTP FTP SFTP FILE) Retrieve a byte range (i.e. a partial docu-" (Indicator: " sftp ") in Source: 00000000-00001308.00000000.128651.00E63000.00000002.mdmp Observed string: "ment) from an HTTP/1.1, FTP or SFTP server or a local FILE." (Indicator: " sftp ") in Source: 00000000-00001308.00000000.128651.00E63000.00000002.mdmp Observed string: "acters. Following is the list of all supported SFTP quote com-" (Indicator: " sftp ") in Source: 00000000-00001308.00000000.128651.00E63000.00000002.mdmp Observed string: "the commands listed below to SFTP servers." (Indicator: " sftp ") in Source: 00000000-00001308.00000000.128651.00E63000.00000002.mdmp Observed string: "SFTP is a binary protocol. Unlike for FTP, curl interprets SFTP" (Indicator: "sftp ") in Source: 00000000-00001308.00000000.128651.00E63000.00000002.mdmp Observed string: "(FTP SFTP) When an FTP or SFTP URL/operation uses a path that" (Indicator: " sftp ") in Source: 00000000-00001308.00000000.128651.00E63000.00000002.mdmp Observed string: "nored by some SFTP servers (including OpenSSH)." (Indicator: " sftp ") in Source: 00000000-00001308.00000000.128651.00E63000.00000002.mdmp Observed string: "sftp" (Indicator: "sftp") in Source: 00000000-00001308.00000000.128651.00E63000.00000002.mdmp72:T7e7,Found string "+ncalrpc:[OLE6532348352C3B379955075A9608D]" (Indicator: "ncalrpc"; Source: "00000000-00001172.00000000.134495.034B0000.00000004.mdmp") Found string "+ncalrpc:[OLE7395597A752F2DC763FED3B23618]" (Indicator: "ncalrpc"; Source: "00000000-00001172.00000000.134495.034B0000.00000004.mdmp") Found string "+ncalrpc:[OLE08B3059F548C10D103AE1F8EF2C9]" (Indicator: "ncalrpc"; Source: "00000000-00001172.00000000.134495.034B0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001172.00000000.134495.034B0000.00000004.mdmp") Found string "+ncalrpc:[OLED1D58B976303F33B6CEF7F73730D]" (Indicator: "ncalrpc"; Source: "00000000-00002400.00000000.132170.02730000.00000004.mdmp, 00000000-00002400.00000001.134088.02730000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002400.00000000.132170.02730000.00000004.mdmp, 00000000-00002400.00000001.134088.02730000.00000004.mdmp") Found string "+ncalrpc:[OLE08B3059F548C10D103AE1F8EF2C9]" (Indicator: "ncalrpc"; Source: "00000000-00002400.00000000.132170.02730000.00000004.mdmp, 00000000-00002400.00000001.134088.02730000.00000004.mdmp, 00000000-00002400.00000001.134088.027E1000.00000004.mdmp") Found string "+ncalrpc:[OLE7395597A752F2DC763FED3B23618]" (Indicator: "ncalrpc"; Source: "00000000-00002400.00000000.132170.02730000.00000004.mdmp, 00000000-00002400.00000001.134088.02730000.00000004.mdmp") Found string "I+ncalrpc:[OLE08B3059F548C10D103AE1F8EF2C9]" (Indicator: "ncalrpc"; Source: "00000000-00002400.00000001.134088.02730000.00000004.mdmp") Found string "I+ncalrpc:[OLEE" (Indicator: "ncalrpc"; Source: "00000000-00002400.00000001.134088.02730000.00000004.mdmp") Found string "ncacn_np" (Indicator: "ncacn_np"; Source: "00000000-00003044.00000000.129665.009C0000.00000004.mdmp, 00000000-00003044.00000001.131585.009C0000.00000004.mdmp, 00000000-00003044.00000002.133504.009C0000.00000004.mdmp")73:Tebc,Found string "Kerberos" (Indicator: "kerberos"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "to delegate when it comes to user credentials. none Don't allow any delegation. policy Delegates if and only if the OK-AS-DELEGATE flag is set in the Kerberos service ticket, which" (Indicator: "kerberos"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "cleared. Such sensitive data should be retrieved from a file in- stead or similar and never used in clear text in a command line. When using Kerberos V5 with a Windows based server you should incl" (Indicator: "kerberos"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string ":\WINDOWS\SysWOW64\Kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00001172.00000000.134495.034B0000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00001172.00000000.134495.034B0000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00001172.00000000.134495.034B0000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00001172.00000000.134495.034B0000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00001308.00000000.128651.009A0000.00000004.mdmp") Found string ":\WINDOWS\SysWOW64\Kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00001308.00000000.128651.009A0000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00001308.00000000.128651.009A0000.00000004.mdmp, 00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00001308.00000000.128651.009A0000.00000004.mdmp") Found string "When using Kerberos V5 with a Windows based server you should" (Indicator: "kerberos"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "the server to successfully obtain a Kerberos Ticket. If you" (Indicator: "kerberos"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "Kerberos." (Indicator: "kerberos"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "(FTP) Enable Kerberos authentication and use. The level must be" (Indicator: "kerberos"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "in the Kerberos service ticket, which is a matter of" (Indicator: "kerberos"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "(GSS/kerberos) Set LEVEL to tell the server what it is allowed" (Indicator: "kerberos"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "Enable Kerberos with security " (Indicator: "kerberos"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002400.00000000.132170.02730000.00000004.mdmp, 00000000-00002400.00000001.134088.02730000.00000004.mdmp") Found string ":\WINDOWS\SysWOW64\Kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00002400.00000000.132170.02730000.00000004.mdmp, 00000000-00002400.00000001.134088.02730000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002400.00000000.132170.02730000.00000004.mdmp, 00000000-00002400.00000001.134088.02730000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00002400.00000000.132170.02730000.00000004.mdmp, 00000000-00002400.00000001.134088.02730000.00000004.mdmp")74:T9de,Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: yuanbao_v2.371_x64.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: msedgeupdate.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: report_helper.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: ProductHelper.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: psmachine_64.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: psuser_64.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: psuser_arm64.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: psmachine_arm64.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: psuser.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: psmachine.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: MicrosoftEdgeUpdateComRegisterShell64.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: MicrosoftEdgeUpdate.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: MicrosoftEdgeComRegisterShellARM64.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: libcef.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: MicrosoftEdgeUpdateOnDemand.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: MicrosoftEdgeUpdateBroker.exe]75:T9d1,"irsetup.exe" called "FindFirstFileA" with parameter %TEMP%\_ir_sf_temp_0\irsetup.exe (UID: 00000000-00005176) "irsetup.exe" called "FindFirstFileA" with parameter C:\yuanbao_v2.371_x64.exe (UID: 00000000-00005176) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\upload\uploa\libcef.dll (UID: 00000000-00005176) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\upload\uploa\msvcp120.dll (UID: 00000000-00005176) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\upload\uploa\msvcr120.dll (UID: 00000000-00005176) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\upload\uploa\Process.JSON (UID: 00000000-00005176) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\upload\uploa\Web.exe (UID: 00000000-00005176) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\upload\uploa\WebProcess.exe (UID: 00000000-00005176) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\upload\uploa\yuanbao_2.77.1.612_x64.exe (UID: 00000000-00005176) "yuanbao_2.77.1.612_x64.exe" called "FindFirstFileW" with parameter %TEMP%\nsw9161.tmp (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\Tencent\Yuanbao (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\Tencent (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "FindFirstFileW" with parameter C:\Program Files (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "FindFirstFileW" with parameter %TEMP%\MicrosoftEdgeWebview2Setup_908350031_1.exe (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "FindFirstFileW" with parameter C:\Users\%OSUSER% (UID: 00000000-00006452) "yuanbao_2.77.1.612_x64.exe" called "FindFirstFileW" with parameter C:\Users (UID: 00000000-00006452) "MicrosoftEdgeUpdate.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\*.* (UID: 00000000-00003044) "MicrosoftEdgeUpdate.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003044)76:T848,"irsetup.exe" called "GetDriveTypeA" with parameter C:\ (UID: 00000000-00005176) "WebProcess.exe" called "GetDriveTypeW" with parameter B:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter D:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter E:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter F:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter G:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter H:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter I:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter J:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter K:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter L:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter M:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter N:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter O:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter P:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter Q:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter R:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter S:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter T:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter U:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter V:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter W:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter X:\ (UID: 00000000-00006212) "WebProcess.exe" called "GetDriveTypeW" with parameter Y:\ (UID: 00000000-00006212)77:Tc0c,file/memory contains long string with (Indicator: "aes"; File: "msedgeupdateres_sr.dll") Found string "IRBlowfish" (Indicator: "blowfish"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found string "Base64EncodeToFile" (Indicator: "base64"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found string "Base64EncodeToString" (Indicator: "base64"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found string "Base64DecodeFromFile" (Indicator: "base64"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found string "Base64DecodeFromString" (Indicator: "base64"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found string "BlowfishEncrypt" (Indicator: "blowfish"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found string "BlowfishDecrypt" (Indicator: "blowfish"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found string "BlowfishEncryptString" (Indicator: "blowfish"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found string "BlowfishDecryptString" (Indicator: "blowfish"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found string "ERR_CRYPTO_INVALID_BASE64_STRING" (Indicator: "base64"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found string "ERR_CRYPTO_ERROR_DECODING_BASE64_STRING" (Indicator: "base64"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found string "ERR_CRYPTO_INVALID_BLOWFISH_HEADER" (Indicator: "blowfish"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found string "ERR_CRYPTO_INCOMPATIBLE_BLOWFISH_FILE" (Indicator: "blowfish"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found string "@INCOMPATIBLE_BLOWFISH_FILE" (Indicator: "blowfish"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found string "@INVALID_BLOWFISH_HEADER" (Indicator: "blowfish"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found string "@ERROR_DECODING_BASE64_STRING" (Indicator: "base64"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found string "@INVALID_BASE64_STRING" (Indicator: "base64"; File: "00000000-00005176.00000001.128114.00401000.00000040.mdmp") Found string "7zAES" (Indicator: "aes"; File: "00000000-00006452.00000000.128421.00401000.00000020.mdmp") Found string "CALG_3DES_112" (Indicator: "3des"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "CALG_3DES" (Indicator: "3des"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "CALG_AES_128" (Indicator: "aes"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "CALG_AES_192" (Indicator: "aes"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "CALG_AES_256" (Indicator: "aes"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "CALG_AES" (Indicator: "aes"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp")78:T1acc,Found string "CRC Failed in encrypted file. Wrong password?" (Indicator: "password"; File: "00000000-00006452.00000000.128421.00401000.00000020.mdmp") Found string "Data Error in encrypted file. Wrong password?" (Indicator: "password"; File: "00000000-00006452.00000000.128421.00401000.00000020.mdmp") Found string "Wrong password" (Indicator: "password"; File: "00000000-00006452.00000000.128421.00401000.00000020.mdmp") Found string "Can not open encrypted archive. Wrong password?" (Indicator: "password"; File: "00000000-00006452.00000000.128421.00401000.00000020.mdmp") Found string "Enter password (will not be echoed):" (Indicator: "password"; File: "00000000-00006452.00000000.128421.00401000.00000020.mdmp") Found string "Enter password:" (Indicator: "password"; File: "00000000-00006452.00000000.128421.00401000.00000020.mdmp") Found string "password" (Indicator: "password"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "Enter %s password for user '%s':" (Indicator: "password"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "Enter %s password for user '%s' on URL #%zu:" (Indicator: "password"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "cation scheme that prevents the password from being sent over the wire in clear text. Use this in combination with the normal -u, --user option to set user name and password. If this option i" (Indicator: "password"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "(FTP) When an FTP server asks for "account data" after user name and password has been provided, this data is sent off using the ACCT command. If this option is used several times, the last one wil" (Indicator: "password"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "connection setup failures. Added in 7.15.2. --location-trusted (HTTP) Like -L, --location, but will allow sending the name + password to all hosts that the site may redirect to. This may" (Indicator: "password"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "thentication is used, curl only sends its credentials to the initial host. If a redirect takes curl to a different host, it won't be able to intercept the user+password. See also --loca- tion" (Indicator: "password"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "user's home directory for login name and password. This is typi- cally used for FTP on Unix. If used with HTTP, curl will enable user authentication. See netrc(5) ftp(1) for details on the file form" (Indicator: "password"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "A quick and very simple example of how to setup a .netrc to al- low curl to FTP to the machine host.domain.com with user name 'myself' and password 'secret' should look similar to: machine host." (Indicator: "password"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "A quick and very simple example of how to setup a .netrc to al- low curl to FTP to the machine host.domain.com with user name 'myself' and password 'secret' should look similar to: machine host." (Indicator: "secret"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "gotiate or NTLM authentication then you can tell curl to select the user name and password from your environment by specifying a single colon with this option: "-U :". On systems where it works, cu" (Indicator: "password"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "Tells curl to use username/password authentication when connect- ing to a SOCKS5 proxy. The username/password authentication is enabled by default. Use --socks5-gssapi to force GSS-API au- then" (Indicator: "password"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "SOCKS5 proxy. The GSS-API authentication is enabled by default (if curl is compiled with GSS-API support). Use --socks5-basic to force username/password authentication to SOCKS5 proxies. Added i" (Indicator: "password"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "--tlspassword are specified but --tlsauthtype is not, then this option defaults to "SRP". This option works only if the under- lying libcurl is built with TLS-SRP support, which requires Open" (Indicator: "password"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "Added in 7.21.4. --tlsuser Set username for use with the TLS authentication method speci- fied with --tlsauthtype. Requires that --tlspassword also is set. Added i" (Indicator: "password"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "If this option is used several times, the last one will be used. -u, --user Specify the user name and password to use for server authentica- tion. Overrides -n, --netrc and --netrc-optional" (Indicator: "password"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "which makes it impossible to use a colon in the user name with this option. The password can, still. On systems where it works, curl will hide the given option argu- ment from process listings. Th" (Indicator: "password"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "beros V5, Negotiate, NTLM or Digest authentication then you can tell curl to select the user name and password from your envi- ronment by specifying a single colon with this option: "-u :". If th" (Indicator: "password"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)" (Indicator: "password"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "67 The user name, password, or similar was not accepted and curl" (Indicator: "password"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp")79:Te7f,Found string "schannel: connection hostname (%s) validated against certificate name (%s)" (Indicator: "hostname"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "schannel: connection hostname (%s) did not match against certificate name (%s)" (Indicator: "hostname"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names" (Indicator: "hostname"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "Hostname %s was found in DNS cache" (Indicator: "hostname"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "Hostname in DNS cache was stale, zapped" (Indicator: "hostname"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "Hostname '%s' was found in DNS cache" (Indicator: "hostname"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "in this list is matched as either a domain which contains the hostname, or the hostname itself. For example, local.com would match local.com, local.com:80, and www.local.com, but not www." (Indicator: "hostname"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "This option overrides any previous use of -x, --proxy, as they are mutually exclusive. Since 7.21.7, this option is superfluous since you can specify a socks5 hostname proxy with -x, --proxy using" (Indicator: "hostname"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "list is matched as either a domain name which contains the host- name, or the hostname itself. This environment variable disables use of the proxy even when specified with the -x, --proxy op" (Indicator: "hostname"; File: "00000000-00001308.00000000.128651.00DF1000.00000020.mdmp") Found string "name, or the hostname itself." (Indicator: "hostname"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "socks5 hostname proxy with -x, --proxy using a socks5h:// proto-" (Indicator: "hostname"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "hostname, or the hostname itself. For example, local.com would" (Indicator: "hostname"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "of using the network. Note: netstat shows the path of an ab-" (Indicator: "netstat"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "Hostname in DNS cache was stale, zapped" (Indicator: "hostname"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "Hostname %s was found in DNS cache" (Indicator: "hostname"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "Hostname '%s' was found in DNS cache" (Indicator: "hostname"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names" (Indicator: "hostname"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "schannel: connection hostname (%s) did not match against certificate name (%s)" (Indicator: "hostname"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp") Found string "schannel: connection hostname (%s) validated against certificate name (%s)" (Indicator: "hostname"; Source: "00000000-00001308.00000000.128651.00E63000.00000002.mdmp")7a:T1022,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001172.00000000.134495.034B0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Temp\report_helper.exe" (Indicator: "\Device\"; Source: "00000000-00001308.00000000.128651.009A0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002400.00000000.132170.02730000.00000004.mdmp, 00000000-00002400.00000001.134088.02730000.00000004.mdmp") Found string "\DEVICE\TCPIP_{2DAE8188-0637-11EE-9C2C-DD6C59A86FB5}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "\DEVICE\TCPIP_{61A21EA1-964A-11F1-9C5A-806E6F6E6963}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "\DEVICE\TCPIP_{61A21EA2-964A-11F1-9C5A-806E6F6E6963}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "\DEVICE\TCPIP_{61A21F69-964A-11F1-9C5A-00505691FABF}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "\DEVICE\TCPIP_{E6AF3BD5-60B2-11ED-9C1B-080027605900}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "\DEVICE\TCPIP_{61A21F6A-964A-11F1-9C5A-00505691FABF}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "\DEVICE\TCPIP_{61A21F6C-964A-11F1-9C5A-00505691FABF}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "\DEVICE\TCPIP_{E6AF3BCD-60B2-11ED-9C1B-080027605900}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "Local Area Connection* 8-WFP Native MAC Layer LightWe\DEVICE\TCPIP_{61A21F6D-964A-11F1-9C5A-00505691FABF}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "\DEVICE\TCPIP_{61A21F71-964A-11F1-9C5A-00505691FABF}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "\DEVICE\TCPIP_{E6AF3BCC-60B2-11ED-9C1B-080027605900}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "\DEVICE\TCPIP_{61A21F73-964A-11F1-9C5A-00505691FABF}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "\DEVICE\TCPIP_{26B11A49-585F-4B43-A90C-9AF3C3D7B25B}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "rLocal Area Connection* 9-Np\DEVICE\TCPIP_{E712CB97-6066-4A95-9107-EF68F40F8718}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "\DEVICE\TCPIP_{F9ECCD21-82B7-4739-990D-04AD74FC3679}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "\DEVICE\TCPIP_{E700981E-49E1-48E2-9BA1-07573726CBA3}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "\DEVICE\TCPIP_{67B97C77-0C14-48EA-B347-E740255C3221}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "\DEVICE\TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "0L\DEVICE\TCPIP_{BFAC8B09-2F8C-4DBA-9C0C-7D8BC388A7A2}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "\DEVICE\TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "\DEVICE\TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp") Found string "\DEVICE\TCPIP_{830B4C59-869C-4C3F-86EF-1606D2B3AC11}" (Indicator: "\Device\"; Source: "00000000-00002400.00000001.134088.04660000.00000004.mdmp")7b:T482,"WebProcess.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "yuanbao_2.77.1.612_x64.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "report_helper.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "MicrosoftEdgeUpdate.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION\EDGEUPDATE") "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION\EDGEUPDATE"; Key: "EVENTMESSAGEFILE"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll"), "MicrosoftEdgeUpdate.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION\EDGEUPDATEM"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION\EDGEUPDATEM"; Key: "EVENTMESSAGEFILE"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll"), "MicrosoftEdgeUpdate.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS")7c:T22db,Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: yuanbao_v2.371_x64.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "GetSecurityDescriptorLength" which can "return the length in bytes of a structurally valid security descriptor" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "MakeSelfRelativeSD" which can "create a security descriptor in self-relative format by using a security descriptor in absolute format as a template" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: MicrosoftEdgeUpdateSetup.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: irsetup.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: ProductHelper.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: ProductHelper.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: ProductHelper.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: ProductHelper.dll] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSecurityDescriptorLength" which can "return the length in bytes of a structurally valid security descriptor" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "ImpersonateLoggedOnUser" which can "let the calling thread impersonate the security context of a logged-on user" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "MakeSelfRelativeSD" which can "create a security descriptor in self-relative format by using a security descriptor in absolute format as a template" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: MicrosoftEdgeUpdateCore.exe]7d:T9d7,"yuanbao_v2.371_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\_IR_SF_TEMP_0\IRSETUP.EXE"; Value: "") "irsetup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\UPLOAD\UPLOA\WEBPROCESS.EXE"; Value: ""), "irsetup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\UPLOAD\UPLOA\YUANBAO_2.77.1.612_X64.EXE"; Value: ""), "WebProcess.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: ""), "WebProcess.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: ""), "WebProcess.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: ""), "WebProcess.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: ""), "WebProcess.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: ""), "WebProcess.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: ""), "WebProcess.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: ""), "WebProcess.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: ""), "WebProcess.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: ""), "WebProcess.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: ""), "WebProcess.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: ""), "WebProcess.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "")7e:T172c1,"yuanbao_v2.371_x64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "C20C000000000000040004000102040000000000630000000D787900010000006B507E000200000087DE830069000000A19F5E000400010000004B00000056737D00070000006B507E00010000009829B70007000000E6C531000100040000001F0000001A9CB2000100050000000100000016F0B20001006500000078030000E6C5310000") "yuanbao_v2.371_x64.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "yuanbao_v2.371_x64.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "yuanbao_v2.371_x64.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "yuanbao_v2.371_x64.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "WebProcess.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "MICROSOFT-A"; Value: "%PROGRAMFILES%\(x86)\upload\uploa\WebProcess.exe"), "yuanbao_2.77.1.612_x64.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US"), "yuanbao_2.77.1.612_x64.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "@C:\WINDOWS\SYSWOW64\FIREWALLCONTROLPANEL.DLL -12122"; Value: "Windows Defender Firewall"), "yuanbao_2.77.1.612_x64.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TENCENT\YUANBAO"; Key: "DEVICEID"; Value: "00000000000000000001"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "PENDINGFILERENAMEOPERATIONS"; Value: "%TEMP%\CopilotUpdate.exe.old{C479BADC-2EB5-47E1-A395-C661BE9102B3}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "PATH"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "COPILOTUPDATEPATH"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\CopilotUpdate.exe"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "UNINSTALLCMDLINE"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /uninstall"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTS\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}"; Key: "PV"; Value: "1.3.251.23"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTS\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}"; Key: "NAME"; Value: "Microsoft Edge Update"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTSTATE\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}"; Key: "PV"; Value: "1.3.251.23"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MICROSOFTEDGEUPDATE.EXE"; Key: "DISABLEEXCEPTIONCHAINVALIDATION"; Value: "0000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "LASTOSVERSION"; Value: "1C0100000A00000000000000AB3F00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001010000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "LASTOSVERSIONPATCHNUMBER"; Value: "F800000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "VERSION"; Value: "1.3.251.23"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MICROSOFT EDGE UPDATE"; Key: "DISPLAYVERSION"; Value: "1.3.251.23"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MICROSOFT EDGE UPDATE"; Key: "VERSION"; Value: "1.3.251.23"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTSTATE\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}"; Key: "INSTALLSOURCE"; Value: "otherinstallcmd"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\PERSISTEDPINGS\{3E7601C5-BBBD-45C6-BD14-66C3578153DA}"; Key: "PERSISTEDPINGSTRING"; Value: ""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\PERSISTEDPINGS\{3E7601C5-BBBD-45C6-BD14-66C3578153DA}"; Key: "PERSISTEDPINGTIME"; Value: "134310130851110815"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"; Key: "(DEFAULT)"; Value: "ServiceModule"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\MICROSOFTEDGEUPDATE.EXE"; Key: "APPID"; Value: "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"; Key: "LOCALSERVICE"; Value: "edgeupdate"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"; Key: "SERVICEPARAMETERS"; Value: "/comsvc"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION\EDGEUPDATE"; Key: "EVENTMESSAGEFILE"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3COMCLASSSERVICE.1.0"; Key: "(DEFAULT)"; Value: "Update3COMClass"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3COMCLASSSERVICE.