26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4f0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample ab9ae87daca1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ab9ae87daca1…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 3/28 AV engines flagged this file. 14 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca"],"about":{"@type":"SoftwareApplication","name":"SecuriteInfo.com.Win32.PWSX-gen.27408.4168.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":3,"total":28},"behavioralIndicators":{"malicious":14,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T28be,Contains base64 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "CryptoAPI/10" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "CryptoAPI/10" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "CryptoAPI/10" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "keep" in header "GET / HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "aliveUpgrade" in header "GET / HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Insecure" in header "GET / HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Requests" in header "GET / HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "like" in header "GET / HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "1418" in header "GET / HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "56Accept" in header "GET / HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "exchange" in header "GET / HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Encoding" in header "GET / HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "gzip" in header "GET / HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Language" in header "GET / HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9"28:T12fa,"ie_to_edge_stub.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "RtlGetVersion" (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00003448) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000001ae8b37cd327787360243301687d707600f33301e05678730609fa0efeffffff1cf2330192427773c0f133010000e576b8f23301ab427773e0df537608000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000048f23301000000000800000000000000000000000000000000000000000000000000e57632e8b37c0000000088f2330169922177ffffffff3400000048f2330108000000000000000000e576b8f233012794217750f233010b00000000000000a0f23301 (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "RtlGetVersion" (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000003d6d187d3d6d00000000d0a9fb740000f4749011f574283d5603c0bb51037812580320ea3301feffffffc8ec3301506a65772a38ddb7feffffffe0ea3301eaa96177283d56030000000078125803a11400000a000b00b2973d6d5c763d6d68763d6d7812580398025803140000000000000000000000283d560308eb3301cc2d667778125803000000008412580300000000f800366d00000000cc0d24385ce864776840637704030000190000001100000010000000e0bd500340eb33018d9af77318bb50033c7758030000000060eb33012c0550033c77580378eb33010000366dfeffffff0400000020aff77300000000000000000300000068eb3301 (UID: 00000000-00002408)29:Ta3f,"RegSvcs.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000002812bd040000d1025f00010018000000000000000000000003000000020000000000d1020c00000000000000a8ef030894ef0308ee1362772812bd04ee13627700000000000000000c0000003bd8802d5c054277acef03082823056e0000d102000000000c00000060c2c804b8ef03082f99326d0c000000 (UID: 00000000-00007956) "RegSvcs.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000d102609bdf0218000000000000000000000003000000020000000000d1020c0000000000000078a930778cec9d00ee1362772812bd04ee13627700000000000000000c0000006f01e66a