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3COMCLASSSERVICE"; Key: "(DEFAULT)"; Value: "Update3COMClass"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3COMCLASSSERVICE\CLSID"; Key: "(DEFAULT)"; Value: "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3COMCLASSSERVICE\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3COMClassService.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"; Key: "(DEFAULT)"; Value: "Update3COMClass"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3COMClassService.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3COMClassService"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"; Key: "APPID"; Value: "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{A6B716CB-028B-404D-B72C-50E153DD68DA}"; Key: "(DEFAULT)"; Value: "ServiceModule"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\MICROSOFTEDGEUPDATE.EXE"; Key: "APPID"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{A6B716CB-028B-404D-B72C-50E153DD68DA}"; Key: "LOCALSERVICE"; Value: "edgeupdatem"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{A6B716CB-028B-404D-B72C-50E153DD68DA}"; Key: "SERVICEPARAMETERS"; Value: "/comsvc"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION\EDGEUPDATEM"; Key: "EVENTMESSAGEFILE"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSSVC.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Legacy On Demand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSSVC.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSSVC"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Legacy On Demand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSSVC\CLSID"; Key: "(DEFAULT)"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSSVC\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Legacy On Demand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassSvc"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}"; Key: "APPID"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBSVC.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Update3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBSVC.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBSVC"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Update3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBSVC\CLSID"; Key: "(DEFAULT)"; Value: "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBSVC\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebSvc.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Update3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebSvc.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebSvc"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"; Key: "APPID"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSSVC.1.0"; Key: "(DEFAULT)"; Value: "Google Update Policy Status Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSSVC.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSSVC"; Key: "(DEFAULT)"; Value: "Google Update Policy Status Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSSVC\CLSID"; Key: "(DEFAULT)"; Value: "{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSSVC\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusSvc.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}"; Key: "(DEFAULT)"; Value: "Google Update Policy Status Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusSvc.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusSvc"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}"; Key: "APPID"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CORECLASS.1"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Core Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CORECLASS.1\CLSID"; Key: "(DEFAULT)"; Value: "{8F09CD6C-5964-4573-82E3-EBFF7702865B}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CORECLASS"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Core Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CORECLASS\CLSID"; Key: "(DEFAULT)"; Value: "{8F09CD6C-5964-4573-82E3-EBFF7702865B}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CORECLASS\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CoreClass.1"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Core Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CoreClass.1"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CoreClass"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}"; Key: "APPID"; Value: "{A6B716CB-028B-404D-B72C-50E153DD68DA}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\psmachine.dll"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\psmachine.dll"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{19911DF1-DDAA-4A5F-9393-C0329375E49E}\INPROCHANDLER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\psmachine.dll"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{19911DF1-DDAA-4A5F-9393-C0329375E49E}\INPROCHANDLER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\psmachine.dll"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"; Key: "(DEFAULT)"; Value: "PSFactoryBuffer"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3500000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}"; Key: "(DEFAULT)"; Value: "IPolicyStatus5"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003700000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}"; Key: "(DEFAULT)"; Value: "IAppSideBySide"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3500000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C853632E-36CA-4999-B992-EC0D408CF5AB}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C853632E-36CA-4999-B992-EC0D408CF5AB}"; Key: "(DEFAULT)"; Value: "IPackage"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{60355531-5BFD-45AB-942C-7912628752C7}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{60355531-5BFD-45AB-942C-7912628752C7}"; Key: "(DEFAULT)"; Value: "IPolicyStatus3"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{60355531-5BFD-45AB-942C-7912628752C7}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}"; Key: "(DEFAULT)"; Value: "IPolicyStatusValue"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003200000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}"; Key: "(DEFAULT)"; Value: "IPolicyStatus6"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003800000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C06EE550-7248-488E-971E-B60C0AB3A6E4}"; Key: "(DEFAULT)"; Value: "IApp2"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "34003300000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A5135E58-384F-4244-9A5F-30FA9259413C}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A5135E58-384F-4244-9A5F-30FA9259413C}"; Key: "(DEFAULT)"; Value: "IProcessLauncher"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A5135E58-384F-4244-9A5F-30FA9259413C}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3600000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7E29BE61-5809-443F-9B5D-CF22156694EB}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7E29BE61-5809-443F-9B5D-CF22156694EB}"; Key: "(DEFAULT)"; Value: "IAppCommand2"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003200000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A1CA7367-21A7-45DD-8C49-614D55CF0803}"; Key: "(DEFAULT)"; Value: "IPolicyStatus7"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003900000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}"; Key: "(DEFAULT)"; Value: "IAppVersion"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E4518371-7326-4865-87F8-D9D3F3B287A3}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E4518371-7326-4865-87F8-D9D3F3B287A3}"; Key: "(DEFAULT)"; Value: "IBrowserHttpRequest2"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}"; Key: "(DEFAULT)"; Value: "IGoogleUpdateCore"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}"; Key: "(DEFAULT)"; Value: "ICoCreateAsyncStatus"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}"; Key: "(DEFAULT)"; Value: "IAppBundle"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "34003100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}"; Key: "(DEFAULT)"; Value: "IAppWeb"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003700000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}"; Key: "(DEFAULT)"; Value: "IJobObserver2"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}"; Key: "(DEFAULT)"; Value: "ICurrentState"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2603C88B-F971-4167-9DE1-871EE4A3DC84}"; Key: "(DEFAULT)"; Value: "ICredentialDialog"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}"; Key: "(DEFAULT)"; Value: "IPolicyStatus4"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003600000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}"; Key: "(DEFAULT)"; Value: "IPolicyStatus"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003600000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{99F8E195-1042-4F89-A28C-89CDB74A14AE}"; Key: "(DEFAULT)"; Value: "IJobObserver"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003300000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}"; Key: "(DEFAULT)"; Value: "IApp"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "34003100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}"; Key: "(DEFAULT)"; Value: "ICoCreateAsync"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}"; Key: "(DEFAULT)"; Value: "IAppCommand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}"; Key: "(DEFAULT)"; Value: "IRegistrationUpdateHook"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3800000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2EC826CB-5478-4533-9015-7580B3B5E03A}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2EC826CB-5478-4533-9015-7580B3B5E03A}"; Key: "(DEFAULT)"; Value: "IAppCommandWeb"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate3"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{837E40DA-EB1B-440C-8623-0F14DF158DC0}"; Key: "(DEFAULT)"; Value: "IAppBundleWeb"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{99980EE2-56FE-4F68-892A-D43F3E57EF9B}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{99980EE2-56FE-4F68-892A-D43F3E57EF9B}"; Key: "(DEFAULT)"; Value: "IAppUnified"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{99980EE2-56FE-4F68-892A-D43F3E57EF9B}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3500000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{1B9063E4-3882-485E-8797-F28A0240782F}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{1B9063E4-3882-485E-8797-F28A0240782F}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate3WebSecurity"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{1B9063E4-3882-485E-8797-F28A0240782F}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}"; Key: "(DEFAULT)"; Value: "IProgressWndEvents"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3900000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}"; Key: "(DEFAULT)"; Value: "IPolicyStatus2"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003300000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3800000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}"; Key: "(DEFAULT)"; Value: "IProcessLauncher2"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3700000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{450CF5FF-95C4-4679-BECA-22680389ECB9}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{450CF5FF-95C4-4679-BECA-22680389ECB9}"; Key: "(DEFAULT)"; Value: "IAppVersionWeb"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINE.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINE.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINE"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINE\CLSID"; Key: "(DEFAULT)"; Value: "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINE\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassMachine"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateBroker.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"; Key: "LOCALIZEDSTRING"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll -3000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINE.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINE.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINE"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINE\CLSID"; Key: "(DEFAULT)"; Value: "{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINE\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebMachine"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateBroker.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}"; Key: "LOCALIZEDSTRING"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll -3000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINE.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINE.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{B5977F34-9264-4AC3-9B31-1224827FF6E8}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINE"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINE\CLSID"; Key: "(DEFAULT)"; Value: "{B5977F34-9264-4AC3-9B31-1224827FF6E8}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINE\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Broker Class Factory"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusMachine"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateBroker.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}"; Key: "LOCALIZEDSTRING"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll -3000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.PROCESSLAUNCHER.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Process Launcher Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.PROCESSLAUNCHER.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{08D832B9-D2FD-481F-98CF-904D00DF63CC}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.PROCESSLAUNCHER"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Process Launcher Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.PROCESSLAUNCHER\CLSID"; Key: "(DEFAULT)"; Value: "{08D832B9-D2FD-481F-98CF-904D00DF63CC}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.PROCESSLAUNCHER\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.ProcessLauncher.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Process Launcher Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.ProcessLauncher.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.ProcessLauncher"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateOnDemand.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.COREMACHINECLASS.1"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Core Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.COREMACHINECLASS.1\CLSID"; Key: "(DEFAULT)"; Value: "{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.COREMACHINECLASS"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Core Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.COREMACHINECLASS\CLSID"; Key: "(DEFAULT)"; Value: "{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.COREMACHINECLASS\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CoreMachineClass.1"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Core Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CoreMachineClass.1"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CoreMachineClass"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateOnDemand.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}"; Key: "LOCALIZEDSTRING"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll -3000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINEFALLBACK.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Legacy On Demand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINEFALLBACK.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINEFALLBACK"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Legacy On Demand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINEFALLBACK\CLSID"; Key: "(DEFAULT)"; Value: "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.ONDEMANDCOMCLASSMACHINEFALLBACK\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Legacy On Demand"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateOnDemand.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"; Key: "LOCALIZEDSTRING"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll -3000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINEFALLBACK.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Update3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINEFALLBACK.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{E421557C-0628-43FB-BF2B-7C9F8A4D067C}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINEFALLBACK"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Update3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINEFALLBACK\CLSID"; Key: "(DEFAULT)"; Value: "{E421557C-0628-43FB-BF2B-7C9F8A4D067C}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.UPDATE3WEBMACHINEFALLBACK\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update Update3Web"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.Update3WebMachineFallback"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateOnDemand.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINEFALLBACK.1.0"; Key: "(DEFAULT)"; Value: "Google Update Policy Status Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINEFALLBACK.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{77857D02-7A25-4B67-9266-3E122A8F39E4}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINEFALLBACK"; Key: "(DEFAULT)"; Value: "Google Update Policy Status Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINEFALLBACK\CLSID"; Key: "(DEFAULT)"; Value: "{77857D02-7A25-4B67-9266-3E122A8F39E4}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.POLICYSTATUSMACHINEFALLBACK\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}"; Key: "(DEFAULT)"; Value: "Google Update Policy Status Class"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.PolicyStatusMachineFallback"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateOnDemand.exe""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ELEVATION"; Key: "ENABLED"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ELEVATION"; Key: "ICONREFERENCE"; Value: "@%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\msedgeupdate.dll -1004"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CREDENTIALDIALOGMACHINE.1.0"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update CredentialDialog"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CREDENTIALDIALOGMACHINE.1.0\CLSID"; Key: "(DEFAULT)"; Value: "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CREDENTIALDIALOGMACHINE"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update CredentialDialog"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CREDENTIALDIALOGMACHINE\CLSID"; Key: "(DEFAULT)"; Value: "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\MICROSOFTEDGEUPDATE.CREDENTIALDIALOGMACHINE\CURVER"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CredentialDialogMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}"; Key: "(DEFAULT)"; Value: "Microsoft Edge Update CredentialDialog"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\PROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CredentialDialogMachine.1.0"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\VERSIONINDEPENDENTPROGID"; Key: "(DEFAULT)"; Value: "MicrosoftEdgeUpdate.CredentialDialogMachine"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\LOCALSERVER32"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\MicrosoftEdgeUpdateOnDemand.exe""), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\psmachine_64.dll"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\psmachine_64.dll"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{19911DF1-DDAA-4A5F-9393-C0329375E49E}\INPROCHANDLER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\psmachine_64.dll"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{19911DF1-DDAA-4A5F-9393-C0329375E49E}\INPROCHANDLER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.251.23\psmachine_64.dll"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Both"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"; Key: "(DEFAULT)"; Value: "PSFactoryBuffer"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3500000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}"; Key: "(DEFAULT)"; Value: "IPolicyStatus5"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003700000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}"; Key: "(DEFAULT)"; Value: "IAppSideBySide"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3500000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C853632E-36CA-4999-B992-EC0D408CF5AB}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C853632E-36CA-4999-B992-EC0D408CF5AB}"; Key: "(DEFAULT)"; Value: "IPackage"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{60355531-5BFD-45AB-942C-7912628752C7}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{60355531-5BFD-45AB-942C-7912628752C7}"; Key: "(DEFAULT)"; Value: "IPolicyStatus3"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{60355531-5BFD-45AB-942C-7912628752C7}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}"; Key: "(DEFAULT)"; Value: "IPolicyStatusValue"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003200000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}"; Key: "(DEFAULT)"; Value: "IPolicyStatus6"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003800000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C06EE550-7248-488E-971E-B60C0AB3A6E4}"; Key: "(DEFAULT)"; Value: "IApp2"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "34003300000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A5135E58-384F-4244-9A5F-30FA9259413C}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A5135E58-384F-4244-9A5F-30FA9259413C}"; Key: "(DEFAULT)"; Value: "IProcessLauncher"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A5135E58-384F-4244-9A5F-30FA9259413C}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3600000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7E29BE61-5809-443F-9B5D-CF22156694EB}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7E29BE61-5809-443F-9B5D-CF22156694EB}"; Key: "(DEFAULT)"; Value: "IAppCommand2"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003200000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A1CA7367-21A7-45DD-8C49-614D55CF0803}"; Key: "(DEFAULT)"; Value: "IPolicyStatus7"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003900000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}"; Key: "(DEFAULT)"; Value: "IAppVersion"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E4518371-7326-4865-87F8-D9D3F3B287A3}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E4518371-7326-4865-87F8-D9D3F3B287A3}"; Key: "(DEFAULT)"; Value: "IBrowserHttpRequest2"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}"; Key: "(DEFAULT)"; Value: "IGoogleUpdateCore"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}"; Key: "(DEFAULT)"; Value: "ICoCreateAsyncStatus"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}"; Key: "(DEFAULT)"; Value: "IAppBundle"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "34003100000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}"; Key: "(DEFAULT)"; Value: "IAppWeb"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003700000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}"; Key: "(DEFAULT)"; Value: "IJobObserver2"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}"; Key: "(DEFAULT)"; Value: "ICurrentState"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{2603C88B-F971-4167-9DE1-871EE4A3DC84}"; Key: "(DEFAULT)"; Value: "ICredentialDialog"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}"; Key: "(DEFAULT)"; Value: "IPolicyStatus4"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003600000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}"; Key: "(DEFAULT)"; Value: "IPolicyStatus"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003600000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{99F8E195-1042-4F89-A28C-89CDB74A14AE}"; Key: "(DEFAULT)"; Value: "IJobObserver"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003300000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}"; Key: "(DEFAULT)"; Value: "IApp"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "34003100000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}"; Key: "(DEFAULT)"; Value: "ICoCreateAsync"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}"; Key: "(DEFAULT)"; Value: "IAppCommand"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003100000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}"; Key: "(DEFAULT)"; Value: "IRegistrationUpdateHook"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3800000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{2EC826CB-5478-4533-9015-7580B3B5E03A}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{2EC826CB-5478-4533-9015-7580B3B5E03A}"; Key: "(DEFAULT)"; Value: "IAppCommandWeb"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003100000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate3"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{837E40DA-EB1B-440C-8623-0F14DF158DC0}"; Key: "(DEFAULT)"; Value: "IAppBundleWeb"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{99980EE2-56FE-4F68-892A-D43F3E57EF9B}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{99980EE2-56FE-4F68-892A-D43F3E57EF9B}"; Key: "(DEFAULT)"; Value: "IAppUnified"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{99980EE2-56FE-4F68-892A-D43F3E57EF9B}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3500000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{1B9063E4-3882-485E-8797-F28A0240782F}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{1B9063E4-3882-485E-8797-F28A0240782F}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate3WebSecurity"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{1B9063E4-3882-485E-8797-F28A0240782F}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3400000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}"; Key: "(DEFAULT)"; Value: "IProgressWndEvents"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3900000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}"; Key: "(DEFAULT)"; Value: "IPolicyStatus2"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "32003300000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}"; Key: "(DEFAULT)"; Value: "IGoogleUpdate3Web"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3800000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}"; Key: "(DEFAULT)"; Value: "IProcessLauncher2"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "3700000000"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{450CF5FF-95C4-4679-BECA-22680389ECB9}\PROXYSTUBCLSID32"; Key: "(DEFAULT)"; Value: "{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{450CF5FF-95C4-4679-BECA-22680389ECB9}"; Key: "(DEFAULT)"; Value: "IAppVersionWeb"), "MicrosoftEdgeUpdateComRegisterShell64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NUMMETHODS"; Key: "(DEFAULT)"; Value: "31003000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEUPDATE\PROXY"; Key: "SOURCE"; Value: "direct"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTSTATE\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}"; Key: "EXPERIMENT_CONTROL_LABELS"; Value: "000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "LASTECSETAG"; Value: ""kZynjkJ0kWiVnLNbXolB3WwGkgvM6kHcDdFrj1rjbPo=""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "ECSEXPIRYCONFIG"; Value: "https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.251.23?clientId=s:D72CCD18-9555-46CE-BE82-DD29EB26E920&appChannel_edgeupdate=6&appConsentState_edgeupdate=0&appDayOfInstall_edgeupdate=0&appInactivityBadgeApplied_edgeupdate=0&appInactivityBadgeCleared_edgeupdate=0&appInactivityBadgeDuration_edgeupdate=0&appInstallTimeDiffSec_edgeupdate=0&appIsPinnedSystem_edgeupdate=false&appLastLaunchCount_edgeupdate=0&appLastLaunchTime_edgeupdate=0&appLastLaunchTimeJson_edgeupdate=0&appLastLaunchTimeDaysAgo_edgeupdate=0&appVersion_edgeupdate=1.3.251.23&appUpdateCheckIsUpdateDisabled_edgeupdate=false&appUpdatesAllowedForMeteredNetworks_edgeupdate=false&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=8&hwPhysmemory=8&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=Xl6yeljlY8c8&oemProductName=tFb3qzS4C9PA&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.16299.248&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=otherinstallcmd&requestIsMachine=true&requestOmahaShellVersion=1.3.251.23&requestOmahaVersion=1.3.251.23"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "ECSEXPIRYTIME"; Value: "K{|j"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\PERSISTEDPINGS\{47EF236C-3719-4E7B-AE69-5C24861CBF95}"; Key: "PERSISTEDPINGSTRING"; Value: ""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\PERSISTEDPINGS\{47EF236C-3719-4E7B-AE69-5C24861CBF95}"; Key: "PERSISTEDPINGTIME"; Value: "134310131148108622"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\PERSISTEDPINGS\{D361099F-F666-4945-9E1D-04EAA0E5D2F4}"; Key: "PERSISTEDPINGSTRING"; Value: ""), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\PERSISTEDPINGS\{D361099F-F666-4945-9E1D-04EAA0E5D2F4}"; Key: "PERSISTEDPINGTIME"; Value: "134310131207379236"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTSTATE\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\CURRENTSTATE"; Key: "STATEVALUE"; Value: "0200000000"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US"), "MicrosoftEdgeUpdate.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE"; Key: "LASTSTARTEDAU"; Value: "B06E7C6A00")7f:T408,"yuanbao_v2.371_x64.exe" was detected as "VC8 -> Microsoft Corporation" "msedgeupdate.dll" was detected as "Borland Delphi 3.0 (???)" "MicrosoftEdgeUpdateSetup.exe" was detected as "VC8 -> Microsoft Corporation" "report_helper.exe" was detected as "VC8 -> Microsoft Corporation" "irsetup.exe" was detected as "UPX v1.25 (Delphi) Stub" "ProductHelper.dll" was detected as "Borland Delphi 3.0 (???)" "psuser.dll" was detected as "Borland Delphi 3.0 (???)" "psmachine.dll" was detected as "Borland Delphi 3.0 (???)" "MicrosoftEdgeUpdateCore.exe" was detected as "VC8 -> Microsoft Corporation" "MicrosoftEdgeUpdate.exe" was detected as "VC8 -> Microsoft Corporation" "libcef.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "WebProcess.exe" was detected as "VC8 -> Microsoft Corporation" "MicrosoftEdgeUpdateOnDemand.exe" was detected as "VC8 -> Microsoft Corporation" "MicrosoftEdgeUpdateBroker.exe" was detected as "VC8 -> Microsoft Corporation" "msedgeupdateres_ml.dll" was detected as "Borland Delphi 3.0 (???)"80:T444,"yuanbao_v2.371_x64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "irsetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "irsetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "WebProcess.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "yuanbao_2.77.1.612_x64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "yuanbao_2.77.1.612_x64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "report_helper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "report_helper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "MicrosoftEdgeWebview2Setup_908350031_1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "MicrosoftEdgeUpdate.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK")81:T6f9,"yuanbao_v2.371_x64.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "yuanbao_v2.371_x64.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "yuanbao_v2.371_x64.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "yuanbao_v2.371_x64.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "yuanbao_v2.371_x64.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "yuanbao_v2.371_x64.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "yuanbao_v2.371_x64.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "yuanbao_v2.371_x64.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "yuanbao_v2.371_x64.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "yuanbao_v2.371_x64.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "yuanbao_v2.371_x64.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "yuanbao_v2.371_x64.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "yuanbao_v2.371_x64.exe" reads file "C:\Users\desktop.ini" "irsetup.exe" reads file "C:\Users\desktop.ini" "irsetup.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "irsetup.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "irsetup.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "irsetup.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "irsetup.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "irsetup.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "irsetup.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "irsetup.exe" reads file "C:\Users\Public\desktop.ini" "irsetup.exe" reads file "C:\Users\Public\Desktop\desktop.ini" "irsetup.exe" reads file "C:\Windows\Fonts\desktop.ini" "irsetup.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini"82:T5df4,"yuanbao_2.77.1.612_x64.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 6 sections"- Location: [%PROGRAMFILES%\(x86)\upload\uploa\yuanbao_2.77.1.612_x64.exe]- [targetUID: 00000000-00005176] "msedgeupdate.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdate.dll]- [targetUID: 00000000-00004704] "MicrosoftEdgeUpdateSetup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateSetup.exe]- [targetUID: 00000000-00003932] "report_helper.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 5 sections"- Location: [%WINDIR%\Temp\report_helper.exe]- [targetUID: 00000000-00001308] "irsetup.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%TEMP%\_ir_sf_temp_0\irsetup.exe]- [targetUID: 00000000-00006148] "ProductHelper.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\nsw9161.tmp\ProductHelper.dll]- [targetUID: 00000000-00006452] "psmachine_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\psmachine_64.dll]- [targetUID: 00000000-00008188] "psuser_64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\psuser_64.dll]- [targetUID: 00000000-00003932] "psuser_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\psuser_arm64.dll]- [targetUID: 00000000-00003932] "psmachine_arm64.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) ARM64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\psmachine_arm64.dll]- [targetUID: 00000000-00003932] "psuser.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\psuser.dll]- [targetUID: 00000000-00003932] "psmachine.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\psmachine.dll]- [targetUID: 00000000-00004704] "MicrosoftEdgeUpdateCore.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateCore.exe]- [targetUID: 00000000-00003932] "INetC.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\nsw9161.tmp\INetC.dll]- [targetUID: 00000000-00006452] "MicrosoftEdgeUpdateComRegisterShell64.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 8 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe]- [targetUID: 00000000-00004704] "MicrosoftEdgeUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe]- [targetUID: 00000000-00004704] "MicrosoftEdgeComRegisterShellARM64.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) ARM64 7 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeComRegisterShellARM64.exe]- [targetUID: 00000000-00003932] "libcef.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\upload\uploa\libcef.dll]- [targetUID: 00000000-00005176] "WebProcess.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\upload\uploa\WebProcess.exe]- [targetUID: 00000000-00005176] "MicrosoftEdgeUpdateOnDemand.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateOnDemand.exe]- [targetUID: 00000000-00003932] "MicrosoftEdgeUpdateBroker.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateBroker.exe]- [targetUID: 00000000-00003932] "msedgeupdateres_ml.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ml.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_el.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_el.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_de.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_de.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_lb.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_lb.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_pl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_pl.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ca.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ca.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_fr-CA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_fr-CA.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_gd.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_gd.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ca-Es-VALENCIA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ca-Es-VALENCIA.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_fr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_fr.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_it.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_it.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_nl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_nl.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_fil.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_fil.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_or.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_or.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_bg.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_bg.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ka.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ka.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_bn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_bn.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_es-419.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_es-419.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_kn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_kn.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_sl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sl.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_hr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_hr.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_hu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_hu.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_sr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sr.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_bn-IN.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_bn-IN.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_mt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_mt.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_mk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_mk.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ro.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ro.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_az.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_az.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_af.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_af.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_sr-Cyrl-BA.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sr-Cyrl-BA.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_gl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_gl.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_uk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_uk.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_eu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_eu.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_es.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_es.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ne.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ne.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_pa.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_pa.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_da.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_da.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ga.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ga.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_sr-Latn-RS.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sr-Latn-RS.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_nn.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_nn.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_sv.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sv.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_gu.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_gu.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ta.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ta.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_bs.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_bs.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_hi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_hi.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_lv.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_lv.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_pt-BR.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_pt-BR.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_te.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_te.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ur.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ur.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_as.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_as.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_sr-Cyrl-RS.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sr-Cyrl-RS.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_pt-PT.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_pt-PT.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_tr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_tr.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ru.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ru.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_fi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_fi.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_cy.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_cy.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ms.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ms.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_kk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_kk.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_mi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_mi.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_quz.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_quz.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_cs.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_cs.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_nb.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_nb.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_vi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_vi.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_mr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_mr.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_kok.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_kok.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_is.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_is.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_sq.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sq.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_sk.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sk.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_lt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_lt.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_tt.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_tt.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_et.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_et.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_id.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_id.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_fa.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_fa.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_th.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_th.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_en.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_en.dll]- [targetUID: 00000000-00007708] "msedgeupdateres_lo.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_lo.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_km.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_km.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_en-GB.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_en-GB.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ug.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ug.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ar.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ar.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_iw.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_iw.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_am.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_am.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ja.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ja.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_ko.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ko.dll]- [targetUID: 00000000-00003932] "CopilotUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\CopilotUpdate.exe]- [targetUID: 00000000-00003932] "msedgeupdateres_zh-CN.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_zh-CN.dll]- [targetUID: 00000000-00003932] "msedgeupdateres_zh-TW.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_zh-TW.dll]- [targetUID: 00000000-00003932] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsw9161.tmp\System.dll]- [targetUID: 00000000-00006452] "MicrosoftEdgeWebview2Setup_908350031_1.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%TEMP%\MicrosoftEdgeWebview2Setup_908350031_1.exe]- [targetUID: 00000000-00003932] "MicrosoftEdgeUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdate.exe]- [targetUID: 00000000-00004704] "CopilotUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Temp\EUD2A0.tmp\CopilotUpdate.exe]- [targetUID: 00000000-00003932]83:Tbf74,"yuanbao_v2.371_x64.exe" wrote 55808 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "irsetup.exe" wrote 12596 bytes starting with PE header signature to file "C:\Program Files (x86)\upload\uploa\libcef.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "irsetup.exe" wrote 12596 bytes starting with PE header signature to file "C:\Program Files (x86)\upload\uploa\msvcp120.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "irsetup.exe" wrote 12596 bytes starting with PE header signature to file "C:\Program Files (x86)\upload\uploa\msvcr120.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "irsetup.exe" wrote 12596 bytes starting with PE header signature to file "C:\Program Files (x86)\upload\uploa\WebProcess.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "irsetup.exe" wrote 12596 bytes starting with PE header signature to file "C:\Program Files (x86)\upload\uploa\yuanbao_2.77.1.612_x64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "yuanbao_2.77.1.612_x64.exe" wrote 12288 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsw9161.tmp\System.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "yuanbao_2.77.1.612_x64.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsw9161.tmp\ProductHelper.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "yuanbao_2.77.1.612_x64.exe" wrote 32768 bytes starting with PE header signature to file "C:\Windows\Temp\report_helper.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "yuanbao_2.77.1.612_x64.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsw9161.tmp\INetC.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "yuanbao_2.77.1.612_x64.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\MicrosoftEdgeWebview2Setup_908350031_1.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdate.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\CopilotUpdate.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdate.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateBroker.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateOnDemand.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeComRegisterShellARM64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\psmachine.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\psmachine_64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\psmachine_arm64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\psuser.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\psuser_64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\psuser_arm64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateCore.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_am.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ar.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_bg.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_bn.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ca.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_cs.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_da.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_de.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_el.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_en.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_en-GB.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_es.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_es-419.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_et.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_fa.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_fi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_fil.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_fr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_gu.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_hi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_hr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_hu.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_id.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_is.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_it.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_iw.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ja.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_kn.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ko.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_lt.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_lv.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ml.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_mr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ms.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_nb.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_nl.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_pl.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_pt-BR.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_pt-PT.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ro.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ru.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sk.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sl.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sv.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ta.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_te.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_th.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_tr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_uk.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ur.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_vi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_zh-CN.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_zh-TW.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_af.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_as.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_az.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_bn-IN.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_bs.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ca-Es-VALENCIA.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_cy.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_eu.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_fr-CA.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ga.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_gd.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_gl.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ka.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_kk.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_km.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_kok.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_lb.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_lo.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_mi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_mk.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_mt.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ne.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_nn.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_or.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_pa.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_quz.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sq.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sr-Cyrl-BA.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sr-Cyrl-RS.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_sr-Latn-RS.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_tt.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ug.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MicrosoftEdgeUpdate.exe" wrote 22872 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\EdgeUpdate\CopilotUpdate.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...84:Tbe1,"yuanbao_v2.371_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" for deletion "irsetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat" for deletion "irsetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG" for deletion "irsetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.JPG" for deletion "yuanbao_2.77.1.612_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsm90D4.tmp" for deletion "yuanbao_2.77.1.612_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsw9161.tmp" for deletion "MicrosoftEdgeWebview2Setup_908350031_1.exe" marked "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\CopilotUpdate.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\EdgeUpdate.dat" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeComRegisterShellARM64.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdate.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdateBroker.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdateComRegisterShell64.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdateCore.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdateOnDemand.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\MicrosoftEdgeUpdateSetup.exe" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdate.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_af.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_am.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_ar.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_as.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_az.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_bg.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_bn-IN.dll" for deletion "MicrosoftEdgeUpdate.exe" marked "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.221.3\msedgeupdateres_bn.dll" for deletion85:Tbdb,"yuanbao_v2.371_x64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_IR_SF_TEMP_0\IRSETUP.EXE" with delete access "yuanbao_v2.371_x64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_IR_SF_TEMP_0" with delete access "yuanbao_v2.371_x64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" with delete access "irsetup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat" with delete access "irsetup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG" with delete access "irsetup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.JPG" with delete access "yuanbao_2.77.1.612_x64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsm90D4.tmp" with delete access "yuanbao_2.77.1.612_x64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsw9161.tmp" with delete access "MicrosoftEdgeWebview2Setup_908350031_1.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdate.exe" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\CopilotUpdate.exe" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdate.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateCore.exe" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeComRegisterShellARM64.exe" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\NOTICE.TXT" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\EdgeUpdate.dat" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_af.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_am.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_ar.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_as.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_az.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_bg.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_bn.dll" with delete access "MicrosoftEdgeUpdate.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\msedgeupdateres_bn-IN.dll" with delete access86:T58a,"msedgeupdate.dll" claimed CRC 56070841 while the actual is CRC 2374671 "MicrosoftEdgeUpdateSetup.exe" claimed CRC 2374671 while the actual is CRC 1747145 "report_helper.exe" claimed CRC 1747145 while the actual is CRC 833551 "irsetup.exe" claimed CRC 833551 while the actual is CRC 612181 "psmachine_64.dll" claimed CRC 524054 while the actual is CRC 445389 "psuser_64.dll" claimed CRC 445389 while the actual is CRC 484778 "psuser_arm64.dll" claimed CRC 484778 while the actual is CRC 429039 "psmachine_arm64.dll" claimed CRC 429039 while the actual is CRC 430145 "psuser.dll" claimed CRC 430145 while the actual is CRC 355268 "psmachine.dll" claimed CRC 355268 while the actual is CRC 385462 "MicrosoftEdgeUpdateCore.exe" claimed CRC 385462 while the actual is CRC 314343 "INetC.dll" claimed CRC 314343 while the actual is CRC 246939 "MicrosoftEdgeUpdateComRegisterShell64.exe" claimed CRC 246939 while the actual is CRC 260210 "MicrosoftEdgeUpdate.exe" claimed CRC 260210 while the actual is CRC 220647 "MicrosoftEdgeComRegisterShellARM64.exe" claimed CRC 220647 while the actual is CRC 227034 "libcef.dll" claimed CRC 227034 while the actual is CRC 180783 "MicrosoftEdgeUpdateOnDemand.exe" claimed CRC 159169 while the actual is CRC 117521 "MicrosoftEdgeUpdateBroker.exe" claimed CRC 117521 while the actual is CRC 112129 "msedgeupdateres_ml.dll" claimed CRC 112129 while the actual is CRC 8094687:T5db,OpenProcessToken GetVersionExA VirtualAlloc Sleep GetModuleFileNameA GetCommandLineA GetProcAddress WriteFile GetTickCount GetFileAttributesA CreateDirectoryA GetStartupInfoA UnhandledExceptionFilter TerminateProcess DeleteFileA GetModuleHandleA GetTempPathA LoadLibraryA ShellExecuteExA GetVersionExW GetSystemInfo LoadLibraryExW DeleteFileW SleepConditionVariableCS LoadLibraryExA Process32NextW GetCommandLineW FindResourceW FindFirstFileW GetTempPathW OutputDebugStringA FindNextFileW OutputDebugStringW ExitThread GetModuleFileNameW CreateFileW GetNativeSystemInfo ReadProcessMemory CreateProcessW Process32FirstW GetFileSize CreateDirectoryW SleepConditionVariableSRW CopyFileW GetStartupInfoW LoadLibraryW GetFileAttributesW GetTempFileNameW IsDebuggerPresent CreateToolhelp32Snapshot FindFirstFileExW LockResource CreateThread GetTickCount64 GetComputerNameExW GetSystemDirectoryW GetFileSizeEx GetModuleHandleExW VirtualProtect GetFileAttributesExW DeviceIoControl GetModuleHandleW OpenProcess FindResourceExW GetDriveTypeW RegOpenKeyExA RegOpenKeyExW RegCloseKey SetSecurityDescriptorDacl RegDeleteValueA RegCreateKeyExA MapViewOfFile CreateFileMappingW CryptEncrypt CreateFileA GetDriveTypeA GetSystemDirectoryA SleepEx FindFirstFileExA recv sendto closesocket accept bind WSAStartup send recvfrom connect listen socket URLDownloadToFileA RegCreateKeyExW ShellExecuteExW GetWindowThreadProcessId88:T660,"yuanbao_v2.371_x64.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" (Handle: 1140) "irsetup.exe" wrote 00000004 bytes to a remote process "C:\Program Files (x86)\upload\uploa\WebProcess.exe" (Handle: 1084) "irsetup.exe" wrote 00000004 bytes to a remote process "C:\Program Files (x86)\upload\uploa\yuanbao_2.77.1.612_x64.exe" (Handle: 1100) "yuanbao_2.77.1.612_x64.exe" wrote 00000004 bytes to a remote process "C:\Windows\Temp\report_helper.exe" (Handle: 960) "yuanbao_2.77.1.612_x64.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\MicrosoftEdgeWebview2Setup_908350031_1.exe" (Handle: 1676) "MicrosoftEdgeWebview2Setup_908350031_1.exe" wrote 00000004 bytes to a remote process "C:\Program Files (x86)\Microsoft\Temp\EUD2A0.tmp\MicrosoftEdgeUpdate.exe" (Handle: 604) "MicrosoftEdgeUpdate.exe" wrote 00000004 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 820) "MicrosoftEdgeUpdate.exe" wrote 00000004 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 860) "MicrosoftEdgeUpdate.exe" wrote 00000004 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 868) "MicrosoftEdgeUpdate.exe" wrote 00000004 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 1200) "MicrosoftEdgeUpdate.exe" wrote 00000004 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" (Handle: 1000)89:T14c8,Spawned process "yuanbao_v2.371_x64.exe" (UID: 00000000-00006148) Spawned process "irsetup.exe" with commandline "__IRAOFF:641570 "__IRAFN:C:\\yuanbao_v2.371_x64.exe" "__IRCT:2" "__IRTSS:0" "__IRSID:S-1-5-21-735145574-3570218355-1207367261-1001"" (UID: 00000000-00005176) Spawned process "WebProcess.exe" (UID: 00000000-00006212) Spawned process "yuanbao_2.77.1.612_x64.exe" (UID: 00000000-00006452) Spawned process "report_helper.exe" with commandline "--connect-timeout 3 --location --request POST "https://otheve.beacon.qq.com/analytics/v2_upload" --header "Content-Type: application/json" --data-raw "{\\"common\\": {\\"A2\\": \\"00000000000000000001\\" \\"A3\\": \\"00000000000000000001\\" \\"A23\\": \\"7001\\" \\"A153\\": \\"00000000000000000001\\" \\"HY99\\": \\"00000000000000000001\\" \\"HY502\\": \\"1\\" \\"HY501\\": \\"\\"} \\"events\\": [{\\"eventCode\\": \\"install_init\\" \\"eventTime\\": \\"1786539254000\\"}] \\"appVersion\\": \\"2.77.1.612\\" \\"sdkId\\": \\"js\\" \\"sdkVersion\\": \\"\\" \\"mainAppKey\\": \\"0WIN06DPC0UV5DHL\\" \\"platformId\\": \\"3\\"}"" (UID: 00000000-00001308) Spawned process "MicrosoftEdgeWebview2Setup_908350031_1.exe" with commandline "/silent /install" (UID: 00000000-00003932) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"" (UID: 00000000-00003044) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regsvc" (UID: 00000000-00007664) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/regserver" (UID: 00000000-00004704) Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00005904) Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00006516) Spawned process "MicrosoftEdgeUpdateComRegisterShell64.exe" (UID: 00000000-00008188) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNTEuMjMiIHNoZWxsX3ZlcnNpb249IjEuMy4yNTEuMjMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDQ2OTE3RTktOTJBMC00N0Q3LUIxMTMtMDU1NDhENzEyRTg0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszRTc2MDFDNS1CQkJELTQ1QzYtQkQxNC02NkMzNTc4MTUzREF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE2Mjk5LjI0OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJYbDZ5ZWxqbFk4YzgiIHByb2R1Y3RfbmFtZT0idEZiM3F6UzRDOVBBIi8-PGV4cCBldGFnPSImcXVvdDsrWkZBajNTT0lJNUJKem9HdXo4T3ByMGhaOEgvckR6cWIvUVZyM1BZaDRJPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMjIxLjMiIG5leHR2ZXJzaW9uPSIxLjMuMjUxLjIzIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTQ1NzQ1MzIxMiIgaW5zdGFsbF90aW1lX21zPSIxMjUzNzEiLz48L2FwcD48L3JlcXVlc3Q-" (UID: 00000000-00007912) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{D46917E9-92A0-47D7-B113-05548D712E84}" /silent" (UID: 00000000-00007672) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/svc" (UID: 00000000-00007708) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNTEuMjMiIHNoZWxsX3ZlcnNpb249IjEuMy4yNTEuMjMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDQ2OTE3RTktOTJBMC00N0Q3LUIxMTMtMDU1NDhENzEyRTg0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RDM2MTA5OUYtRjY2Ni00OTQ1LTlFMUQtMDRFQUEwRTVEMkY0fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNjI5OS4yNDgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iWGw2eWVsamxZOGM4IiBwcm9kdWN0X25hbWU9InRGYjNxelM0QzlQQSIvPjxleHAgZXRhZz0iJnF1b3Q7a1p5bmprSjBrV2lWbkxOYlhvbEIzV3dHa2d2TTZrSGNEZEZyajFyamJQbz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTQ0LjAuNzU1OS4xMzMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iSEtGTCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjE5MSIgaW5zdGFsbGRhdGV0aW1lPSIxNzY5OTUzNjEzIiBvb2JlX2luc3RhbGxfdGltZT0iMTMxNjQ3NDA0Njc0NDcwMDAwIiBmaXJzdF9mcmVfc2Vlbl90aW1lPSIxMzI5NTY0MDgxNjIyOTY1NDAiIGZpcnN0X2ZyZV9zZWVuX3ZlcnNpb249IjEwMC4wLjExODUuNTAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxNTEwNzgxNjciIHN5c3RlbV91cHRpbWVfdGlja3M9IjExNTM2OTg0NzMxIi8-PC9hcHA-PC9yZXF1ZXN0Pg" (UID: 00000000-00002400) Spawned process "MicrosoftEdgeUpdate.exe" with commandline "/ua /installsource scheduler" (UID: 00000000-00001172)8a:T400,AAABAAEAICAQdAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==8b:T4f2,/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNTEuMjMiIHNoZWxsX3ZlcnNpb249IjEuMy4yNTEuMjMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDQ2OTE3RTktOTJBMC00N0Q3LUIxMTMtMDU1NDhENzEyRTg0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszRTc2MDFDNS1CQkJELTQ1QzYtQkQxNC02NkMzNTc4MTUzREF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE2Mjk5LjI0OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJYbDZ5ZWxqbFk4YzgiIHByb2R1Y3RfbmFtZT0idEZiM3F6UzRDOVBBIi8-PGV4cCBldGFnPSImcXVvdDsrWkZBajNTT0lJNUJKem9HdXo4T3ByMGhaOEgvckR6cWIvUVZyM1BZaDRJPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMjIxLjMiIG5leHR2ZXJzaW9uPSIxLjMuMjUxLjIzIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTQ1NzQ1MzIxMiIgaW5zdGFsbF90aW1lX21zPSIxMjUzNzEiLz48L2FwcD48L3JlcXVlc3Q-8c:T400,AAABAAEAICAQdAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==8d:T5b0,/ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNTEuMjMiIHNoZWxsX3ZlcnNpb249IjEuMy4yNTEuMjMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDQ2OTE3RTktOTJBMC00N0Q3LUIxMTMtMDU1NDhENzEyRTg0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RDM2MTA5OUYtRjY2Ni00OTQ1LTlFMUQtMDRFQUEwRTVEMkY0fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNjI5OS4yNDgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iWGw2eWVsamxZOGM4IiBwcm9kdWN0X25hbWU9InRGYjNxelM0QzlQQSIvPjxleHAgZXRhZz0iJnF1b3Q7a1p5bmprSjBrV2lWbkxOYlhvbEIzV3dHa2d2TTZrSGNEZEZyajFyamJQbz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTQ0LjAuNzU1OS4xMzMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iSEtGTCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjE5MSIgaW5zdGFsbGRhdGV0aW1lPSIxNzY5OTUzNjEzIiBvb2JlX2luc3RhbGxfdGltZT0iMTMxNjQ3NDA0Njc0NDcwMDAwIiBmaXJzdF9mcmVfc2Vlbl90aW1lPSIxMzI5NTY0MDgxNjIyOTY1NDAiIGZpcnN0X2ZyZV9zZWVuX3ZlcnNpb249IjEwMC4wLjExODUuNTAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxNTEwNzgxNjciIHN5c3RlbV91cHRpbWVfdGlja3M9IjExNTM2OTg0NzMxIi8-PC9hcHA-PC9yZXF1ZXN0Pg8e:T400,AAABAAEAICAQdAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791859195418,"unified_at":"2026-10-13T02:39:55.418Z","metadata":{"hashes":{"sha256":"7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","sha1":"d1f24bebb41d15b92773cf2b13ab4f46de52160e","md5":"f4f7714b9c3c056794c20ede93593197","sha512":"d44ce144bcdde0f997d62e90775665c0ab1e38fcc3ed8bc384a1bde9775adfd0b270912db26e81ed0caf1bc68a34b8e5de1198fd1d2147fac86df4e8accc0744","ssdeep":"1572864:TIuBcQqtTt03MhuiHaYgXgkHquQQIDm0I5RJwRoPtR:8wc1tV6YgwkHq3QIDm0QJwkR","ssdeep_chunks":["1572864:TIuBcQq","1572864:IuBcQqt","1572864:uBcQqtT","1572864:BcQqtTt","1572864:cQqtTt0","1572864:QqtTt03","1572864:qtTt03M","1572864:tTt03Mh","1572864:Tt03Mhu","1572864:t03Mhui","1572864:03MhuiH","1572864:3MhuiHa","1572864:MhuiHaY","1572864:huiHaYg","1572864:uiHaYgX","1572864:iHaYgXg","1572864:HaYgXgk","1572864:aYgXgkH","1572864:YgXgkHq","1572864:gXgkHqu","1572864:XgkHquQ","1572864:gkHquQQ","1572864:kHquQQI","1572864:HquQQID","1572864:quQQIDm","1572864:uQQIDm0","1572864:QQIDm0I","1572864:QIDm0I5","1572864:IDm0I5R","1572864:Dm0I5RJ","1572864:m0I5RJw","1572864:0I5RJwR","1572864:I5RJwRo","1572864:5RJwRoP","1572864:RJwRoPt","1572864:JwRoPtR","3145728:TIuBcQq","3145728:IuBcQqt","3145728:uBcQqtT","3145728:BcQqtTt","3145728:cQqtTt0","3145728:QqtTt03","3145728:qtTt03M","3145728:tTt03Mh","3145728:Tt03Mhu","3145728:t03Mhui","3145728:03MhuiH","3145728:3MhuiHa","3145728:MhuiHaY","3145728:huiHaYg","3145728:uiHaYgX","3145728:iHaYgXg","3145728:HaYgXgk","3145728:aYgXgkH","3145728:YgXgkHq","3145728:gXgkHqu","3145728:XgkHquQ","3145728:gkHquQQ","3145728:kHquQQI","3145728:HquQQID","3145728:quQQIDm","3145728:uQQIDm0","3145728:QQIDm0I","3145728:QIDm0I5","3145728:IDm0I5R","3145728:Dm0I5RJ","3145728:m0I5RJw","3145728:0I5RJwR","3145728:I5RJwRo","3145728:5RJwRoP","3145728:RJwRoPt","3145728:JwRoPtR","1572864:8wc1tV6","1572864:wc1tV6Y","1572864:c1tV6Yg","1572864:1tV6Ygw","1572864:tV6Ygwk","1572864:V6YgwkH","1572864:6YgwkHq","1572864:YgwkHq3","1572864:gwkHq3Q","1572864:wkHq3QI","1572864:kHq3QID","1572864:Hq3QIDm","1572864:q3QIDm0","1572864:3QIDm0Q","1572864:QIDm0QJ","1572864:IDm0QJw","1572864:Dm0QJwk","1572864:m0QJwkR"],"imphash":"d2c82993d1a616abe994cabd5db7b4f8","pehash":"a8542ddc3de1d35eb24ad53e3faeb7e444c1451d"},"file_info":{"file_name":"yuanbao_v2.371_x64.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":56043749,"entropy":8,"compile_timestamp":"2009-11-06T19:53:27","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1786539216000,"last_seen":1787835204000,"last_multi_scan":1787835204000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":4,"import_count":0,"export_count":0,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":28836,"raw_size":32768},{"name":".rdata","virtual_address":"0x9000","virtual_size":10370,"raw_size":12288},{"name":".data","virtual_address":"0xc000","virtual_size":6440,"raw_size":4096},{"name":".rsrc","virtual_address":"0xe000","virtual_size":4495,"raw_size":8192}],"section_names":[".text",".rdata",".data",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["modular","criminal","rat","changemerat","adware","windows-server-utility","evasive"]},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":120},"sandbox_signatures":{"informative_count":305,"suspicious_count":20,"malicious_count":10,"total":335},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"QD:Adware.GenericKDQ.9522A693EE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Malgent_MSR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"QD:Adware.GenericKDQ.9522A693EE (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Valley.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Backdoor ( 006e4a5e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GenusC.KCA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"QD:Adware.GenericQ","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"ChangemeRAT","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Queries volatile registry keys"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls APIs used for find file/directory path"},{"type":"informative","value":"Contains ability to lookup its own filename"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Copy files into temp folder"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to transfer files using SCP"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Contains ability to transfer files remotely using SFTP"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"informative","value":"YARA signature match - Possible payload download using Office macros"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Discovery","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","identifiers":[{"type":"informative","value":"May contain SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Executes WMI queries"},{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"},{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Persistence","technique":"Bootkit","attack_id":"T1542.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1542/003","identifiers":[{"type":"malicious","value":"Interacts with the primary disk partition (DR0)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"suspicious","value":"Contains ability to update the user profile"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection"},{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Hidden File System","attack_id":"T1564.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/005","identifiers":[{"type":"malicious","value":"Contains virtual file system log filepaths used by malware"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"YARA signature match – PEB traversal"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file is packed with UPX"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"malicious","value":"PE file contains executable resources"},{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Sets a windows hook"},{"type":"malicious","value":"Sets a global windows hook to intercept mouse events"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Able to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Accesses software policy settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"},{"type":"informative","value":"Imports a library used to perform LDAP operation"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate logical drives on the computer"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"malicious","value":"Executes WMI queries in order to detect local security applications"},{"type":"malicious","value":"Reads Antivirus engine related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Identified known pipe name"},{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to move file or directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Queries list of installed browsers"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"},{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Uses cURL to communicate over HTTPS"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Calls an API used to connect to internet"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"informative","value":"Able to use IDE tunneling for remote connection"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains reference to OpenSSL library string"},{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Able to send file to remote server using cURL utility"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Exfiltration","technique":"Exfiltration to Cloud Storage","attack_id":"T1567.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1567/002","identifiers":[{"type":"informative","value":"Able to transfer data to cloud storage service"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Possible payload download using Office macros","description":"YARA signature for payload download using Office macros matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1204.002","id":"yara-28","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-103","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentDirectoryA\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStrings\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\"), Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"sample.bin\"), Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetUserObjectInformationA\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStrings\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"8.2.1.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \")q.jp\", Pattern match: \"www.indigorose.com\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"libz Automatic decompression of compressed files over HTTP is\" (Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")\n Found string \"(SCP SFTP) Enables built-in SSH compression. This is a request,\" (Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")\n Found string \"Enable SSH compression\" (Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")\n Found string \"Error while processing content unencoding: Unknown failure within decompression software.\" (Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")\n Found string \"unknown compression method\" (Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"yuanbao_v2.371_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteService\" (Source: \"00000000-00005176-00000C2C-999559512\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"irsetup.exe\" called \"FindResourceA\" with parameter \"3585\" - (UID: 00000000-00005176)\n \"irsetup.exe\" called \"FindResourceA\" with parameter \"103\" - (UID: 00000000-00005176)\n \"irsetup.exe\" called \"FindResourceA\" with parameter \"143\" - (UID: 00000000-00005176)\n \"MicrosoftEdgeWebview2Setup_908350031_1.exe\" called \"FindResourceW\" with parameter \"102\" - (UID: 00000000-00003932)\n \"MicrosoftEdgeUpdate.exe\" called \"FindResourceW\" with parameter \"188\" - (UID: 00000000-00003044)\n \"MicrosoftEdgeUpdate.exe\" called \"FindResourceW\" with parameter \"190\" - (UID: 00000000-00003044)\n \"MicrosoftEdgeUpdate.exe\" called \"FindResourceW\" with parameter \"189\" - (UID: 00000000-00003044)\n \"MicrosoftEdgeUpdate.exe\" called \"FindResourceW\" with parameter \"188\" - (UID: 00000000-00007664)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"irsetup.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5740064'}\" (UID: 00000000-00005176)\n \"irsetup.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5740224'}\" (UID: 00000000-00005176)\n \"MicrosoftEdgeWebview2Setup_908350031_1.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '13079776'}\" (UID: 00000000-00003932)\n \"MicrosoftEdgeUpdate.exe\" called \"LoadResource with parameter {'hModule': '74776577', 'hResInfo': '74780312'}\" (UID: 00000000-00003044)\n \"MicrosoftEdgeUpdate.exe\" called \"LoadResource with parameter {'hModule': '74776577', 'hResInfo': '74780344'}\" (UID: 00000000-00003044)\n \"MicrosoftEdgeUpdate.exe\" called \"LoadResource with parameter {'hModule': '74776577', 'hResInfo': '74780376'}\" (UID: 00000000-00003044)\n \"MicrosoftEdgeUpdate.exe\" called \"LoadResource with parameter {'hModule': '74776577', 'hResInfo': '74780328'}\" (UID: 00000000-00003044)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"yuanbao_v2.371_x64.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\_ir_sf_temp_0 (UID: 00000000-00006148)\n \"yuanbao_v2.371_x64.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\_ir_sf_temp_0\\ (UID: 00000000-00006148)\n \"irsetup.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\_ir_sf_temp_0 (UID: 00000000-00005176)\n \"MicrosoftEdgeUpdate.exe\" called \"RemoveDirectoryW\" with parameter %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.221.3 (UID: 00000000-00003044)\n \"MicrosoftEdgeUpdate.exe\" called \"RemoveDirectoryW\" with parameter %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\Offline (UID: 00000000-00003044)\n \"MicrosoftEdgeUpdate.exe\" called \"RemoveDirectoryW\" with parameter %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\Install\\{2C5E8545-77C5-41DE-896B-7EA8CF456EE4} (UID: 00000000-00007708)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to lookup its own filename","description":"PathFindFileNameA@SHLWAPI.DLL at 00000000-00005176-39349-6266-004D1FAB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":5,"id":"stream-65","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetKeyValueW\" (Indicator: \"RegSetKeyValue\"; File: \"yuanbao_v2.371_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$28","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"Failed to set filetime %I64d on outfile: SetFileTime failed: GetLastError %u\" (Indicator: \"SetFileTime\"; File: \"00000000-00001308.00000000.128651.00DF1000.00000020.mdmp\")\n Found reference to API \"Failed to set filetime %I64d on outfile: SetFileTime failed: GetLastError %u\" (Indicator: \"SetFileTime\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"SHA384\"; File: \"INetC.dll\")\n file/memory contains long string with (Indicator: \"SHA384\"; File: \"WebProcess.exe\")\n Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00006452-00000CC3-1008050019\")\n Found reference to \"CALG_RC2\" (Indicator: \"RC2\"; File: \"00000000-00001308.00000000.128651.00DF1000.00000020.mdmp\")\n Found reference to \"CALG_HMAC\" (Indicator: \"HMAC\"; File: \"00000000-00001308.00000000.128651.00DF1000.00000020.mdmp\")\n Found reference to \"CALG_HMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")\n Found reference to \"CALG_RC2\" (Indicator: \"RC2\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")\n Found reference to \"ertificateUtil::FindAllCertificatesByOidValue: Will try to find the OID: '1.2.840.113556.1.5.284.7'\" (Indicator: \"Oid\"; Source: \"00000000-00003044.00000000.129665.009C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"$29","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$2c","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"yuanbao_2.77.1.612_x64.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"$2d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"$2e","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"UPX0\" is zero\n Raw size of \".data\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; File: \"yuanbao_v2.371_x64.exe\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; File: \"00000000-00001308.00000000.128651.00DF1000.00000020.mdmp\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; File: \"yuanbao_v2.371_x64.exe\")\n Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; File: \"00000000-00001308.00000000.128651.00DF1000.00000020.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"yuanbao_v2.371_x64.exe\")\n Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001172.00000000.134495.034B0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001308.00000000.128651.009A0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002400.00000000.132170.02730000.00000004.mdmp, 00000000-00002400.00000001.134088.02730000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003044.00000000.129665.009C0000.00000004.mdmp, 00000000-00003044.00000001.131585.009C0000.00000004.mdmp, 00000000-00003044.00000002.133504.009C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$33","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$34","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$35","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00001308.00000000.128651.047C0000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00001308.00000000.128651.047C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00006212-00000C2C-1012221072\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"yuanbao_v2.371_x64.exe\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; File: \"yuanbao_v2.371_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"yuanbao_v2.371_x64.exe\")\n file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"psuser_arm64.dll\")\n file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"psmachine_arm64.dll\")\n file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"psuser.dll\")\n file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"psmachine.dll\")\n file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"MicrosoftEdgeUpdateCore.exe\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005176-00000C2C-999559179\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003044-00000C2C-1026423588\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo() thread failed to start\" (Indicator: \"getaddrinfo\"; File: \"00000000-00001308.00000000.128651.00DF1000.00000020.mdmp\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"yuanbao_v2.371_x64.exe\")\n Found reference to API \"getaddrinfo() thread failed to start\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"yuanbao_v2.371_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00005176-00000C2C-999872890\")\n Found reference to API \"PostMessageA\" (Indicator: \"postmessage\"; Source: \"00000000-00005176-00000C2C-999873840\")\n Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; Source: \"00000000-00005176-00000C2C-999874177\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"yuanbao_v2.371_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"irsetup.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005176)\n \"WebProcess.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006212)\n \"yuanbao_2.77.1.612_x64.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006452)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"irsetup.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005176)\n \"irsetup.exe\" called \"GetDiskFreeSpaceExA\" with parameters (UID: 00000000-00005176)\n \"irsetup.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005176)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"yuanbao_v2.371_x64.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006148)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Calls APIs used for find file/directory path","description":"Observed import api PathFindFileName (Source: ProductHelper.dll)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-183","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"yuanbao_v2.371_x64.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006148)\n \"WebProcess.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006212)\n \"MicrosoftEdgeUpdate.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003044)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"irsetup.exe\" called \"IsWow64Process\" with parameter \"5176\" - (UID: 00000000-00005176)\n \"yuanbao_2.77.1.612_x64.exe\" called \"IsWow64Process\" with parameter \"6452\" - (UID: 00000000-00006452)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$36","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"irsetup.exe\" called \"GetActiveWindow\" (UID: 00000000-00005176)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"yuanbao_v2.371_x64.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006148)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$37","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$38","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WebProcess.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00006212)\n \"MicrosoftEdgeUpdate.exe\" called \"LookupAccountSidW\" with param Name LOCAL SERVICE (UID: 00000000-00007708)\n \"MicrosoftEdgeUpdate.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00007708)\n \"MicrosoftEdgeUpdate.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00007708)\n \"MicrosoftEdgeUpdate.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00007708)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"irsetup.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00005176)\n \"MicrosoftEdgeUpdate.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00007708)\n \"MicrosoftEdgeUpdate.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00002400)\n \"MicrosoftEdgeUpdate.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00001172)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WebProcess.exe\" called \"GetLocaleInfoW\" with parameter \"2048\" - (UID: 00000000-00006212)\n \"report_helper.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001308)\n \"report_helper.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00001308)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: report_helper.exe]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: yuanbao_v2.371_x64.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: ProductHelper.dll]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: MicrosoftEdgeUpdateCore.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"$39","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"$3a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeA@KERNEL32.DLL at 00000000-00005176-39349-7287-0042B6A7\n GetLogicalDriveStringsA@KERNEL32.DLL at 00000000-00005176-39349-7297-0042B48A\n GetLogicalDriveStringsA@KERNEL32.DLL at 00000000-00005176-39349-10706-00451C46\n GetDriveTypeA@KERNEL32.DLL at 00000000-00001308-60270-1147-00E4CF56\n GetDriveTypeW@KERNEL32.DLL at 00000000-00001308-60270-1163-00E5C86C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"$3b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005176-39349-4818-004F5E6A\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005176-39349-4823-004E4E1B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005176-39349-5325-004DDDB1\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005176-39349-6644-004E4E5E\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005176-39349-6692-004F2F5E\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006452-55614-1052-0041704B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006452-55614-2487-0048C38D\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001308-60270-383-00E49F7C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001308-60270-1577-00E5AC27\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003044-64212-496-00DDBC73","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00005176-39349-4792-004F0FD9\n GetTimeZoneInformation@KERNEL32.DLL at 00000000-00001308-60270-825-00E510AB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"$3c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"$3d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00005176-39349-5583-0043E8BE\n GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00005176-39349-5584-0043E94F\n GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00006452-55614-2805-00404F62","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set uninstall data folder:\" (Indicator: \"set \"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")\n Found string \"Set uninstall config file name:\" (Indicator: \"set \"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")\n Found string \"set timeouts for state %d; Total %ld, retry %d maxtry %d\" (Indicator: \"set \"; File: \"00000000-00001308.00000000.128651.00DF1000.00000020.mdmp\")\n Found string \"set as \"ENG\" if none was provided. (iOS and macOS only) If curl is built against Secure Transport, then the certificate string can either be the name of a certifi- cate/private key in the system o\" (Indicator: \"set \"; File: \"00000000-00001308.00000000.128651.00DF1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00005176-39349-6582-004DC8D7\n GetSystemInfo@KERNEL32.DLL at 00000000-00006452-55614-211-00416EAE\n GetSystemInfo@KERNEL32.DLL at 00000000-00006452-55614-393-0045D564\n GetSystemInfo@KERNEL32.DLL at 00000000-00003044-64212-450-00DDAFFC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"yuanbao_v2.371_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"$3f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"WebProcess.exe\" issued a query \"SELECT displayName FROM AntiVirusProduct\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$40","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\NSW9161.TMP\\SYSTEM.DLL\n %TEMP%\\NSW9161.TMP\\PRODUCTHELPER.DLL\n %TEMP%\\NSW9161.TMP\\INETC.DLL\n %PROGRAMFILES%\\(X86)\\MICROSOFT\\EDGEUPDATE\\1.3.251.23\\PSMACHINE.DLL\n %PROGRAMFILES%\\(X86)\\MICROSOFT\\TEMP\\EUD2A0.TMP\\MSEDGEUPDATE.DLL\n %PROGRAMFILES%\\(X86)\\MICROSOFT\\EDGEUPDATE\\1.3.251.23\\MSEDGEUPDATE.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"\"MicrosoftEdgeUpdate.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\"; Key: \"\"; Value: \"\")\n \"MicrosoftEdgeUpdate.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volatile registry keys","description":"\"yuanbao_2.77.1.612_x64.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"yuanbao_2.77.1.612_x64.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\1\"; Key: \"\"; Value: \"\")\n \"MicrosoftEdgeUpdate.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"MicrosoftEdgeUpdate.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\0\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-139","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$42","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"yuanbao_v2.371_x64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"irsetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WebProcess.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"yuanbao_2.77.1.612_x64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"report_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"MicrosoftEdgeUpdate.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WebProcess.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"yuanbao_2.77.1.612_x64.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"MicrosoftEdgeUpdate.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$43","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"psuser_arm64.dll\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"psmachine_arm64.dll\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"psuser.dll\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"psmachine.dll\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"MicrosoftEdgeUpdateCore.exe\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00005176-00000C2C-999531124\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00005176-00000C2C-999531183\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"yuanbao_v2.371_x64.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"yuanbao_v2.371_x64.exe\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"psuser_arm64.dll\")\n file/memory contains long string(File: \"psmachine_arm64.dll\")\n file/memory contains long string(File: \"psuser.dll\")\n file/memory contains long string(File: \"psmachine.dll\")\n file/memory contains long string(File: \"MicrosoftEdgeUpdateCore.exe\")\n file/memory contains long string(File: \"MicrosoftEdgeUpdateComRegisterShell64.exe\")\n file/memory contains long string(File: \"MicrosoftEdgeUpdate.exe\")\n file/memory contains long string(File: \"MicrosoftEdgeComRegisterShellARM64.exe\")\n file/memory contains long string(File: \"libcef.dll\")\n file/memory contains long string(File: \"MicrosoftEdgeUpdateOnDemand.exe\")\n file/memory contains long string(File: \"MicrosoftEdgeUpdateBroker.exe\")\n file/memory contains long string(File: \"CopilotUpdate.exe\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$44","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Accesses software policy settings","description":"\"MicrosoftEdgeUpdate.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"F9388EA2C9B7D632B66A2B0B406DF1D37D3901F6\")\n \"MicrosoftEdgeUpdate.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"F9388EA2C9B7D632B66A2B0B406DF1D37D3901F6\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"MicrosoftEdgeWebview2Setup_908350031_1.exe\" called \"CopyFileW\" to copy %TEMP%\\MicrosoftEdgeWebview2Setup_908350031_1.exe to new location %PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\MicrosoftEdgeUpdateSetup.exe (UID: 00000000-00003932)\n \"MicrosoftEdgeUpdate.exe\" called \"CopyFileW\" to copy %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.251.23\\MicrosoftEdgeUpdate.exe to new location %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe (UID: 00000000-00003044)\n \"MicrosoftEdgeUpdate.exe\" called \"CopyFileW\" to copy %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.251.23\\CopilotUpdate.exe to new location %PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\CopilotUpdate.exe (UID: 00000000-00003044)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$45","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$46","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$47","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"\"irsetup.exe\" called \"MoveFileA\" (UID: 00000000-00005176)","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"112.213.110.210:441\"\n \"129.226.106.210:443\"\n \"4.150.223.96:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"MicrosoftEdgeUpdate_unsigned.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT displayName FROM AntiVirusProduct\" (Source: 00000000-00006212-00002714-1012451414, Indicator: \"select displayname from antivirusproduct\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcess\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")\n Found reference to API \"128474,8116,3143,,CreateProcessW,kernel32.dll,\"00:33:44.703\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003044.00000000.129665.009C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$49","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: yuanbao_v2.371_x64.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: report_helper.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: irsetup.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: libcef.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"$4a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"yuanbao_v2.371_x64.exe\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"yuanbao_v2.371_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"yuanbao_v2.371_x64.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"yuanbao_v2.371_x64.exe\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"yuanbao_v2.371_x64.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")\n Found reference to API \"__crtGetShowWindowMode\" (Indicator: \"ShowWindow\"; File: \"yuanbao_v2.371_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$4b","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"Mapi32.dll\" (Indicator: \"MAPI32.dll\"; File: \"00000000-00006452.00000000.128421.00401000.00000020.mdmp\")\n Found string \"cannot load Mapi32.dll\" (Indicator: \"MAPI32.dll\"; File: \"00000000-00006452.00000000.128421.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-571","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: msedgeupdate.dll)\n Found MoveFileA in import section (Source: report_helper.exe)\n Found MoveFileW in import section (Source: ProductHelper.dll)\n Found MoveFileExW in import section (Source: psmachine_64.dll)\n Found MoveFileExW in import section (Source: psuser_64.dll)\n Found MoveFileExW in import section (Source: psuser_arm64.dll)\n Found MoveFileExW in import section (Source: psmachine_arm64.dll)\n Found MoveFileExW in import section (Source: psuser.dll)\n Found MoveFileExW in import section (Source: psmachine.dll)\n Found MoveFileExW in import section (Source: MicrosoftEdgeUpdateCore.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Copy files into temp folder","description":"\"MicrosoftEdgeWebview2Setup_908350031_1.exe\" copies %TEMP%\\MicrosoftEdgeWebview2Setup_908350031_1.exe to temp folder %PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\MicrosoftEdgeUpdateSetup.exe (UID: 00000000-00003932)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-268","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$4d","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$4e","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$4f","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"ftp@example.com\"\n Pattern match: \"premium-server@thawte.com\"\n Pattern match: \"user@example.com\"\n Pattern match: \"daniel@haxx.se\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; File: \"00000000-00001308.00000000.128651.00DF1000.00000020.mdmp\")\n Found string \"User-Agent: Microsoft Edge Update/1.3.251.23;winhttp\" (Indicator: \"user-agent: \"; Source: \"00000000-00001172.00000000.134495.034B0000.00000004.mdmp\")\n Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$50","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"report_helper.exe\" loaded module \"%WINDIR%\\SysWOW64\\Wldap32.dll\" at 77970000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$51","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"yuanbao_2.77.1.612_x64.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72450000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"$52","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"yuanbao_v2.371_x64.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 770E0000\n \"irsetup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 770E0000\n \"WebProcess.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 770E0000\n \"yuanbao_2.77.1.612_x64.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 770E0000\n \"report_helper.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 770E0000\n \"MicrosoftEdgeWebview2Setup_908350031_1.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 770E0000\n \"MicrosoftEdgeUpdate.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 770E0000\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 56010000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$53","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$54","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$55","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$56","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"KERNEL32.dll\" : \"239\" [Source: msedgeupdate.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$57","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$58","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x16e000\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x174600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x16deea\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x174424\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"psmachine_64.dll\" has high imagebase \"0x180000000\"\n \"psuser_64.dll\" has high imagebase \"0x180000000\"\n \"psuser_arm64.dll\" has high imagebase \"0x180000000\"\n \"psmachine_arm64.dll\" has high imagebase \"0x180000000\"\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" has high imagebase \"0x140000000\"\n \"MicrosoftEdgeComRegisterShellARM64.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\Temp\\report_helper.exe\" [Source: 00000000-00006452-00000C47-7938222580]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$59","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"otheve.beacon.qq.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"yuanbao_2.77.1.612_x64.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"MicrosoftEdgeUpdate.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\WINDOWS\\System32\\wldap32.dll\" (Source: \"00000000-00001308.00000000.128651.009A0000.00000004.mdmp\")\n Found string \"WLDAP32.dll\" (Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")\n Found string \"\" (Source: \"00000000-00001308.00000000.128651.00EAC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"irsetup.exe\" searching for class \"MS_WINHELP\"\n \"yuanbao_2.77.1.612_x64.exe\" searching for class \"#32770\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"irsetup.exe\" sets a windows hook with filter \"WH_CBT\" for thread ID 3700\n \"WebProcess.exe\" sets a global windows hook with filter \"WH_MOUSE_LL\"","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$5c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$5d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1, O=\"DigiCert\n Inc.\", C=US\" (SHA1: 24:96:5A:7D:EF:CC:F6:8B:AA:76:29:C6:ED:CB:3C:65:84:B5:CE:09; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 92:BC:C5:2C:87:F8:30:EB:7A:AB:F7:DB:77:8C:DE:D1:AB:1C:28:D8; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"$5e","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"yuanbao_v2.371_x64.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\irsetup.exe\"\n \"irsetup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\irsetup.dat\"\n \"irsetup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\IRIMG1.JPG\"\n \"irsetup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\IRIMG2.JPG\"\n \"yuanbao_2.77.1.612_x64.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsw9161.tmp\\System.dll\"\n \"yuanbao_2.77.1.612_x64.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsw9161.tmp\\ProductHelper.dll\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00000000-00005176-39349-5501-00438CD1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"yuanbao_v2.371_x64.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"WebProcess.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"yuanbao_2.77.1.612_x64.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"report_helper.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"$5f","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$60","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$61","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$62","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"yuanbao_v2.371_x64.exe\" queries basic process information of the \"C:\\yuanbao_v2.371_x64.exe\" (UID: 6148)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$63","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"yuanbao_2.77.1.612_x64.exe\" called \"NtQueueApcThread\" (UID: 00000000-00006452)\n \"MicrosoftEdgeUpdate.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007912)\n \"MicrosoftEdgeUpdate.exe\" called \"NtQueueApcThread\" (UID: 00000000-00002400)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"yuanbao_v2.371_x64.exe\" reads file \"c:\\yuanbao_v2.371_x64.exe\"\n \"irsetup.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"\n \"irsetup.exe\" reads file \"c:\\yuanbao_v2.371_x64.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$64","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"yuanbao_v2.371_x64.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"yuanbao_v2.371_x64.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"\n \"yuanbao_v2.371_x64.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"yuanbao_v2.371_x64.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"\n \"yuanbao_v2.371_x64.exe\" trying to touch file \"C:\\MSVCP140.DLL\"\n \"yuanbao_v2.371_x64.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\msvcp140.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$65","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$66","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$67","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$68","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"yuanbao_v2.371_x64.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_ir_sf_temp_0\\irsetup.exe\"\n \"yuanbao_v2.371_x64.exe\" writes file \"%temp%\\_ir_sf_temp_0\\irsetup.exe\"\n \"irsetup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_ir_sf_temp_0\\irsetup.dat\"\n \"irsetup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_ir_sf_temp_0\\irimg1.jpg\"\n \"irsetup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_ir_sf_temp_0\\irimg2.jpg\"\n \"irsetup.exe\" writes file \"c:\\program files (x86)\\upload\\uploa\\libcef.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"irsetup.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\irsetup.dat\"\n \"irsetup.exe\" writes a file \"%TEMP%\\_ir_sf_temp_0\\irsetup.dat\"\n \"yuanbao_2.77.1.612_x64.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Tencent\\yuanbao\\Global\\Logs\\app_installer_2026081205.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"psuser_arm64.dll\")\n file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"psmachine_arm64.dll\")\n file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"psuser.dll\")\n file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"psmachine.dll\")\n file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"MicrosoftEdgeUpdateCore.exe\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; File: \"yuanbao_v2.371_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"yuanbao_v2.371_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"$69","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Able to send file to remote server using cURL utility","description":"Found string \"You can specify one -T, --upload-file for each URL on the com- mand line. Each -T, --upload-file + URL pair specifies what to upload and to where. curl also supports \"globbing\" of the -T, --up\" (File: \"00000000-00001308.00000000.128651.00DF1000.00000020.mdmp\")\n Found string \"curl --upload-file \"{file1\nfile2}\" http://www.example.com or even curl -T \"img[1-1000].png\" ftp://ftp.example.com/upload/ When uploading to an SMTP server: the uploaded data is assumed\" (File: \"00000000-00001308.00000000.128651.00DF1000.00000020.mdmp\")\n Found string \"curl --upload-file \"{file1\nfile2}\" http://www.example.com\" (Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1048.003","relevance":3,"id":"string-747","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Able to transfer data to cloud storage service","description":"Found string \"curl --upload-file \"{file1\nfile2}\" http://www.example.com or even curl -T \"img[1-1000].png\" ftp://ftp.example.com/upload/ When uploading to an SMTP server: the uploaded data is assumed\" (File: \"00000000-00001308.00000000.128651.00DF1000.00000020.mdmp\")\n Found string \"curl -T \"img[1-1000].png\" ftp://ftp.example.com/upload/\" (Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1567.002","relevance":1,"id":"string-956","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"MicrosoftEdgeUpdate.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: /OneCollector/1.0/\" - (UID: 00000000-00007912), \"MicrosoftEdgeUpdate.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: /OneCollector/1.0/\" - (UID: 00000000-00002400)\n \"MicrosoftEdgeUpdate.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: /OneCollector/1.0/\" - (UID: 00000000-00001172)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"MicrosoftEdgeUpdate.exe\" called \"InternetReadFile\" with parameter 1024 (UID: 00000000-00007912)\n \"MicrosoftEdgeUpdate.exe\" called \"InternetReadFile\" with parameter 1024 (UID: 00000000-00002400)\n \"MicrosoftEdgeUpdate.exe\" called \"InternetReadFile\" with parameter 1024 (UID: 00000000-00001172)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"yuanbao_2.77.1.612_x64.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"736cad0\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"yuanbao_2.77.1.612_x64.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"736cad0\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"MicrosoftEdgeUpdate.exe\" called \"InternetOpenA\" (UID: 00000000-00007912)\n \"MicrosoftEdgeUpdate.exe\" called \"InternetOpenW\" (UID: 00000000-00007912)\n \"MicrosoftEdgeUpdate.exe\" called \"InternetOpenA\" (UID: 00000000-00002400)\n \"MicrosoftEdgeUpdate.exe\" called \"InternetOpenW\" (UID: 00000000-00002400)\n \"MicrosoftEdgeUpdate.exe\" called \"InternetOpenA\" (UID: 00000000-00001172)\n \"MicrosoftEdgeUpdate.exe\" called \"InternetOpenW\" (UID: 00000000-00001172)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")\n Found reference to API \"WSAStartup failed (%d)\" (Indicator: \"WSAStartup\"; File: \"00000000-00001308.00000000.128651.00DF1000.00000020.mdmp\")\n Found reference to API \"WSAStartup failed (%d)\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"CInternetConnection\" (Indicator: \"InternetConnect\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")\n Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")\n Found reference to API \".?AVCInternetConnection@@\" (Indicator: \"InternetConnect\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"yuanbao_v2.371_x64.exe\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"yuanbao_v2.371_x64.exe\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; File: \"yuanbao_v2.371_x64.exe\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; File: \"yuanbao_v2.371_x64.exe\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")\n Found reference to API \"55596,6088,3237,,InternetReadFile,Wininet.dll,\"00:34:24.234\",RX=0,PX=0\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00002400.00000000.132170.04660000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"yuanbao_v2.371_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionExA\" (Indicator: \"InternetSetOption\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer files using SCP","description":"Observed string: \"eral disabled for security reasons: Since 7.19.4 FILE and SCP are disabled, and since 7.40.0 SMB and SMBS are also disabled. Specifying all or +all enables all protocols on redirect, in- clud\" (Indicator: \" scp \") in Source: 60270-1345-00DF1000","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-577","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"Found string \"plied with OpenSSL. Using --capath can allow OpenSSL-powered\" (Indicator: \"openssl-\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\";mx.l\" [Source: yuanbao_v2.371_x64.exe]\n Observed email domain:\"imap.\" [Source: 60270-590-00E386E0]\n Observed email domain:\"smtp.\" [Source: 60270-590-00E386E0]\n Observed email domain:\"pop3.\" [Source: 60270-590-00E386E0]\n Observed email domain:\"http and rejected by imap.\" [Source: 00000000-00001308.00000000.128651.00E63000.00000002.mdmp]\n Observed email domain:\"pop3.\" [Source: 00000000-00001308.00000000.128651.00E63000.00000002.mdmp]\n Observed email domain:\"smtp.\" [Source: 00000000-00001308.00000000.128651.00E63000.00000002.mdmp]\n Observed email domain:\"imap.\" [Source: 00000000-00001308.00000000.128651.00E63000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"details too long to display","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Identified known pipe name","description":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00003044-00000CCE-1025994911\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":3,"id":"string-735","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://curl.haxx.se\"\n Found HTTPS url \"https://example.com\"\n Found HTTPS url \"https://www.example.com\"\n Found HTTPS url \"https://curl.haxx.sesee\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"129.226.106.210\" on port \"443\"\n HTTPS traffic to \"4.150.223.96\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Network Related","name":"Uses cURL to communicate over HTTPS","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-722","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"report_helper.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – PEB traversal","description":"YARA signature for PEB traversal process \"00000000-00006212\"","origin":"YARA Signature","mitre_attack_id":"T1027.007","relevance":1,"id":"yara-166","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection","description":"Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00005176-39349-7876-0044A4EB\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00005176-39349-10718-0045DDCF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":1,"id":"stream-78","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Remote Access Related","name":"Able to use IDE tunneling for remote connection","description":"$70","origin":"File/Memory","mitre_attack_id":"T1219","relevance":1,"id":"string-883","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"yuanbao_v2.371_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; File: \"yuanbao_v2.371_x64.exe\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; File: \"yuanbao_v2.371_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to transfer files remotely using SFTP","description":"$71","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-578","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$72","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$73","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"DragQueryFileA\" (Source: \"00000000-00005176-00000C2C-999791767\")\n Found string \"GetClipboardData\" (Source: \"00000000-00006212-00000C2C-1011260768\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"yuanbao_v2.371_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00005176-00000C2C-999531141\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00006212-00000C2C-1011233553\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"$74","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegGetValueW\" in file \"yuanbao_v2.371_x64.exe\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: msedgeupdate.dll]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"WebProcess.exe\" tries to directly access volume data \"B:\"\n \"WebProcess.exe\" tries to directly access volume data \"D:\"\n \"WebProcess.exe\" tries to directly access volume data \"E:\"\n \"WebProcess.exe\" tries to directly access volume data \"F:\"\n \"WebProcess.exe\" tries to directly access volume data \"G:\"\n \"WebProcess.exe\" tries to directly access volume data \"H:\"\n \"WebProcess.exe\" tries to directly access volume data \"I:\"\n \"WebProcess.exe\" tries to directly access volume data \"J:\"\n \"WebProcess.exe\" tries to directly access volume data \"K:\"\n \"WebProcess.exe\" tries to directly access volume data \"L:\"\n \"WebProcess.exe\" tries to directly access volume data \"M:\"\n \"WebProcess.exe\" tries to directly access volume data \"N:\"\n \"WebProcess.exe\" tries to directly access volume data \"O:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"irsetup.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 72E90000\n \"MicrosoftEdgeUpdate.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 72300000\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 4EFC0000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$75","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"yuanbao_v2.371_x64.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"irsetup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"WebProcess.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"WebProcess.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"yuanbao_2.77.1.612_x64.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"report_helper.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"MicrosoftEdgeWebview2Setup_908350031_1.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"MicrosoftEdgeUpdate.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"$76","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate logical drives on the computer","description":"\"irsetup.exe\" called \"GetLogicalDriveStringsA\" with parameters {\"nBufferLength\": \"1024\"\n \"lpBuffer\": \"C:\\\\\"}\n \"WebProcess.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"1000\"\n \"lpBuffer\": \"C:\\\\\"}\n \"MicrosoftEdgeUpdate.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"260\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1680","relevance":6,"id":"api-326","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"WebProcess.exe\" called \"GetComputerNameW\" (UID: 00000000-00006212)\n \"MicrosoftEdgeUpdate.exe\" called \"GetComputerNameW\" (UID: 00000000-00003044)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"WebProcess.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"MicrosoftEdgeUpdate.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$77","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"yuanbao_v2.371_x64.exe\")\n Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; File: \"yuanbao_v2.371_x64.exe\")\n Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; File: \"yuanbao_v2.371_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve class object from a DLL object handler","description":"\"psmachine_64.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"psuser_64.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"psuser_arm64.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"psmachine_arm64.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"psuser.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"psmachine.dll\" contains export function called \"DllGetClassObject\" at ordinal 2","origin":"Static Parser","mitre_attack_id":"T1559.001","relevance":1,"id":"static-177","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where all occurrences of % must be doubled when using this op-\" (Indicator: \"where \"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")\n Found string \"where the proxy-name does not match the principal name.\" (Indicator: \"where \"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")\n Found string \"Where to redirect stderr\" (Indicator: \"where \"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir given the current user in your system). On Windows, it then\" (Indicator: \"dir \"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; File: \"yuanbao_v2.371_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname() failed: %s\" (Indicator: \"getsockname\"; File: \"00000000-00001308.00000000.128651.00DF1000.00000020.mdmp\")\n Found reference to API \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\"; File: \"00000000-00001308.00000000.128651.00DF1000.00000020.mdmp\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"yuanbao_v2.371_x64.exe\")\n Found reference to API \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")\n Found reference to API \"getsockname() failed: %s\" (Indicator: \"getsockname\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$78","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 39349-7242-00429139","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"Since 7.19.5, you can append \":[start]-[end]\" to the right of the ad-\" (Indicator: \"[end]\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$79","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"WebProcess.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT displayName FROM AntiVirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00006212-00002714-1012451414\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00007664-00000C2C-1030091465\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"MicrosoftEdgeUpdate.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003044)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: yuanbao_v2.371_x64.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: msedgeupdate.dll]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: ProductHelper.dll]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: MicrosoftEdgeUpdateCore.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$7a","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"00000000-00005176.00000001.128114.00401000.00000040.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00003044.00000000.129665.009C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"yuanbao_v2.371_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; File: \"00000000-00006452.00000000.128421.00401000.00000020.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; File: \"00000000-00006452.00000000.128421.00401000.00000020.mdmp\")\n Found reference to API \"SeCreateSymbolicLinkPrivilege\" (Indicator: \"SeCreateSymbolicLinkPrivilege\"; File: \"00000000-00006452.00000000.128421.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00001172.00000000.134495.034B0000.00000004.mdmp\n Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00002400.00000000.132170.02730000.00000004.mdmp\n 00000000-00002400.00000001.134088.02730000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$7b","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"System Security","name":"Imports a library used to perform LDAP operation","description":"Observed import dll \"wldap32.dll\" which can perform LDAP operation [Source: report_helper.exe]","origin":"Static Parser","mitre_attack_id":"T1069.002","relevance":3,"id":"static-225","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$7c","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"System Security","name":"May contain SSL certificate","description":"\"-----BEGIN CERTIFICATE-----\" (Indicator: \"----begin certificate----\") in Source: 60270-1007-00E42AF0\n \"-----BEGIN CERTIFICATE-----\" (Indicator: \"----begin certificate----\") in Source: 00000000-00001308.00000000.128651.00E63000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1588.004","relevance":1,"id":"string-574","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"yuanbao_v2.371_x64.exe\" opened \"\\Device\\KsecDD\"\n \"WebProcess.exe\" opened \"\\Device\\KsecDD\"\n \"yuanbao_2.77.1.612_x64.exe\" opened \"\\Device\\KsecDD\"\n \"report_helper.exe\" opened \"\\Device\\KsecDD\"\n \"MicrosoftEdgeUpdate.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$7d","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$7e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"update.exe,svchost.exe,smss.exe,csrss.exe,wininit.exe\" (Source: \"00000000-00001308.00000000.128651.047C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"yuanbao_v2.371_x64.exe\")\n Found reference to API \"OpenMutexA\" (Indicator: \"OpenMutex\"; File: \"yuanbao_v2.371_x64.exe\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"yuanbao_v2.371_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00001172.00000000.134495.05150000.00000004.mdmp, Indicator: \"key.com\")\n \".getmicrosoftkey.com1&0\" (Source: 00000000-00002400.00000000.132170.04660000.00000004.mdmp, 00000000-00002400.00000001.134088.04660000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"irsetup.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%TEMP%\\_ir_sf_temp_0\\irsetup.exe]- [targetUID: 00000000-00006148]\n \"ProductHelper.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections\"- Location: [%TEMP%\\nsw9161.tmp\\ProductHelper.dll]- [targetUID: 00000000-00006452]\n \"INetC.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections\"- Location: [%TEMP%\\nsw9161.tmp\\INetC.dll]- [targetUID: 00000000-00006452]\n \"System.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nsw9161.tmp\\System.dll]- [targetUID: 00000000-00006452]\n \"MicrosoftEdgeWebview2Setup_908350031_1.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections\"- Location: [%TEMP%\\MicrosoftEdgeWebview2Setup_908350031_1.exe]- [targetUID: 00000000-00003932]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"modern-wizard.bmp\" has type \"PC bitmap Windows 3.x format 164 x 314 x 4 image size 26376 resolution 2834 x 2834 px/m cbSize 26494 bits offset 118\" and extension \"bmp\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"ConvertSidToStringSidA\" (Source: yuanbao_v2.371_x64.exe, API is part of module: ADVAPI32.DLL)\n Found string \"GetProcessWindowStation\" (Source: yuanbao_v2.371_x64.exe, API is part of module: USER32.DLL)\n Found string \"GetUserObjectInformationA\" (Source: yuanbao_v2.371_x64.exe, API is part of module: USER32.DLL)\n Found string \"GetLastActivePopup\" (Source: yuanbao_v2.371_x64.exe, API is part of module: USER32.DLL)\n Found string \"GetActiveWindow\" (Source: yuanbao_v2.371_x64.exe, API is part of module: USER32.DLL)\n Found string \"system\" (Source: yuanbao_v2.371_x64.exe, API is part of module: MSVCRT.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"$7f","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"$80","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"irsetup.exe\" has a section named \"UPX0\"\n \"irsetup.exe\" has a section named \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"msedgeupdate.dll\" has section name .rsrc with entropy \"7.142768340244925\"\n \"MicrosoftEdgeUpdateSetup.exe\" has section name .rsrc with entropy \"7.985642709321671\"\n \"irsetup.exe\" has section name UPX1 with entropy \"7.930618570341931\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET DROP Spamhaus DROP Listed Traffic Inbound group 24\" (SID: 2400023, Rev: 4791, Severity: 2) categorized as \"Misc Attack\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/23 Antivirus vendors marked sample as malicious (21% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LoadResource@KERNEL32.DLL at 00000000-00005176-39349-4920-004018AC\n FindResourceA@KERNEL32.DLL at 00000000-00005176-39349-4936-00401908\n FindResourceA@KERNEL32.DLL at 00000000-00005176-39349-5034-004B84F5\n FindResourceA@KERNEL32.DLL at 00000000-00005176-39349-5547-004BF9B0\n FindResourceA@KERNEL32.DLL at 00000000-00005176-39349-6125-004B8222\n FindResourceA@KERNEL32.DLL at 00000000-00005176-39349-6326-004C9819\n FindResourceA@KERNEL32.DLL at 00000000-00005176-39349-11076-004B8724\n LockResource@KERNEL32.DLL at 00000000-00005176-39349-11077-004B86EB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$81","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$82","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"WebProcess.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"MICROSOFT-A\"; Value: \"%PROGRAMFILES%\\(x86)\\upload\\uploa\\WebProcess.exe\"), \"MicrosoftEdgeUpdate.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\MICROSOFTEDGEUPDATE.EXE\"), \"MicrosoftEdgeUpdate.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\MICROSOFTEDGEUPDATE.EXE\"; Key: \"DISABLEEXCEPTIONCHAINVALIDATION\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$83","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 129.226.106.210 on port 443 is sent without HTTP header\n TCP traffic to 4.150.223.96 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"MicrosoftEdgeUpdate.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoA@USER32.DLL at 00000000-00005176-39349-5553-004BA711\n SystemParametersInfoA@USER32.DLL at 00000000-00005176-39349-5586-0043F379\n SystemParametersInfoA@USER32.DLL at 00000000-00005176-39349-8915-004C6E33\n SystemParametersInfoW@USER32.DLL at 00000000-00006452-55614-496-00406894","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00001308.00000000.128651.047C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$84","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$85","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"yuanbao_v2.371_x64.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"MicrosoftEdgeUpdate.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$86","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00005176-39349-6165-004BAEB1\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00005176-39349-6188-004BD53E\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00006452-55614-422-00401290","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"irsetup.exe\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$87","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Contains virtual file system log filepaths used by malware","description":"Found reference to API \"default /etc/pki/nssdb). If the NSS PEM PKCS#11 module (lib-\" (Indicator: \"/etc/pki/\"; Source: \"00000000-00001308.00000000.128651.00E63000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.005","relevance":10,"id":"string-503","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"yuanbao_v2.371_x64.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\_ir_sf_temp_0\\irsetup.exe\" __IRAOFF:641570 \"__IRAFN:C:\\yuanbao_v2.371_x64.exe\" \"__IRCT:2\" \"__\" - (UID: 00000000-00006148), \"MicrosoftEdgeUpdate.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /handoff \"appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&app\" - (UID: 00000000-00003044)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"PE file contains executable resources","description":"msedgeupdateres_ml.dll has PE file in resource with name: \"RT_STRING\" and filetype:CLIPPER COFF executable C2 R1 not stripped - version 37 alignment trap enabled","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Reads Antivirus engine related registry keys","description":"\"yuanbao_2.77.1.612_x64.exe\" (Path: \"HKCU\\SOFTWARE\\TENCENT\")\n \"yuanbao_2.77.1.612_x64.exe\" (Path: \"HKCU\\SOFTWARE\\TENCENT\\YUANBAO\")\n \"yuanbao_2.77.1.612_x64.exe\" (Path: \"HKCU\\SOFTWARE\\TENCENT\\YUANBAO\"; Key: \"INSTALLER LANGUAGE\")\n \"yuanbao_2.77.1.612_x64.exe\" (Path: \"HKLM\\SOFTWARE\\TENCENT\\YUANBAO\")","origin":"Registry Access","mitre_attack_id":"T1518.001","relevance":8,"id":"registry-32","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"malicious","category":"Environment Awareness","name":"Sets a global windows hook to intercept mouse events","description":"\"WebProcess.exe\" set a windows hook with filter \"WH_MOUSE_LL\"","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-73","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$88","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"malicious","category":"System Destruction","name":"Interacts with the primary disk partition (DR0)","description":"\"yuanbao_2.77.1.612_x64.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x2d1400","origin":"API Call","mitre_attack_id":"T1542.003","relevance":5,"id":"api-59","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"malicious","category":"System Security","name":"Executes WMI queries in order to detect local security applications","description":"\"WebProcess.exe\" issued a query \"SELECT displayName FROM AntiVirusProduct\"","origin":"API Call","mitre_attack_id":"T1518.001","relevance":7,"id":"api-80","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$89","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Spyware","details_count":6,"details":[{"detail":"Sets a global windows hook to intercept mouse events"},{"detail":"Sets a computer-based training (CBT) hook"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Interacts with the primary disk partition (DR0)"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Executes WMI queries in order to detect local security applications"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Evasive","details_count":7,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping multiple times"},{"detail":"Reads Antivirus engine related registry keys"},{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Attempts to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]}],"intel_graph":{"map":{"Domain:0092531b1f6f94473cc7ff2c020042a2e4f665463014195c6ba337a160557adf":{"type":"Domain","value":"rmonitor.qq.com","verdict":{"verdict":"unknown"}},"Domain:3ae602f12581d758016d04397da2758f78820c6cb04498049d6f9f131a7a25fa":{"type":"Domain","value":"rdelivery.qq.com","verdict":{"verdict":"unknown"}},"Domain:4d64755671167cde5c511a6c08920915c9e35f83eabb2a5afe8a716455d4400e":{"type":"Domain","value":"conn.yuanbao.tencent.com","verdict":{"verdict":"unknown"}},"Domain:4e97fef59ff6c9eced02ff66bafed1d8043d3c660058973fe7371ab7a2d14efe":{"type":"Domain","value":"oth.eve.mdt.qq.com","verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},"Domain:54d2318d212b2fca33c10499daaf57b3ec869ef04777a8d965ccb509a10969ed":{"type":"Domain","value":"yuanbao.tencent.com","verdict":{"verdict":"unknown"}},"Domain:61f98b934ccaf65041c9a020b8d3b3713516b8a35d36d00af62707069475ef95":{"type":"Domain","value":"quic.yuanbao.tencent.com","verdict":{"verdict":"unknown"}},"Domain:6a218ad6ac307e8476c88c8905973300a81a12a15fa9a8d07fc68f8fab3e2762":{"type":"Domain","value":"meeting.tencent.com","verdict":{"verdict":"unknown"}},"Domain:886c3a3b1d8820ba390ea1c6b4985215a59f052a155ee45e823e5ee76e070f10":{"type":"Domain","value":"snowflake.qq.com","verdict":{"verdict":"unknown"}},"Domain:a9b1b62a5a012cc4ad047892165f5012639ef1de8fbf70cfc791428433548f74":{"type":"Domain","value":"otheve.beacon.qq.com","verdict":{"verdict":"unknown"}},"Domain:b396b3a88eba06c50679e93c6ec73981e216a954f949b9506e79c9be3580dd12":{"type":"Domain","value":"down-30005.sz.gfp.tencent-cloud.com","verdict":{"verdict":"unknown"}},"Domain:c3aa384d7a7acbfbaf217705513de6e3084c0baa7e09326445b14df979ce5277":{"type":"Domain","value":"cdnimg.3g.qq.com","verdict":{"verdict":"unknown"}},"Domain:cdd313f07aff25a30fb5784b937a4ad9c6b9441ca8dd271aeba041ab62bc8848":{"type":"Domain","value":"down.qq.com","verdict":{"verdict":"unknown"}},"Domain:d4a189e3c3a620b8111ee5088071e3a8e96c919c672128c9a117396aa1d6c7a7":{"type":"Domain","value":"api.yuanbao.tencent.com","verdict":{"verdict":"unknown"}},"File:01270bef18bc494a05da66c375b48ef2fc32933f28a492986d162b980be15915":{"type":"File","value":"01270bef18bc494a05da66c375b48ef2fc32933f28a492986d162b980be15915"},"File:01276444b8b9c5db0c23dbed8a1490e377e645e455a838aa79900e6e826f28ae":{"type":"File","value":"01276444b8b9c5db0c23dbed8a1490e377e645e455a838aa79900e6e826f28ae"},"File:03cde30a501d7c0b3f841181db20b855d53fc1b646053ed4a8077ef268f63dbc":{"type":"File","value":"03cde30a501d7c0b3f841181db20b855d53fc1b646053ed4a8077ef268f63dbc"},"File:0526afbd369ca23aa7c7365464d81a9b0e78f9654ef1a12e99e17e8133e8661e":{"type":"File","value":"0526afbd369ca23aa7c7365464d81a9b0e78f9654ef1a12e99e17e8133e8661e"},"File:063420f389706a84784b5026b25a9ce6192e7302166bbadf21ab7e1cec139ff5":{"type":"File","value":"063420f389706a84784b5026b25a9ce6192e7302166bbadf21ab7e1cec139ff5"},"File:068f5d8cbe13198f18e025bd65c9cfb5ee1161dde13840f84cb87726a6b5f7f9":{"type":"File","value":"068f5d8cbe13198f18e025bd65c9cfb5ee1161dde13840f84cb87726a6b5f7f9"},"File:06c2b5e2bff2398ea359a55bf703f7e296c6161d71183d50a5ef6ae66a08b5b5":{"type":"File","value":"06c2b5e2bff2398ea359a55bf703f7e296c6161d71183d50a5ef6ae66a08b5b5"},"File:088230830c4a951ff6ddbd8921e79bafa9dd5457ddfcbd91fd265235161b6e1c":{"type":"File","value":"088230830c4a951ff6ddbd8921e79bafa9dd5457ddfcbd91fd265235161b6e1c"},"File:0a93c2e00fbae0277c4a1f7a2d0f4af6c1c53c92bc1e24db30128cc890647971":{"type":"File","value":"0a93c2e00fbae0277c4a1f7a2d0f4af6c1c53c92bc1e24db30128cc890647971"},"File:0c1527f70712c867406cd0b1134032453373715feb8c107798656413449b912f":{"type":"File","value":"0c1527f70712c867406cd0b1134032453373715feb8c107798656413449b912f"},"File:11ff088cbd4a182bfff4c5dbcb0f74b392cbcce96ad25fd8f68eb7aa8516354f":{"type":"File","value":"11ff088cbd4a182bfff4c5dbcb0f74b392cbcce96ad25fd8f68eb7aa8516354f"},"File:15aac3e50cf8aaa3bfb76565f30eeb8d0efa30ab4360140b47c63d9d2f0b660c":{"type":"File","value":"15aac3e50cf8aaa3bfb76565f30eeb8d0efa30ab4360140b47c63d9d2f0b660c"},"File:1878788ea2dc6d205ab4a130172840d9238d9532f9db6f34b8bf5688acf8d6d2":{"type":"File","value":"1878788ea2dc6d205ab4a130172840d9238d9532f9db6f34b8bf5688acf8d6d2"},"File:189357c6f37e7fbcda7e9a91e8ffb327276867c504dd881370be6716bfd23250":{"type":"File","value":"189357c6f37e7fbcda7e9a91e8ffb327276867c504dd881370be6716bfd23250"},"File:19190387546863a4d4483fe07b4aec8bb2ee62274fc40766aa53e99f96d7d18b":{"type":"File","value":"19190387546863a4d4483fe07b4aec8bb2ee62274fc40766aa53e99f96d7d18b"},"File:1c3af925ab59e8884a96da9e24d0f8df9566afd7f16f5de3987170e87cd81b34":{"type":"File","value":"1c3af925ab59e8884a96da9e24d0f8df9566afd7f16f5de3987170e87cd81b34"},"File:1e9f3cbaf3dc4f35aa0a5ee38e70b5e1b32c4e1f43ea10e42f39a216be945178":{"type":"File","value":"1e9f3cbaf3dc4f35aa0a5ee38e70b5e1b32c4e1f43ea10e42f39a216be945178"},"File:244ec7a3a808e9b5206451da5a307c18baa805ec192f560268da3427623da790":{"type":"File","value":"244ec7a3a808e9b5206451da5a307c18baa805ec192f560268da3427623da790"},"File:26141f72749fafe473f67bb250b1483900c19b8845e74b69ba46e6c3e443a377":{"type":"File","value":"26141f72749fafe473f67bb250b1483900c19b8845e74b69ba46e6c3e443a377"},"File:271e39a4dac315a96e5be9898c205a5afe8e2a9d427c25e1a8866157849ac10f":{"type":"File","value":"271e39a4dac315a96e5be9898c205a5afe8e2a9d427c25e1a8866157849ac10f"},"File:29eba285dc948b34ddf926d82fffb746bcdb3b72f5c9f04107c48de9e76a02dd":{"type":"File","value":"29eba285dc948b34ddf926d82fffb746bcdb3b72f5c9f04107c48de9e76a02dd"},"File:2af694fd709a067972c546f6b795514e9141461ee9f39678b92f7d219df5c24d":{"type":"File","value":"2af694fd709a067972c546f6b795514e9141461ee9f39678b92f7d219df5c24d"},"File:2d14a3764c5ab3b8c74771044d80a39154191825d3eee6f317d931d7fede4949":{"type":"File","value":"2d14a3764c5ab3b8c74771044d80a39154191825d3eee6f317d931d7fede4949"},"File:2f448e91a605f3eb09ab0ee0df731ce2cdc30b2243bce5420b0c023cb42dd7e9":{"type":"File","value":"2f448e91a605f3eb09ab0ee0df731ce2cdc30b2243bce5420b0c023cb42dd7e9"},"File:309a3b55e47966fc5975cce0be5c13a828bebcc127e366d58868894736d4887b":{"type":"File","value":"309a3b55e47966fc5975cce0be5c13a828bebcc127e366d58868894736d4887b"},"File:3544c128049ecdf6f0a9bd226862e8d855ea8badd2802b20054512d4c1101e1b":{"type":"File","value":"3544c128049ecdf6f0a9bd226862e8d855ea8badd2802b20054512d4c1101e1b"},"File:35ec821fadfa8209de2886509ae03a1aa6fb7920add0bee5220476bfde0b0f64":{"type":"File","value":"35ec821fadfa8209de2886509ae03a1aa6fb7920add0bee5220476bfde0b0f64"},"File:38f5506c60b3f1284ebfb92c6d0c3d0f6e2ab4386635a91717194a63c3a29a8b":{"type":"File","value":"38f5506c60b3f1284ebfb92c6d0c3d0f6e2ab4386635a91717194a63c3a29a8b"},"File:3afe7f28768b2a9488979905d452fb25f911818d8a292fb6e2a49d2e8a3fe0a5":{"type":"File","value":"3afe7f28768b2a9488979905d452fb25f911818d8a292fb6e2a49d2e8a3fe0a5"},"File:3c20d719daa000b9475eca74b1b76d0cb206c5f9e315cdb0069ca05866532d88":{"type":"File","value":"3c20d719daa000b9475eca74b1b76d0cb206c5f9e315cdb0069ca05866532d88"},"File:3c6224236a9b6dfffc0829c229392acc51d1dff8a86ca37a45249db739e4b780":{"type":"File","value":"3c6224236a9b6dfffc0829c229392acc51d1dff8a86ca37a45249db739e4b780"},"File:3fd7a246b79f473fce494f072b67695a6a9b1a2209bb700dc0dd527c487bbd4e":{"type":"File","value":"3fd7a246b79f473fce494f072b67695a6a9b1a2209bb700dc0dd527c487bbd4e"},"File:408acc13f54a5d242a99a3c0c3ea2e637a0d38aa9c2886ca39dfbf4189cc7095":{"type":"File","value":"408acc13f54a5d242a99a3c0c3ea2e637a0d38aa9c2886ca39dfbf4189cc7095"},"File:4dafed576ef61b4fa0a9fdbc4ba87c77988ee8ddb7a7a7ef25480d4023c9d524":{"type":"File","value":"4dafed576ef61b4fa0a9fdbc4ba87c77988ee8ddb7a7a7ef25480d4023c9d524"},"File:4ed7a33fc981a85697d84033539c75733e5fa1a17c96f16216e446bb8118244b":{"type":"File","value":"4ed7a33fc981a85697d84033539c75733e5fa1a17c96f16216e446bb8118244b"},"File:4eeae8e1abc6282b77f073e87961203bc4aad15234a3f5d379f2874f57d9ae78":{"type":"File","value":"4eeae8e1abc6282b77f073e87961203bc4aad15234a3f5d379f2874f57d9ae78"},"File:4f8320e4617a197a4e99c154e368adeec2c4ef161458f9ce47e0b7d022cf04c3":{"type":"File","value":"4f8320e4617a197a4e99c154e368adeec2c4ef161458f9ce47e0b7d022cf04c3"},"File:502309de3a2aba2bd1459c07265dd6f8d5eb26898a2d86bae2ccbd8d409eeb94":{"type":"File","value":"502309de3a2aba2bd1459c07265dd6f8d5eb26898a2d86bae2ccbd8d409eeb94","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected relationship with a Threat ChangemeRAT","confirmed relationship with a Threat"]},"filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:521823e03f4e0451106740c161f1b72e1975bdbfe040a0debcc55e96562faea7":{"type":"File","value":"521823e03f4e0451106740c161f1b72e1975bdbfe040a0debcc55e96562faea7"},"File:534c28c5b51335871077f862473e07b1d6428d573f011781bf0701125d170200":{"type":"File","value":"534c28c5b51335871077f862473e07b1d6428d573f011781bf0701125d170200"},"File:53fe1680089c27c8c59e5099afc1c7958a0d6c13cee781418c89fd0cc943d0e7":{"type":"File","value":"53fe1680089c27c8c59e5099afc1c7958a0d6c13cee781418c89fd0cc943d0e7"},"File:541c84ff029a76c55a6c3a18c61acfe0c2a06dcd49fd696587c3287e6955ce66":{"type":"File","value":"541c84ff029a76c55a6c3a18c61acfe0c2a06dcd49fd696587c3287e6955ce66"},"File:582b2881f236287cfa73e8d0f4264c9da48fc2d79623d56be36a2e9f60cfc3d6":{"type":"File","value":"582b2881f236287cfa73e8d0f4264c9da48fc2d79623d56be36a2e9f60cfc3d6"},"File:5873fac906613708deb9d38ee9c92d089d662815d7c890fe66824f13a9b758e7":{"type":"File","value":"5873fac906613708deb9d38ee9c92d089d662815d7c890fe66824f13a9b758e7"},"File:596f2e8470f6d73d5054ab55836724640fb08aa0fe7fed95398661a1f42ba129":{"type":"File","value":"596f2e8470f6d73d5054ab55836724640fb08aa0fe7fed95398661a1f42ba129"},"File:5973a78301b6f91a1aa3a51104522f3e529f59b2c434a427695aedbcbe3abab7":{"type":"File","value":"5973a78301b6f91a1aa3a51104522f3e529f59b2c434a427695aedbcbe3abab7"},"File:663753ac5286cdb44990a65c6612768a708b70c29425ea2399e69d2aba742547":{"type":"File","value":"663753ac5286cdb44990a65c6612768a708b70c29425ea2399e69d2aba742547"},"File:66a9c98a32f8fd576a346863a450f247318250cac103a8e4f04ec2d1cd5eee4a":{"type":"File","value":"66a9c98a32f8fd576a346863a450f247318250cac103a8e4f04ec2d1cd5eee4a"},"File:6a730310f3a5f962353bddcdf0c28cef4ab2187bff21a5a9bdd31bbb06c3402a":{"type":"File","value":"6a730310f3a5f962353bddcdf0c28cef4ab2187bff21a5a9bdd31bbb06c3402a"},"File:6d45503c689dc023708fd8c24ab858863a9871e52861b592cfb1d12253f47aff":{"type":"File","value":"6d45503c689dc023708fd8c24ab858863a9871e52861b592cfb1d12253f47aff"},"File:6e9b826564a3dcaf0ce063118adb0b3f6df66a67865817edcba3df4bd69e937b":{"type":"File","value":"6e9b826564a3dcaf0ce063118adb0b3f6df66a67865817edcba3df4bd69e937b"},"File:6f94b94a8c09557eb834140bc45794d981eeeaa4fc6dee2ba6b3dd4bddc0dd9c":{"type":"File","value":"6f94b94a8c09557eb834140bc45794d981eeeaa4fc6dee2ba6b3dd4bddc0dd9c"},"File:73a241198aabcf0f84d92c80f22bee0cf1a837a13fdc0416e72ffdc39b888d0e":{"type":"File","value":"73a241198aabcf0f84d92c80f22bee0cf1a837a13fdc0416e72ffdc39b888d0e"},"File:7409b3cc22e88378433a9cff33e362f19df08075da9bc2dcadf85d9da2a3841e":{"type":"File","value":"7409b3cc22e88378433a9cff33e362f19df08075da9bc2dcadf85d9da2a3841e"},"File:74161c808612aa7613d9e89abd20666508fb5cd6d71d4335e0e9532595ea7515":{"type":"File","value":"74161c808612aa7613d9e89abd20666508fb5cd6d71d4335e0e9532595ea7515"},"File:767d381c7aa5a39191e5c9dcb5e590d56c9741ea80ce2fe11ad85e5e9b2fee5f":{"type":"File","value":"767d381c7aa5a39191e5c9dcb5e590d56c9741ea80ce2fe11ad85e5e9b2fee5f"},"File:78b6ec0464be3aba9513e6d1244d42a0f8ea6d1ddfaf3a24e74ba87576851d33":{"type":"File","value":"78b6ec0464be3aba9513e6d1244d42a0f8ea6d1ddfaf3a24e74ba87576851d33"},"File:7b815065f1af222551d4a4987e21526ec28a2b5549759d042bfe3a2bc3fae7e7":{"type":"File","value":"7b815065f1af222551d4a4987e21526ec28a2b5549759d042bfe3a2bc3fae7e7"},"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776":{"type":"File","value":"7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected relationship with a Threat ChangemeRAT","Sample drops '.exe' file to %TEMP% directory","confirmed relationship with a Threat"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:7bdb3d0d6d675bc02a433a7ca41dd1425b4edf7df26889554e3bcc384f9190ec":{"type":"File","value":"7bdb3d0d6d675bc02a433a7ca41dd1425b4edf7df26889554e3bcc384f9190ec","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected relationship with a Threat ChangemeRAT","confirmed relationship with a Threat"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:7c208692ab4093e9d730519cf2ed64cb90895e1683acf733864aadc1d2de5f47":{"type":"File","value":"7c208692ab4093e9d730519cf2ed64cb90895e1683acf733864aadc1d2de5f47"},"File:7ce95fc474244a44f0fdefb31203364b96851eefa57ba5f028359d6ebfae096d":{"type":"File","value":"7ce95fc474244a44f0fdefb31203364b96851eefa57ba5f028359d6ebfae096d"},"File:7ee38e82a14914db6bfa8fd879366cc4eda36ab87c748d61949fc287397ecbb9":{"type":"File","value":"7ee38e82a14914db6bfa8fd879366cc4eda36ab87c748d61949fc287397ecbb9"},"File:818e439014cca00a9054db87e131e6f4a6bd2a1018806995d7109fe1453972d3":{"type":"File","value":"818e439014cca00a9054db87e131e6f4a6bd2a1018806995d7109fe1453972d3"},"File:81cc678b5842db675179e7111f1c2e4c7678104d48de0e4e6724c0f85cd27889":{"type":"File","value":"81cc678b5842db675179e7111f1c2e4c7678104d48de0e4e6724c0f85cd27889"},"File:84fd6f3c8210bbed89f6f042e77b80b692d035abb6ba499db1ece479a54bcba1":{"type":"File","value":"84fd6f3c8210bbed89f6f042e77b80b692d035abb6ba499db1ece479a54bcba1"},"File:85be9005af63b47840d55cbbf0e587f9f328b9c0fe6749e522e8aec88dc36dee":{"type":"File","value":"85be9005af63b47840d55cbbf0e587f9f328b9c0fe6749e522e8aec88dc36dee"},"File:87136e58703315e012a959e2fcda518a5689f6e975f207e29b69041cda3554fe":{"type":"File","value":"87136e58703315e012a959e2fcda518a5689f6e975f207e29b69041cda3554fe"},"File:8c4a80540b6bbcbef30a4e8c7d1ac504b6fc09db922b4acdfd85c9d5f6f1050e":{"type":"File","value":"8c4a80540b6bbcbef30a4e8c7d1ac504b6fc09db922b4acdfd85c9d5f6f1050e"},"File:90e5ecb87b036b21c59700836219942289fe1133c2d89be7200394452a55f6aa":{"type":"File","value":"90e5ecb87b036b21c59700836219942289fe1133c2d89be7200394452a55f6aa"},"File:92be025d020bb20e7dfd8d442abb872fdd93df219a70c3fd32ae401de6ef8201":{"type":"File","value":"92be025d020bb20e7dfd8d442abb872fdd93df219a70c3fd32ae401de6ef8201"},"File:9571bf8021f98ed64d37228275bd7d80b23740d581857b966b963d6e284c5e47":{"type":"File","value":"9571bf8021f98ed64d37228275bd7d80b23740d581857b966b963d6e284c5e47"},"File:96e1e7ef0566b7725816874e161f190c09e481c39799ce6e5183b48ea9dfd02a":{"type":"File","value":"96e1e7ef0566b7725816874e161f190c09e481c39799ce6e5183b48ea9dfd02a"},"File:9804af9177dd6230656b3087649565a02740d2fa6ea154c34eed19a3e9df0e2c":{"type":"File","value":"9804af9177dd6230656b3087649565a02740d2fa6ea154c34eed19a3e9df0e2c"},"File:9910036633f458b5cf40a9c2f4527425ebdc7be5d2a8c89615645b1004d9cc10":{"type":"File","value":"9910036633f458b5cf40a9c2f4527425ebdc7be5d2a8c89615645b1004d9cc10"},"File:9b2e808699fd2a61abcfe674993d0ffc1a607db38de31a35f1f1dc61d7359e92":{"type":"File","value":"9b2e808699fd2a61abcfe674993d0ffc1a607db38de31a35f1f1dc61d7359e92"},"File:9bb6c4cc3a62206db9313364a34cbf6fe1b755850e4ed15abd8f2f66657a66b2":{"type":"File","value":"9bb6c4cc3a62206db9313364a34cbf6fe1b755850e4ed15abd8f2f66657a66b2"},"File:9c31d6651c311955e0a794910e71323239a9066fdea554461a5ed666a198fbaf":{"type":"File","value":"9c31d6651c311955e0a794910e71323239a9066fdea554461a5ed666a198fbaf"},"File:9c38310e8ae1caede6b7d490a27561a84ba179998bd46e9af6e83fa21a5aa675":{"type":"File","value":"9c38310e8ae1caede6b7d490a27561a84ba179998bd46e9af6e83fa21a5aa675"},"File:9d15832b2f79cedc4f44cd01658a057b6f23556f78486a40cf0f092bb297f9e0":{"type":"File","value":"9d15832b2f79cedc4f44cd01658a057b6f23556f78486a40cf0f092bb297f9e0"},"File:9f8fc77edf5c4affc6441d38b4dbd195145ea9b249c133e2337b2c6ac825b594":{"type":"File","value":"9f8fc77edf5c4affc6441d38b4dbd195145ea9b249c133e2337b2c6ac825b594"},"File:a3a9db1fe202f3b44565ddaf9970235d9e3f4f9cf5c9e3719a3eee484920cc0d":{"type":"File","value":"a3a9db1fe202f3b44565ddaf9970235d9e3f4f9cf5c9e3719a3eee484920cc0d"},"File:a5d9da7626046fe00d3d3fd0868aabe55b0a9ce9327e6d1563c5859fbeee08bb":{"type":"File","value":"a5d9da7626046fe00d3d3fd0868aabe55b0a9ce9327e6d1563c5859fbeee08bb"},"File:a7818c1e0dad1cbba4d17809688887adeeafe940a3cb53a6aeabdfcd196f7258":{"type":"File","value":"a7818c1e0dad1cbba4d17809688887adeeafe940a3cb53a6aeabdfcd196f7258"},"File:a80ab41f6a6b13e60840528b13a1ea591d4ae7029ce3dc637f3589223b9b9d84":{"type":"File","value":"a80ab41f6a6b13e60840528b13a1ea591d4ae7029ce3dc637f3589223b9b9d84"},"File:a8d492fc3eb59d69c9d304e360f9467fba7dd6ddb783ca9596457a7c28affa94":{"type":"File","value":"a8d492fc3eb59d69c9d304e360f9467fba7dd6ddb783ca9596457a7c28affa94"},"File:a9dad33fb69efc3171a05ebe62d127191be634b97bdb8c2d7f5e269a89588ed8":{"type":"File","value":"a9dad33fb69efc3171a05ebe62d127191be634b97bdb8c2d7f5e269a89588ed8"},"File:ab552f9f4e58f5b4c2d9160dff7aa98ad544f52f428ee039970061d38e088e74":{"type":"File","value":"ab552f9f4e58f5b4c2d9160dff7aa98ad544f52f428ee039970061d38e088e74"},"File:ae2c105573d58144bc5d842ae76dbfaccedc633f76e95fcbca2c151602cbd087":{"type":"File","value":"ae2c105573d58144bc5d842ae76dbfaccedc633f76e95fcbca2c151602cbd087"},"File:b745969a5ab4820e1f1744e6c925ce0c79afa9c11022f763120c0785a0b7e99a":{"type":"File","value":"b745969a5ab4820e1f1744e6c925ce0c79afa9c11022f763120c0785a0b7e99a"},"File:b766796a5017e4552be3e8e482d986452022c5b85e3aec5a7541cfb200bf99d1":{"type":"File","value":"b766796a5017e4552be3e8e482d986452022c5b85e3aec5a7541cfb200bf99d1"},"File:ba98f24b2604c711e5e3097898a9e20989008a8f567728dc53e1a1fba8dcb51c":{"type":"File","value":"ba98f24b2604c711e5e3097898a9e20989008a8f567728dc53e1a1fba8dcb51c"},"File:bc0c4fb550fa0b53e3e9f7b73bbb92a6bb49ad4bc94bc0cb305ce349dec4e9cc":{"type":"File","value":"bc0c4fb550fa0b53e3e9f7b73bbb92a6bb49ad4bc94bc0cb305ce349dec4e9cc"},"File:bc2af5657a85bc656bdce044e1c65339556b01008cf15309f025354a9f5d830d":{"type":"File","value":"bc2af5657a85bc656bdce044e1c65339556b01008cf15309f025354a9f5d830d"},"File:c1229d6b90642fc45b2391a6d155207997d976e813cfc2dc9548230d2d9e42e5":{"type":"File","value":"c1229d6b90642fc45b2391a6d155207997d976e813cfc2dc9548230d2d9e42e5"},"File:c4651d574bccb16edea929f0083d167c1eab821a00f4923edb35036e6acc3aad":{"type":"File","value":"c4651d574bccb16edea929f0083d167c1eab821a00f4923edb35036e6acc3aad"},"File:cc7dca7df4778e9e0f4ee62ab8be39bf82d74fe3b4e4ec44f5f3fc50dcc6f7af":{"type":"File","value":"cc7dca7df4778e9e0f4ee62ab8be39bf82d74fe3b4e4ec44f5f3fc50dcc6f7af"},"File:ccb23fe647cd684b92af67f756dba545310c6b724ac3183478b14583fd492af3":{"type":"File","value":"ccb23fe647cd684b92af67f756dba545310c6b724ac3183478b14583fd492af3"},"File:d1b30f2e9abcd76d7407c4fb537b7b69030554894b2f780cd6eaecf82a38aced":{"type":"File","value":"d1b30f2e9abcd76d7407c4fb537b7b69030554894b2f780cd6eaecf82a38aced"},"File:d22af3f652bea7fe2c788784ca5f5b631e2ca01cd589fbe31f9ead7ff4436632":{"type":"File","value":"d22af3f652bea7fe2c788784ca5f5b631e2ca01cd589fbe31f9ead7ff4436632"},"File:d60a247f5d8b9d2b89947eb46563190d712b081fb358ba9b6dcc48e2a1cb2299":{"type":"File","value":"d60a247f5d8b9d2b89947eb46563190d712b081fb358ba9b6dcc48e2a1cb2299"},"File:d63d88e2d51286e53cdabd427e13472f52c562c5c3a84ec569f022d9db192b1f":{"type":"File","value":"d63d88e2d51286e53cdabd427e13472f52c562c5c3a84ec569f022d9db192b1f"},"File:d686b60b911e277ce0b9077cc719d0e23fd44c9959c4f14fa75bd895afe3c620":{"type":"File","value":"d686b60b911e277ce0b9077cc719d0e23fd44c9959c4f14fa75bd895afe3c620"},"File:da43aa92760030e9418e4ee7e40e936b9d7b5bfd1b130b42d45c2ba6da3ecff5":{"type":"File","value":"da43aa92760030e9418e4ee7e40e936b9d7b5bfd1b130b42d45c2ba6da3ecff5"},"File:dd4f738fdbaf151149df52149ce35338d239e779eea83d85bd17d88471ef08a4":{"type":"File","value":"dd4f738fdbaf151149df52149ce35338d239e779eea83d85bd17d88471ef08a4"},"File:e318023ae97eb75399209e1eec3b9f3d0f4f0b9588a750da23052af97b598c07":{"type":"File","value":"e318023ae97eb75399209e1eec3b9f3d0f4f0b9588a750da23052af97b598c07"},"File:ee1a0dfed1f3263ced6ad013dbb0b9aac529df72c09bab5a1b3f0311cfcb2cb7":{"type":"File","value":"ee1a0dfed1f3263ced6ad013dbb0b9aac529df72c09bab5a1b3f0311cfcb2cb7"},"File:efcfc847bf72e41b44833ad2c1cff42f908fb130174e72e485cc36603514003f":{"type":"File","value":"efcfc847bf72e41b44833ad2c1cff42f908fb130174e72e485cc36603514003f"},"File:f2c0eec61fb10af7432c31fe970c313bc56df7d60c61ead72153fded0a386239":{"type":"File","value":"f2c0eec61fb10af7432c31fe970c313bc56df7d60c61ead72153fded0a386239"},"File:f2c9707b8819b73b46ef132aad79fa2dd00ebf13f2811b247ccebdcc861b1931":{"type":"File","value":"f2c9707b8819b73b46ef132aad79fa2dd00ebf13f2811b247ccebdcc861b1931"},"File:f5cb7bef4416ff9f9bc89334afef573a1e5c7b94caa4eb9f0d03f3ab0b56d40c":{"type":"File","value":"f5cb7bef4416ff9f9bc89334afef573a1e5c7b94caa4eb9f0d03f3ab0b56d40c"},"File:f67224220a00f18c77ac1e52afdef691dad0c5ace6dc38839fa0a58f4c843834":{"type":"File","value":"f67224220a00f18c77ac1e52afdef691dad0c5ace6dc38839fa0a58f4c843834"},"File:f95a7d7cd5c3257d694cc5ceb105348aa75522dd1a9b479338721f0cad44cd77":{"type":"File","value":"f95a7d7cd5c3257d694cc5ceb105348aa75522dd1a9b479338721f0cad44cd77"},"File:ff7a234f9a2db1a97248c760eddf56e5c6fc2fb591e1f05a2ced40517b564c56":{"type":"File","value":"ff7a234f9a2db1a97248c760eddf56e5c6fc2fb591e1f05a2ced40517b564c56"},"Ip:112.213.110.210":{"type":"Ip","value":"112.213.110.210"},"Ip:129.226.106.210":{"type":"Ip","value":"129.226.106.210"},"Ip:4.150.223.96":{"type":"Ip","value":"4.150.223.96"},"Threat:2234d6c8bd33d89d16d3986c2569a120b7d553cd6c8d9225c9f0b606f1879fd6":{"type":"Threat","value":"ChangemeRAT","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected relationship with a Threat ChangemeRAT","confirmed relationship with a Threat"]}}},"chains":[{"id":"1542517469810194429","root":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","edges":[],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected relationship with a Threat ChangemeRAT","Sample drops '.exe' file to %TEMP% directory","confirmed relationship with a Threat"]}},{"id":"1542517451892127585","root":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","edges":[{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:0092531b1f6f94473cc7ff2c020042a2e4f665463014195c6ba337a160557adf"}],"verdict":{"verdict":"unknown"}},{"id":"1542517451908904869","root":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","edges":[{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:3ae602f12581d758016d04397da2758f78820c6cb04498049d6f9f131a7a25fa"}],"verdict":{"verdict":"unknown"}},{"id":"1542517451917293506","root":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","edges":[{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:4d64755671167cde5c511a6c08920915c9e35f83eabb2a5afe8a716455d4400e"}],"verdict":{"verdict":"unknown"}},{"id":"1542517509956755622","root":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","edges":[{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:4e97fef59ff6c9eced02ff66bafed1d8043d3c660058973fe7371ab7a2d14efe"}],"verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},{"id":"1542517451896321911","root":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","edges":[{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:54d2318d212b2fca33c10499daaf57b3ec869ef04777a8d965ccb509a10969ed"}],"verdict":{"verdict":"unknown"}},{"id":"1542517451904710552","root":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","edges":[{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:61f98b934ccaf65041c9a020b8d3b3713516b8a35d36d00af62707069475ef95"}],"verdict":{"verdict":"unknown"}},{"id":"1542517451929876463","root":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","edges":[{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:6a218ad6ac307e8476c88c8905973300a81a12a15fa9a8d07fc68f8fab3e2762"}],"verdict":{"verdict":"unknown"}},{"id":"1542517451921487826","root":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","edges":[{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:886c3a3b1d8820ba390ea1c6b4985215a59f052a155ee45e823e5ee76e070f10"}],"verdict":{"verdict":"unknown"}},{"id":"1542517451913099185","root":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","edges":[{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:a9b1b62a5a012cc4ad047892165f5012639ef1de8fbf70cfc791428433548f74"}],"verdict":{"verdict":"unknown"}},{"id":"1542517451917293498","root":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","edges":[{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:b396b3a88eba06c50679e93c6ec73981e216a954f949b9506e79c9be3580dd12"}],"verdict":{"verdict":"unknown"}},{"id":"1542517451896321910","root":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","edges":[{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:c3aa384d7a7acbfbaf217705513de6e3084c0baa7e09326445b14df979ce5277"}],"verdict":{"verdict":"unknown"}},{"id":"1542517451917293504","root":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","edges":[{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:cdd313f07aff25a30fb5784b937a4ad9c6b9441ca8dd271aeba041ab62bc8848"}],"verdict":{"verdict":"unknown"}},{"id":"1542517451908904867","root":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","edges":[{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:d4a189e3c3a620b8111ee5088071e3a8e96c919c672128c9a117396aa1d6c7a7"}],"verdict":{"verdict":"unknown"}},{"id":"1542517514974269699","root":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","edges":[{"edge_kind":"memory","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:7bdb3d0d6d675bc02a433a7ca41dd1425b4edf7df26889554e3bcc384f9190ec"},{"edge_kind":"extracted","from_key":"File:7bdb3d0d6d675bc02a433a7ca41dd1425b4edf7df26889554e3bcc384f9190ec","to_key":"File:502309de3a2aba2bd1459c07265dd6f8d5eb26898a2d86bae2ccbd8d409eeb94"},{"edge_kind":"is_threat","from_key":"File:502309de3a2aba2bd1459c07265dd6f8d5eb26898a2d86bae2ccbd8d409eeb94","to_key":"Threat:2234d6c8bd33d89d16d3986c2569a120b7d553cd6c8d9225c9f0b606f1879fd6"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected","confirmed relationship with a Threat"]}},{"id":"sandbox_network","root":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","edges":[{"edge_kind":"contacted_ip","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Ip:112.213.110.210"},{"edge_kind":"contacted_ip","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Ip:129.226.106.210"},{"edge_kind":"contacted_ip","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Ip:4.150.223.96"},{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:6a218ad6ac307e8476c88c8905973300a81a12a15fa9a8d07fc68f8fab3e2762"},{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:54d2318d212b2fca33c10499daaf57b3ec869ef04777a8d965ccb509a10969ed"},{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:3ae602f12581d758016d04397da2758f78820c6cb04498049d6f9f131a7a25fa"},{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:886c3a3b1d8820ba390ea1c6b4985215a59f052a155ee45e823e5ee76e070f10"},{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:4e97fef59ff6c9eced02ff66bafed1d8043d3c660058973fe7371ab7a2d14efe"},{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:b396b3a88eba06c50679e93c6ec73981e216a954f949b9506e79c9be3580dd12"},{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:a9b1b62a5a012cc4ad047892165f5012639ef1de8fbf70cfc791428433548f74"},{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:0092531b1f6f94473cc7ff2c020042a2e4f665463014195c6ba337a160557adf"},{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:d4a189e3c3a620b8111ee5088071e3a8e96c919c672128c9a117396aa1d6c7a7"},{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:61f98b934ccaf65041c9a020b8d3b3713516b8a35d36d00af62707069475ef95"},{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:cdd313f07aff25a30fb5784b937a4ad9c6b9441ca8dd271aeba041ab62bc8848"},{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:c3aa384d7a7acbfbaf217705513de6e3084c0baa7e09326445b14df979ce5277"},{"edge_kind":"contacted_domain","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"Domain:4d64755671167cde5c511a6c08920915c9e35f83eabb2a5afe8a716455d4400e"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","edges":[{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:502309de3a2aba2bd1459c07265dd6f8d5eb26898a2d86bae2ccbd8d409eeb94"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:efcfc847bf72e41b44833ad2c1cff42f908fb130174e72e485cc36603514003f"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:a7818c1e0dad1cbba4d17809688887adeeafe940a3cb53a6aeabdfcd196f7258"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:6f94b94a8c09557eb834140bc45794d981eeeaa4fc6dee2ba6b3dd4bddc0dd9c"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:66a9c98a32f8fd576a346863a450f247318250cac103a8e4f04ec2d1cd5eee4a"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:35ec821fadfa8209de2886509ae03a1aa6fb7920add0bee5220476bfde0b0f64"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:26141f72749fafe473f67bb250b1483900c19b8845e74b69ba46e6c3e443a377"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:78b6ec0464be3aba9513e6d1244d42a0f8ea6d1ddfaf3a24e74ba87576851d33"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:8c4a80540b6bbcbef30a4e8c7d1ac504b6fc09db922b4acdfd85c9d5f6f1050e"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:767d381c7aa5a39191e5c9dcb5e590d56c9741ea80ce2fe11ad85e5e9b2fee5f"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:244ec7a3a808e9b5206451da5a307c18baa805ec192f560268da3427623da790"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:541c84ff029a76c55a6c3a18c61acfe0c2a06dcd49fd696587c3287e6955ce66"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:d22af3f652bea7fe2c788784ca5f5b631e2ca01cd589fbe31f9ead7ff4436632"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:663753ac5286cdb44990a65c6612768a708b70c29425ea2399e69d2aba742547"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:53fe1680089c27c8c59e5099afc1c7958a0d6c13cee781418c89fd0cc943d0e7"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:90e5ecb87b036b21c59700836219942289fe1133c2d89be7200394452a55f6aa"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:da43aa92760030e9418e4ee7e40e936b9d7b5bfd1b130b42d45c2ba6da3ecff5"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:03cde30a501d7c0b3f841181db20b855d53fc1b646053ed4a8077ef268f63dbc"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:a8d492fc3eb59d69c9d304e360f9467fba7dd6ddb783ca9596457a7c28affa94"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:29eba285dc948b34ddf926d82fffb746bcdb3b72f5c9f04107c48de9e76a02dd"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:8c4a80540b6bbcbef30a4e8c7d1ac504b6fc09db922b4acdfd85c9d5f6f1050e"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:ba98f24b2604c711e5e3097898a9e20989008a8f567728dc53e1a1fba8dcb51c"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:7ee38e82a14914db6bfa8fd879366cc4eda36ab87c748d61949fc287397ecbb9"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:3fd7a246b79f473fce494f072b67695a6a9b1a2209bb700dc0dd527c487bbd4e"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:3afe7f28768b2a9488979905d452fb25f911818d8a292fb6e2a49d2e8a3fe0a5"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:4ed7a33fc981a85697d84033539c75733e5fa1a17c96f16216e446bb8118244b"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:3c6224236a9b6dfffc0829c229392acc51d1dff8a86ca37a45249db739e4b780"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:818e439014cca00a9054db87e131e6f4a6bd2a1018806995d7109fe1453972d3"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:ab552f9f4e58f5b4c2d9160dff7aa98ad544f52f428ee039970061d38e088e74"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:9c31d6651c311955e0a794910e71323239a9066fdea554461a5ed666a198fbaf"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:f2c9707b8819b73b46ef132aad79fa2dd00ebf13f2811b247ccebdcc861b1931"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:87136e58703315e012a959e2fcda518a5689f6e975f207e29b69041cda3554fe"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:84fd6f3c8210bbed89f6f042e77b80b692d035abb6ba499db1ece479a54bcba1"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:ae2c105573d58144bc5d842ae76dbfaccedc633f76e95fcbca2c151602cbd087"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:cc7dca7df4778e9e0f4ee62ab8be39bf82d74fe3b4e4ec44f5f3fc50dcc6f7af"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:521823e03f4e0451106740c161f1b72e1975bdbfe040a0debcc55e96562faea7"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:81cc678b5842db675179e7111f1c2e4c7678104d48de0e4e6724c0f85cd27889"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:5973a78301b6f91a1aa3a51104522f3e529f59b2c434a427695aedbcbe3abab7"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:9d15832b2f79cedc4f44cd01658a057b6f23556f78486a40cf0f092bb297f9e0"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:3c20d719daa000b9475eca74b1b76d0cb206c5f9e315cdb0069ca05866532d88"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:4dafed576ef61b4fa0a9fdbc4ba87c77988ee8ddb7a7a7ef25480d4023c9d524"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:534c28c5b51335871077f862473e07b1d6428d573f011781bf0701125d170200"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:f95a7d7cd5c3257d694cc5ceb105348aa75522dd1a9b479338721f0cad44cd77"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:9bb6c4cc3a62206db9313364a34cbf6fe1b755850e4ed15abd8f2f66657a66b2"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:c4651d574bccb16edea929f0083d167c1eab821a00f4923edb35036e6acc3aad"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:2af694fd709a067972c546f6b795514e9141461ee9f39678b92f7d219df5c24d"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:d63d88e2d51286e53cdabd427e13472f52c562c5c3a84ec569f022d9db192b1f"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:063420f389706a84784b5026b25a9ce6192e7302166bbadf21ab7e1cec139ff5"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:f5cb7bef4416ff9f9bc89334afef573a1e5c7b94caa4eb9f0d03f3ab0b56d40c"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:2f448e91a605f3eb09ab0ee0df731ce2cdc30b2243bce5420b0c023cb42dd7e9"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:a3a9db1fe202f3b44565ddaf9970235d9e3f4f9cf5c9e3719a3eee484920cc0d"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:a80ab41f6a6b13e60840528b13a1ea591d4ae7029ce3dc637f3589223b9b9d84"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:ee1a0dfed1f3263ced6ad013dbb0b9aac529df72c09bab5a1b3f0311cfcb2cb7"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:1878788ea2dc6d205ab4a130172840d9238d9532f9db6f34b8bf5688acf8d6d2"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:4eeae8e1abc6282b77f073e87961203bc4aad15234a3f5d379f2874f57d9ae78"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:f2c0eec61fb10af7432c31fe970c313bc56df7d60c61ead72153fded0a386239"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:9f8fc77edf5c4affc6441d38b4dbd195145ea9b249c133e2337b2c6ac825b594"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:01270bef18bc494a05da66c375b48ef2fc32933f28a492986d162b980be15915"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:c1229d6b90642fc45b2391a6d155207997d976e813cfc2dc9548230d2d9e42e5"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:271e39a4dac315a96e5be9898c205a5afe8e2a9d427c25e1a8866157849ac10f"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:ccb23fe647cd684b92af67f756dba545310c6b724ac3183478b14583fd492af3"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:0526afbd369ca23aa7c7365464d81a9b0e78f9654ef1a12e99e17e8133e8661e"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:5873fac906613708deb9d38ee9c92d089d662815d7c890fe66824f13a9b758e7"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:9804af9177dd6230656b3087649565a02740d2fa6ea154c34eed19a3e9df0e2c"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:7b815065f1af222551d4a4987e21526ec28a2b5549759d042bfe3a2bc3fae7e7"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:d1b30f2e9abcd76d7407c4fb537b7b69030554894b2f780cd6eaecf82a38aced"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:2d14a3764c5ab3b8c74771044d80a39154191825d3eee6f317d931d7fede4949"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:9c38310e8ae1caede6b7d490a27561a84ba179998bd46e9af6e83fa21a5aa675"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:408acc13f54a5d242a99a3c0c3ea2e637a0d38aa9c2886ca39dfbf4189cc7095"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:b745969a5ab4820e1f1744e6c925ce0c79afa9c11022f763120c0785a0b7e99a"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:01276444b8b9c5db0c23dbed8a1490e377e645e455a838aa79900e6e826f28ae"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:74161c808612aa7613d9e89abd20666508fb5cd6d71d4335e0e9532595ea7515"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:6d45503c689dc023708fd8c24ab858863a9871e52861b592cfb1d12253f47aff"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:4f8320e4617a197a4e99c154e368adeec2c4ef161458f9ce47e0b7d022cf04c3"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:85be9005af63b47840d55cbbf0e587f9f328b9c0fe6749e522e8aec88dc36dee"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:1c3af925ab59e8884a96da9e24d0f8df9566afd7f16f5de3987170e87cd81b34"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:0c1527f70712c867406cd0b1134032453373715feb8c107798656413449b912f"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:9b2e808699fd2a61abcfe674993d0ffc1a607db38de31a35f1f1dc61d7359e92"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:1e9f3cbaf3dc4f35aa0a5ee38e70b5e1b32c4e1f43ea10e42f39a216be945178"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:582b2881f236287cfa73e8d0f4264c9da48fc2d79623d56be36a2e9f60cfc3d6"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:068f5d8cbe13198f18e025bd65c9cfb5ee1161dde13840f84cb87726a6b5f7f9"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:d686b60b911e277ce0b9077cc719d0e23fd44c9959c4f14fa75bd895afe3c620"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:309a3b55e47966fc5975cce0be5c13a828bebcc127e366d58868894736d4887b"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:6e9b826564a3dcaf0ce063118adb0b3f6df66a67865817edcba3df4bd69e937b"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:ff7a234f9a2db1a97248c760eddf56e5c6fc2fb591e1f05a2ced40517b564c56"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:e318023ae97eb75399209e1eec3b9f3d0f4f0b9588a750da23052af97b598c07"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:73a241198aabcf0f84d92c80f22bee0cf1a837a13fdc0416e72ffdc39b888d0e"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:96e1e7ef0566b7725816874e161f190c09e481c39799ce6e5183b48ea9dfd02a"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:6a730310f3a5f962353bddcdf0c28cef4ab2187bff21a5a9bdd31bbb06c3402a"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:7409b3cc22e88378433a9cff33e362f19df08075da9bc2dcadf85d9da2a3841e"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:15aac3e50cf8aaa3bfb76565f30eeb8d0efa30ab4360140b47c63d9d2f0b660c"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:7ce95fc474244a44f0fdefb31203364b96851eefa57ba5f028359d6ebfae096d"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:7c208692ab4093e9d730519cf2ed64cb90895e1683acf733864aadc1d2de5f47"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:dd4f738fdbaf151149df52149ce35338d239e779eea83d85bd17d88471ef08a4"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:0a93c2e00fbae0277c4a1f7a2d0f4af6c1c53c92bc1e24db30128cc890647971"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:f67224220a00f18c77ac1e52afdef691dad0c5ace6dc38839fa0a58f4c843834"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:06c2b5e2bff2398ea359a55bf703f7e296c6161d71183d50a5ef6ae66a08b5b5"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:bc0c4fb550fa0b53e3e9f7b73bbb92a6bb49ad4bc94bc0cb305ce349dec4e9cc"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:b766796a5017e4552be3e8e482d986452022c5b85e3aec5a7541cfb200bf99d1"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:3544c128049ecdf6f0a9bd226862e8d855ea8badd2802b20054512d4c1101e1b"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:bc2af5657a85bc656bdce044e1c65339556b01008cf15309f025354a9f5d830d"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:088230830c4a951ff6ddbd8921e79bafa9dd5457ddfcbd91fd265235161b6e1c"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:38f5506c60b3f1284ebfb92c6d0c3d0f6e2ab4386635a91717194a63c3a29a8b"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:a9dad33fb69efc3171a05ebe62d127191be634b97bdb8c2d7f5e269a89588ed8"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:189357c6f37e7fbcda7e9a91e8ffb327276867c504dd881370be6716bfd23250"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:a5d9da7626046fe00d3d3fd0868aabe55b0a9ce9327e6d1563c5859fbeee08bb"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:9910036633f458b5cf40a9c2f4527425ebdc7be5d2a8c89615645b1004d9cc10"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:92be025d020bb20e7dfd8d442abb872fdd93df219a70c3fd32ae401de6ef8201"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:596f2e8470f6d73d5054ab55836724640fb08aa0fe7fed95398661a1f42ba129"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:d60a247f5d8b9d2b89947eb46563190d712b081fb358ba9b6dcc48e2a1cb2299"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:11ff088cbd4a182bfff4c5dbcb0f74b392cbcce96ad25fd8f68eb7aa8516354f"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:9571bf8021f98ed64d37228275bd7d80b23740d581857b966b963d6e284c5e47"},{"edge_kind":"extracted","from_key":"File:7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","to_key":"File:19190387546863a4d4483fe07b4aec8bb2ee62274fc40766aa53e99f96d7d18b"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":17,"spawned_processes_count":17,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":77,"imported_dlls_count":154,"dropped_files_count":0,"extracted_files_count":113,"files_written_count":154,"files_deleted_count":0,"registry_keys_created_count":51,"registry_keys_modified_count":0,"registry_keys_deleted_count":6,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":57,"embedded_ips_count":0,"embedded_domains_count":13,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":13,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["modular","criminal","rat","changemerat","adware","windows-server-utility","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6a7c6cc9ff43e55ebf04ad45","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"QD:Adware.GenericKDQ","contacted_countries":["HKG","USA"],"submit_name":"yuanbao_v2.371_x64.exe","analysis_start_time":"2026-08-12T12:53:40+00:00","indicators_count":{"informative":304,"suspicious":135,"malicious":15},"tags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"112.213.110.210","port":441,"protocol":"TCP","country":"Hong Kong SAR China","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"address":"129.226.106.210","port":443,"protocol":"TCP","country":"Hong Kong SAR China","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"address":"4.150.223.96","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]}],"dns_resolutions":[{"domain":"meeting.tencent.com","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"yuanbao.tencent.com","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"rdelivery.qq.com","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"snowflake.qq.com","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"oth.eve.mdt.qq.com","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"down-30005.sz.gfp.tencent-cloud.com","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"otheve.beacon.qq.com","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"domain":"rmonitor.qq.com","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"api.yuanbao.tencent.com","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"quic.yuanbao.tencent.com","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"down.qq.com","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"cdnimg.3g.qq.com","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"conn.yuanbao.tencent.com","sources":[{"report_type":"qsp","report_id":""}]}],"http_requests":null,"embedded_domains":[{"value":"meeting.tencent.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"yuanbao.tencent.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"rdelivery.qq.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"snowflake.qq.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"oth.eve.mdt.qq.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"down-30005.sz.gfp.tencent-cloud.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"otheve.beacon.qq.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"rmonitor.qq.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"api.yuanbao.tencent.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"quic.yuanbao.tencent.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"down.qq.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"cdnimg.3g.qq.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"conn.yuanbao.tencent.com","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}],"processes":[{"pid":6148,"ppid":0,"name":"yuanbao_v2.371_x64.exe","command_line":"","sha256":"7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776","normalized_path":"C:\\yuanbao_v2.371_x64.exe","uid":"00000000-00006148","icon":"$8a"},{"pid":5176,"ppid":6148,"name":"irsetup.exe","command_line":"__IRAOFF:641570 \"__IRAFN:C:\\yuanbao_v2.371_x64.exe\" \"__IRCT:2\" \"__IRTSS:0\" \"__IRSID:S-1-5-21-735145574-3570218355-1207367261-1001\"","sha256":"a7818c1e0dad1cbba4d17809688887adeeafe940a3cb53a6aeabdfcd196f7258","normalized_path":"%TEMP%\\_ir_sf_temp_0\\irsetup.exe","parent_uid":"00000000-00006148","uid":"00000000-00005176"},{"pid":6212,"ppid":5176,"name":"WebProcess.exe","command_line":"","sha256":"9571bf8021f98ed64d37228275bd7d80b23740d581857b966b963d6e284c5e47","normalized_path":"%PROGRAMFILES%\\(x86)\\upload\\uploa\\WebProcess.exe","parent_uid":"00000000-00005176","uid":"00000000-00006212"},{"pid":6452,"ppid":5176,"name":"yuanbao_2.77.1.612_x64.exe","command_line":"","sha256":"d3c7455cb9edfb70063c95f4b5ff36f980d4e299e07ccdd321304b537238ca51","normalized_path":"%PROGRAMFILES%\\(x86)\\upload\\uploa\\yuanbao_2.77.1.612_x64.exe","parent_uid":"00000000-00005176","uid":"00000000-00006452"},{"pid":1308,"ppid":6452,"name":"report_helper.exe","command_line":"--connect-timeout 3 --location --request POST \"https://otheve.beacon.qq.com/analytics/v2_upload\" --header \"Content-Type: application/json\" --data-raw \"{\\\"common\\\": {\\\"A2\\\": \\\"00000000000000000001\\\", \\\"A3\\\": \\\"00000000000000000001\\\", \\\"A23\\\": \\\"7001\\\", \\\"A153\\\": \\\"00000000000000000001\\\", \\\"HY99\\\": \\\"00000000000000000001\\\", \\\"HY502\\\": \\\"1\\\", \\\"HY501\\\": \\\"\\\"}, \\\"events\\\": [{\\\"eventCode\\\": \\\"install_init\\\", \\\"eventTime\\\": \\\"1786539254000\\\"}], \\\"appVersion\\\": \\\"2.77.1.612\\\", \\\"sdkId\\\": \\\"js\\\", \\\"sdkVersion\\\": \\\"\\\", \\\"mainAppKey\\\": \\\"0WIN06DPC0UV5DHL\\\", \\\"platformId\\\": \\\"3\\\"}\"","sha256":"6f94b94a8c09557eb834140bc45794d981eeeaa4fc6dee2ba6b3dd4bddc0dd9c","normalized_path":"%WINDIR%\\Temp\\report_helper.exe","parent_uid":"00000000-00006452","uid":"00000000-00001308"},{"pid":3932,"ppid":6452,"name":"MicrosoftEdgeWebview2Setup_908350031_1.exe","command_line":"/silent /install","sha256":"8c4a80540b6bbcbef30a4e8c7d1ac504b6fc09db922b4acdfd85c9d5f6f1050e","normalized_path":"%TEMP%\\MicrosoftEdgeWebview2Setup_908350031_1.exe","parent_uid":"00000000-00006452","uid":"00000000-00003932"},{"pid":3044,"ppid":3932,"name":"MicrosoftEdgeUpdate.exe","command_line":"/silent /install \"appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers\"","sha256":"66a9c98a32f8fd576a346863a450f247318250cac103a8e4f04ec2d1cd5eee4a","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00003932","uid":"00000000-00003044"},{"pid":7664,"ppid":3044,"name":"MicrosoftEdgeUpdate.exe","command_line":"/regsvc","sha256":"66a9c98a32f8fd576a346863a450f247318250cac103a8e4f04ec2d1cd5eee4a","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00003044","uid":"00000000-00007664"},{"pid":4704,"ppid":3044,"name":"MicrosoftEdgeUpdate.exe","command_line":"/regserver","sha256":"66a9c98a32f8fd576a346863a450f247318250cac103a8e4f04ec2d1cd5eee4a","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00003044","uid":"00000000-00004704"},{"pid":5904,"ppid":4704,"name":"MicrosoftEdgeUpdateComRegisterShell64.exe","command_line":"","sha256":"26141f72749fafe473f67bb250b1483900c19b8845e74b69ba46e6c3e443a377","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.251.23\\MicrosoftEdgeUpdateComRegisterShell64.exe","parent_uid":"00000000-00004704","uid":"00000000-00005904"},{"pid":6516,"ppid":4704,"name":"MicrosoftEdgeUpdateComRegisterShell64.exe","command_line":"","sha256":"26141f72749fafe473f67bb250b1483900c19b8845e74b69ba46e6c3e443a377","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.251.23\\MicrosoftEdgeUpdateComRegisterShell64.exe","parent_uid":"00000000-00004704","uid":"00000000-00006516"},{"pid":8188,"ppid":4704,"name":"MicrosoftEdgeUpdateComRegisterShell64.exe","command_line":"","sha256":"26141f72749fafe473f67bb250b1483900c19b8845e74b69ba46e6c3e443a377","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.251.23\\MicrosoftEdgeUpdateComRegisterShell64.exe","parent_uid":"00000000-00004704","uid":"00000000-00008188"},{"pid":7912,"ppid":3044,"name":"MicrosoftEdgeUpdate.exe","command_line":"$8b","sha256":"66a9c98a32f8fd576a346863a450f247318250cac103a8e4f04ec2d1cd5eee4a","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00003044","uid":"00000000-00007912"},{"pid":7672,"ppid":3044,"name":"MicrosoftEdgeUpdate.exe","command_line":"/handoff \"appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers\" /installsource otherinstallcmd /sessionid \"{D46917E9-92A0-47D7-B113-05548D712E84}\" /silent","sha256":"66a9c98a32f8fd576a346863a450f247318250cac103a8e4f04ec2d1cd5eee4a","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00003044","uid":"00000000-00007672"},{"pid":7708,"ppid":0,"name":"MicrosoftEdgeUpdate.exe","command_line":"/svc","sha256":"66a9c98a32f8fd576a346863a450f247318250cac103a8e4f04ec2d1cd5eee4a","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","uid":"00000000-00007708","icon":"$8c"},{"pid":2400,"ppid":7708,"name":"MicrosoftEdgeUpdate.exe","command_line":"$8d","sha256":"66a9c98a32f8fd576a346863a450f247318250cac103a8e4f04ec2d1cd5eee4a","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","parent_uid":"00000000-00007708","uid":"00000000-00002400"},{"pid":1172,"ppid":0,"name":"MicrosoftEdgeUpdate.exe","command_line":"/ua /installsource scheduler","sha256":"66a9c98a32f8fd576a346863a450f247318250cac103a8e4f04ec2d1cd5eee4a","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","uid":"00000000-00001172","icon":"$8e"}],"all_imported_dlls":["profapi.dll","WinTypes.dll","msvcr120.dll","wintrust.dll","ncrypt.dll","dhcpcsvc.dll","msvcp140.dll","msIso.dll","CoreMessaging.dll","dxgi.dll","wbemsvc.dll","ucrtbase.dll","ws2_32.dll","nsi.dll","wininet.dll","slwga.dll","gdi32.dll","uxtheme.dll","pcacli.dll","mdmregistration.dll","nlaapi.dll","msvfw32.dll","schannel.dll","wow64cpu.dll","shlwapi.dll","msasn1.dll","gpapi.dll","iertutil.dll","xmllite.dll","ProductHelper.dll","netutils.dll","msvcrt.dll","wbemcomn.dll","sfc_os.dll","msvcp_win.dll","version.dll","dinput8.dll","psmachine.dll","bcryptprimitives.dll","winmmbase.dll","riched20.dll","ntasn1.dll","kernel32.dll","cryptbase.dll","VxSSL32.dll","vcruntime140.dll","propsys.dll","dwmapi.dll","pnrpnsp.dll","winhttp.dll","fwbase.dll","cryptsp.dll","msvcp120.dll","dnsapi.dll","rasadhlp.dll","msedgeupdate.dll","wtsapi32.dll","sppc.dll","shell32.dll","combase.dll","aepic.dll","InputHost.dll","shfolder.dll","comdlg32.dll","devenum.dll","System.dll","webio.dll","msvcp110_win.dll","vcruntime140_1.dll","TextInputFramework.dll","psapi.dll","userenv.dll","tiptsf.dll","winnsi.dll","ntdll.dll","sspicli.dll","SHCore.dll","oleaut32.dll","INetC.dll","dmcmnutils.dll","fltLib.dll","mswsock.dll","WindowsCodecs.dll","psmachine_64.dll","win32u.dll","sechost.dll","powrprof.dll","IPHLPAPI.DLL","winrnr.dll","wkscli.dll","wow64win.dll","cldapi.dll","fastprox.dll","IconCodecService.dll","kernel.appcore.dll","setupapi.dll","crypt32.dll","avicap32.dll","VxSSL64.dll","bcrypt.dll","netapi32.dll","GdiPlus.dll","msdmo.dll","CoreUIComponents.dll","rsaenh.dll","devobj.dll","dpapi.dll","cryptnet.dll","gdi32full.dll","edputil.dll","samcli.dll","NapiNSP.dll","FirewallAPI.dll","usp10.dll","mpr.dll","wow64.dll","KernelBase.dll","ole32.dll","msctf.dll","netprofm.dll","atlthunk.dll","windows.storage.dll","imm32.dll","Windows.StateRepositoryPS.dll","imagehlp.dll","wbemprox.dll","fwpolicyiomgr.dll","OnDemandConnRouteHelper.dll","npmproxy.dll","cfgmgr32.dll","ntmarta.dll","Wldap32.dll","msxml6.dll","wldp.dll","apphelp.dll","oleacc.dll","msls31.dll","mskeyprotect.dll","clbcatq.dll","urlmon.dll","oledlg.dll","dhcpcsvc6.dll","comctl32.dll","winsta.dll","advapi32.dll","winmm.dll","libcef.dll","FWPUCLNT.DLL","taskschd.dll","ncryptsslp.dll","secur32.dll","dsreg.dll","user32.dll","rpcrt4.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"502309de3a2aba2bd1459c07265dd6f8d5eb26898a2d86bae2ccbd8d409eeb94","sha256":"502309de3a2aba2bd1459c07265dd6f8d5eb26898a2d86bae2ccbd8d409eeb94","verdict":"malicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"libcef.dll","sha256":"efcfc847bf72e41b44833ad2c1cff42f908fb130174e72e485cc36603514003f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"irsetup.exe","sha256":"a7818c1e0dad1cbba4d17809688887adeeafe940a3cb53a6aeabdfcd196f7258","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"report_helper.exe","sha256":"6f94b94a8c09557eb834140bc45794d981eeeaa4fc6dee2ba6b3dd4bddc0dd9c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"MicrosoftEdgeUpdate.exe","sha256":"66a9c98a32f8fd576a346863a450f247318250cac103a8e4f04ec2d1cd5eee4a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"MicrosoftEdgeComRegisterShellARM64.exe","sha256":"35ec821fadfa8209de2886509ae03a1aa6fb7920add0bee5220476bfde0b0f64","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"MicrosoftEdgeUpdateComRegisterShell64.exe","sha256":"26141f72749fafe473f67bb250b1483900c19b8845e74b69ba46e6c3e443a377","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"MicrosoftEdgeUpdateCore.exe","sha256":"78b6ec0464be3aba9513e6d1244d42a0f8ea6d1ddfaf3a24e74ba87576851d33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"MicrosoftEdgeUpdateSetup.exe","sha256":"8c4a80540b6bbcbef30a4e8c7d1ac504b6fc09db922b4acdfd85c9d5f6f1050e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdate.dll","sha256":"767d381c7aa5a39191e5c9dcb5e590d56c9741ea80ce2fe11ad85e5e9b2fee5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"psmachine.dll","sha256":"244ec7a3a808e9b5206451da5a307c18baa805ec192f560268da3427623da790","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"psmachine_64.dll","sha256":"541c84ff029a76c55a6c3a18c61acfe0c2a06dcd49fd696587c3287e6955ce66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"psmachine_arm64.dll","sha256":"d22af3f652bea7fe2c788784ca5f5b631e2ca01cd589fbe31f9ead7ff4436632","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"psuser.dll","sha256":"663753ac5286cdb44990a65c6612768a708b70c29425ea2399e69d2aba742547","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"psuser_64.dll","sha256":"53fe1680089c27c8c59e5099afc1c7958a0d6c13cee781418c89fd0cc943d0e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"psuser_arm64.dll","sha256":"90e5ecb87b036b21c59700836219942289fe1133c2d89be7200394452a55f6aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Web.exe","sha256":"da43aa92760030e9418e4ee7e40e936b9d7b5bfd1b130b42d45c2ba6da3ecff5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"yuanbao_2.77.1.612_x64.exe","sha256":"03cde30a501d7c0b3f841181db20b855d53fc1b646053ed4a8077ef268f63dbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"INetC.dll","sha256":"a8d492fc3eb59d69c9d304e360f9467fba7dd6ddb783ca9596457a7c28affa94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"ProductHelper.dll","sha256":"29eba285dc948b34ddf926d82fffb746bcdb3b72f5c9f04107c48de9e76a02dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"MicrosoftEdgeWebview2Setup_908350031_1.exe","sha256":"8c4a80540b6bbcbef30a4e8c7d1ac504b6fc09db922b4acdfd85c9d5f6f1050e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"MicrosoftEdgeUpdate.log","sha256":"ba98f24b2604c711e5e3097898a9e20989008a8f567728dc53e1a1fba8dcb51c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"CopilotUpdate.exe","sha256":"7ee38e82a14914db6bfa8fd879366cc4eda36ab87c748d61949fc287397ecbb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"MicrosoftEdgeUpdateBroker.exe","sha256":"3fd7a246b79f473fce494f072b67695a6a9b1a2209bb700dc0dd527c487bbd4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"MicrosoftEdgeUpdateOnDemand.exe","sha256":"3afe7f28768b2a9488979905d452fb25f911818d8a292fb6e2a49d2e8a3fe0a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_af.dll","sha256":"4ed7a33fc981a85697d84033539c75733e5fa1a17c96f16216e446bb8118244b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_am.dll","sha256":"3c6224236a9b6dfffc0829c229392acc51d1dff8a86ca37a45249db739e4b780","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_ar.dll","sha256":"818e439014cca00a9054db87e131e6f4a6bd2a1018806995d7109fe1453972d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_as.dll","sha256":"ab552f9f4e58f5b4c2d9160dff7aa98ad544f52f428ee039970061d38e088e74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_az.dll","sha256":"9c31d6651c311955e0a794910e71323239a9066fdea554461a5ed666a198fbaf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_bg.dll","sha256":"f2c9707b8819b73b46ef132aad79fa2dd00ebf13f2811b247ccebdcc861b1931","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_bn-IN.dll","sha256":"87136e58703315e012a959e2fcda518a5689f6e975f207e29b69041cda3554fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_bn.dll","sha256":"84fd6f3c8210bbed89f6f042e77b80b692d035abb6ba499db1ece479a54bcba1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_bs.dll","sha256":"ae2c105573d58144bc5d842ae76dbfaccedc633f76e95fcbca2c151602cbd087","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_ca-Es-VALENCIA.dll","sha256":"cc7dca7df4778e9e0f4ee62ab8be39bf82d74fe3b4e4ec44f5f3fc50dcc6f7af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_ca.dll","sha256":"521823e03f4e0451106740c161f1b72e1975bdbfe040a0debcc55e96562faea7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_cs.dll","sha256":"81cc678b5842db675179e7111f1c2e4c7678104d48de0e4e6724c0f85cd27889","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_cy.dll","sha256":"5973a78301b6f91a1aa3a51104522f3e529f59b2c434a427695aedbcbe3abab7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_da.dll","sha256":"9d15832b2f79cedc4f44cd01658a057b6f23556f78486a40cf0f092bb297f9e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_de.dll","sha256":"3c20d719daa000b9475eca74b1b76d0cb206c5f9e315cdb0069ca05866532d88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_el.dll","sha256":"4dafed576ef61b4fa0a9fdbc4ba87c77988ee8ddb7a7a7ef25480d4023c9d524","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_en-GB.dll","sha256":"534c28c5b51335871077f862473e07b1d6428d573f011781bf0701125d170200","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_en.dll","sha256":"f95a7d7cd5c3257d694cc5ceb105348aa75522dd1a9b479338721f0cad44cd77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_es-419.dll","sha256":"9bb6c4cc3a62206db9313364a34cbf6fe1b755850e4ed15abd8f2f66657a66b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_es.dll","sha256":"c4651d574bccb16edea929f0083d167c1eab821a00f4923edb35036e6acc3aad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_et.dll","sha256":"2af694fd709a067972c546f6b795514e9141461ee9f39678b92f7d219df5c24d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_eu.dll","sha256":"d63d88e2d51286e53cdabd427e13472f52c562c5c3a84ec569f022d9db192b1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_fa.dll","sha256":"063420f389706a84784b5026b25a9ce6192e7302166bbadf21ab7e1cec139ff5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_fi.dll","sha256":"f5cb7bef4416ff9f9bc89334afef573a1e5c7b94caa4eb9f0d03f3ab0b56d40c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_fil.dll","sha256":"2f448e91a605f3eb09ab0ee0df731ce2cdc30b2243bce5420b0c023cb42dd7e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_fr-CA.dll","sha256":"a3a9db1fe202f3b44565ddaf9970235d9e3f4f9cf5c9e3719a3eee484920cc0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_fr.dll","sha256":"a80ab41f6a6b13e60840528b13a1ea591d4ae7029ce3dc637f3589223b9b9d84","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_ga.dll","sha256":"ee1a0dfed1f3263ced6ad013dbb0b9aac529df72c09bab5a1b3f0311cfcb2cb7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_gd.dll","sha256":"1878788ea2dc6d205ab4a130172840d9238d9532f9db6f34b8bf5688acf8d6d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_gl.dll","sha256":"4eeae8e1abc6282b77f073e87961203bc4aad15234a3f5d379f2874f57d9ae78","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_gu.dll","sha256":"f2c0eec61fb10af7432c31fe970c313bc56df7d60c61ead72153fded0a386239","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_hi.dll","sha256":"9f8fc77edf5c4affc6441d38b4dbd195145ea9b249c133e2337b2c6ac825b594","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_hr.dll","sha256":"01270bef18bc494a05da66c375b48ef2fc32933f28a492986d162b980be15915","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_hu.dll","sha256":"c1229d6b90642fc45b2391a6d155207997d976e813cfc2dc9548230d2d9e42e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_id.dll","sha256":"271e39a4dac315a96e5be9898c205a5afe8e2a9d427c25e1a8866157849ac10f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_is.dll","sha256":"ccb23fe647cd684b92af67f756dba545310c6b724ac3183478b14583fd492af3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_it.dll","sha256":"0526afbd369ca23aa7c7365464d81a9b0e78f9654ef1a12e99e17e8133e8661e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_iw.dll","sha256":"5873fac906613708deb9d38ee9c92d089d662815d7c890fe66824f13a9b758e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_ja.dll","sha256":"9804af9177dd6230656b3087649565a02740d2fa6ea154c34eed19a3e9df0e2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_ka.dll","sha256":"7b815065f1af222551d4a4987e21526ec28a2b5549759d042bfe3a2bc3fae7e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_kk.dll","sha256":"d1b30f2e9abcd76d7407c4fb537b7b69030554894b2f780cd6eaecf82a38aced","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_km.dll","sha256":"2d14a3764c5ab3b8c74771044d80a39154191825d3eee6f317d931d7fede4949","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_kn.dll","sha256":"9c38310e8ae1caede6b7d490a27561a84ba179998bd46e9af6e83fa21a5aa675","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_ko.dll","sha256":"408acc13f54a5d242a99a3c0c3ea2e637a0d38aa9c2886ca39dfbf4189cc7095","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_kok.dll","sha256":"b745969a5ab4820e1f1744e6c925ce0c79afa9c11022f763120c0785a0b7e99a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_lb.dll","sha256":"01276444b8b9c5db0c23dbed8a1490e377e645e455a838aa79900e6e826f28ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_lo.dll","sha256":"74161c808612aa7613d9e89abd20666508fb5cd6d71d4335e0e9532595ea7515","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_lt.dll","sha256":"6d45503c689dc023708fd8c24ab858863a9871e52861b592cfb1d12253f47aff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_lv.dll","sha256":"4f8320e4617a197a4e99c154e368adeec2c4ef161458f9ce47e0b7d022cf04c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_mi.dll","sha256":"85be9005af63b47840d55cbbf0e587f9f328b9c0fe6749e522e8aec88dc36dee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_mk.dll","sha256":"1c3af925ab59e8884a96da9e24d0f8df9566afd7f16f5de3987170e87cd81b34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_ml.dll","sha256":"0c1527f70712c867406cd0b1134032453373715feb8c107798656413449b912f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_mr.dll","sha256":"9b2e808699fd2a61abcfe674993d0ffc1a607db38de31a35f1f1dc61d7359e92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_ms.dll","sha256":"1e9f3cbaf3dc4f35aa0a5ee38e70b5e1b32c4e1f43ea10e42f39a216be945178","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_mt.dll","sha256":"582b2881f236287cfa73e8d0f4264c9da48fc2d79623d56be36a2e9f60cfc3d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_nb.dll","sha256":"068f5d8cbe13198f18e025bd65c9cfb5ee1161dde13840f84cb87726a6b5f7f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_ne.dll","sha256":"d686b60b911e277ce0b9077cc719d0e23fd44c9959c4f14fa75bd895afe3c620","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_nl.dll","sha256":"309a3b55e47966fc5975cce0be5c13a828bebcc127e366d58868894736d4887b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_nn.dll","sha256":"6e9b826564a3dcaf0ce063118adb0b3f6df66a67865817edcba3df4bd69e937b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_or.dll","sha256":"ff7a234f9a2db1a97248c760eddf56e5c6fc2fb591e1f05a2ced40517b564c56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_pa.dll","sha256":"e318023ae97eb75399209e1eec3b9f3d0f4f0b9588a750da23052af97b598c07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_pl.dll","sha256":"73a241198aabcf0f84d92c80f22bee0cf1a837a13fdc0416e72ffdc39b888d0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_pt-BR.dll","sha256":"96e1e7ef0566b7725816874e161f190c09e481c39799ce6e5183b48ea9dfd02a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_pt-PT.dll","sha256":"6a730310f3a5f962353bddcdf0c28cef4ab2187bff21a5a9bdd31bbb06c3402a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_quz.dll","sha256":"7409b3cc22e88378433a9cff33e362f19df08075da9bc2dcadf85d9da2a3841e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_ro.dll","sha256":"15aac3e50cf8aaa3bfb76565f30eeb8d0efa30ab4360140b47c63d9d2f0b660c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_ru.dll","sha256":"7ce95fc474244a44f0fdefb31203364b96851eefa57ba5f028359d6ebfae096d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_sk.dll","sha256":"7c208692ab4093e9d730519cf2ed64cb90895e1683acf733864aadc1d2de5f47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_sl.dll","sha256":"dd4f738fdbaf151149df52149ce35338d239e779eea83d85bd17d88471ef08a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_sq.dll","sha256":"0a93c2e00fbae0277c4a1f7a2d0f4af6c1c53c92bc1e24db30128cc890647971","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_sr-Cyrl-BA.dll","sha256":"f67224220a00f18c77ac1e52afdef691dad0c5ace6dc38839fa0a58f4c843834","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_sr-Cyrl-RS.dll","sha256":"06c2b5e2bff2398ea359a55bf703f7e296c6161d71183d50a5ef6ae66a08b5b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_sr-Latn-RS.dll","sha256":"bc0c4fb550fa0b53e3e9f7b73bbb92a6bb49ad4bc94bc0cb305ce349dec4e9cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_sr.dll","sha256":"b766796a5017e4552be3e8e482d986452022c5b85e3aec5a7541cfb200bf99d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_sv.dll","sha256":"3544c128049ecdf6f0a9bd226862e8d855ea8badd2802b20054512d4c1101e1b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_ta.dll","sha256":"bc2af5657a85bc656bdce044e1c65339556b01008cf15309f025354a9f5d830d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_te.dll","sha256":"088230830c4a951ff6ddbd8921e79bafa9dd5457ddfcbd91fd265235161b6e1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_th.dll","sha256":"38f5506c60b3f1284ebfb92c6d0c3d0f6e2ab4386635a91717194a63c3a29a8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_tr.dll","sha256":"a9dad33fb69efc3171a05ebe62d127191be634b97bdb8c2d7f5e269a89588ed8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_tt.dll","sha256":"189357c6f37e7fbcda7e9a91e8ffb327276867c504dd881370be6716bfd23250","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_ug.dll","sha256":"a5d9da7626046fe00d3d3fd0868aabe55b0a9ce9327e6d1563c5859fbeee08bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_uk.dll","sha256":"9910036633f458b5cf40a9c2f4527425ebdc7be5d2a8c89615645b1004d9cc10","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_ur.dll","sha256":"92be025d020bb20e7dfd8d442abb872fdd93df219a70c3fd32ae401de6ef8201","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_vi.dll","sha256":"596f2e8470f6d73d5054ab55836724640fb08aa0fe7fed95398661a1f42ba129","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_zh-CN.dll","sha256":"d60a247f5d8b9d2b89947eb46563190d712b081fb358ba9b6dcc48e2a1cb2299","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"msedgeupdateres_zh-TW.dll","sha256":"11ff088cbd4a182bfff4c5dbcb0f74b392cbcce96ad25fd8f68eb7aa8516354f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"WebProcess.exe","sha256":"9571bf8021f98ed64d37228275bd7d80b23740d581857b966b963d6e284c5e47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"System.dll","sha256":"19190387546863a4d4483fe07b4aec8bb2ee62274fc40766aa53e99f96d7d18b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\irsetup.exe","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\irsetup.dat","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG1.JPG","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG2.JPG","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\upload\\uploa\\libcef.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\upload\\uploa\\msvcp120.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\upload\\uploa\\msvcr120.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\upload\\uploa\\Process.JSON","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\upload\\uploa\\Web.exe","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\upload\\uploa\\WebProcess.exe","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\upload\\uploa\\yuanbao_2.77.1.612_x64.exe","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%TEMP%\\nsm90D4.tmp","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%TEMP%\\nsw9161.tmp","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%TEMP%\\nsw9161.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%TEMP%\\nsw9161.tmp\\ProductHelper.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%APPDATA%\\Tencent\\yuanbao\\Global\\Logs","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%APPDATA%\\Tencent\\yuanbao\\Global\\Logs\\app_installer_2026081205.log","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%WINDIR%\\Temp","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%WINDIR%\\Temp\\report_helper.exe","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%TEMP%\\nsw9161.tmp\\modern-wizard.bmp","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%TEMP%\\nsw9161.tmp\\INetC.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%TEMP%\\MicrosoftEdgeWebview2Setup_908350031_1.exe","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\MicrosoftEdgeUpdate.exe","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\CopilotUpdate.exe","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdate.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\MicrosoftEdgeUpdateBroker.exe","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\MicrosoftEdgeUpdateOnDemand.exe","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\MicrosoftEdgeUpdateComRegisterShell64.exe","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\MicrosoftEdgeComRegisterShellARM64.exe","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\psmachine.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\psmachine_64.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\psmachine_arm64.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\psuser.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\psuser_64.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\psuser_arm64.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\NOTICE.TXT","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\EdgeUpdate.dat","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\MicrosoftEdgeUpdateCore.exe","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_am.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_ar.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_bg.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_bn.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_ca.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_cs.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_da.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_de.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_el.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_en.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_en-GB.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_es.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_es-419.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_et.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_fa.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_fi.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_fil.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_fr.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_gu.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_hi.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_hr.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_hu.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_id.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_is.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_it.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_iw.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_ja.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_kn.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_ko.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_lt.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_lv.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_ml.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_mr.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_ms.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_nb.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_nl.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_pl.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_pt-BR.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_pt-PT.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_ro.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_ru.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_sk.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_sl.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_sr.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_sv.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_ta.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_te.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_th.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_tr.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_uk.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_ur.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_vi.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_zh-CN.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_zh-TW.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_af.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_as.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_az.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_bn-IN.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_bs.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_ca-Es-VALENCIA.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_cy.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_eu.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_fr-CA.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_ga.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_gd.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_gl.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_ka.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_kk.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_km.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_kok.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_lb.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_lo.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_mi.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_mk.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_mt.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_ne.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_nn.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_or.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_pa.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_quz.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_sq.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_sr-Cyrl-BA.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_sr-Cyrl-RS.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_sr-Latn-RS.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_tt.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\msedgeupdateres_ug.dll","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EUD2A0.tmp\\MicrosoftEdgeUpdateSetup.exe","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\CopilotUpdate.exe","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%TEMP%\\af397ef28e484961ba48646a5d38cf54.db.ses","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%WINDIR%\\Temp\\af397ef28e484961ba48646a5d38cf54.db.ses","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{19911DF1-DDAA-4A5F-9393-C0329375E49E}\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{19911DF1-DDAA-4A5F-9393-C0329375E49E}\\INPROCHANDLER32\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{3B27E9A3-0A3D-4CF6-8CC2-5E61BE21E150}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{C853632E-36CA-4999-B992-EC0D408CF5AB}\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{C853632E-36CA-4999-B992-EC0D408CF5AB}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{C853632E-36CA-4999-B992-EC0D408CF5AB}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{60355531-5BFD-45AB-942C-7912628752C7}\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{60355531-5BFD-45AB-942C-7912628752C7}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{60355531-5BFD-45AB-942C-7912628752C7}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{A5135E58-384F-4244-9A5F-30FA9259413C}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{A5135E58-384F-4244-9A5F-30FA9259413C}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{7E29BE61-5809-443F-9B5D-CF22156694EB}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{7E29BE61-5809-443F-9B5D-CF22156694EB}\\NUMMETHODS\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{19911DF1-DDAA-4A5F-9393-C0329375E49E}\\INPROCHANDLER32\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{19911DF1-DDAA-4A5F-9393-C0329375E49E}\\","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6148:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6148:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Local\\SM0:6148:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Local\\SM0:6148:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"SM0:6148:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6148:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5176:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5176:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"SM0:5176:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Local\\SM0:5176:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6212:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6212:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"2026. 7.25","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Local\\SM0:6212:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"SM0:6212:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\2026. 7.25","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6452:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6452:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\Yuanbao-bbb11330-d88e-4d8f-9b2b-0b976597f967","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"SM0:6452:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Local\\SM0:6452:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3044:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3044:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\EdgeUpdate{F340B839-380B-4AA9-BA6F-B83F23E2DD05}","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\EdgeUpdate{DDDDEAEB-04CC-4BAA-9C63-CCA5FE38F688}","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3044:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3044:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Local\\SM0:3044:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Local\\SM0:3044:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"SM0:3044:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"_Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"SM0:3044:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7664:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7664:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Local\\SM0:7664:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"SM0:7664:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4704:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4704:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"SM0:4704:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Local\\SM0:4704:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7912:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7912:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"SM0:7912:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"SM0:7912:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Local\\SM0:7912:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7912:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7672:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7672:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7672:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"Local\\SM0:7672:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"SM0:7672:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"SM0:7672:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\SM0:7708:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:7708:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\_Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\EdgeUpdate{76524F9B-42D7-48C8-B7DF-FAB9E93834BF}","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\EdgeUpdate{9FE41F29-8211-488D-B96A-81FCD0A8ACE3}","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\EdgeUpdate{8A5FF6DC-FF03-4CB3-8834-D3AD1DE301DF}","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:2400:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\SM0:2400:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\SM0:2400:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\SM0:1172:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:1172:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\EdgeUpdate{8061D004-DAFE-413C-AEF6-A3D067FFA5D8}","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\SM0:1172:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]},{"name":"\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a7c6cc9ff43e55ebf04ad45"}]}]}},"report_ids":{"sandbox_job_ids":["6a7c6cc9ff43e55ebf04ad45"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious QD:Adware.GenericQ Sample 7bcb6b3adcb4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7bcb6b3adcb4…. Malware family: QD:Adware.GenericQ. Threat score 100/100. 9/24 AV engines flagged this file. 10 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776"}],["$","meta","4",{"property":"og:title","content":"Malicious QD:Adware.GenericQ Sample 7bcb6b3adcb4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7bcb6b3adcb4…. Malware family: QD:Adware.GenericQ. Threat score 100/100. 9/24 AV engines flagged this file. 10 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious QD:Adware.GenericQ Sample 7bcb6b3adcb4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7bcb6b3adcb4…. Malware family: QD:Adware.GenericQ. Threat score 100/100. 9/24 AV engines flagged this file. 10 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L8f","11",{}]]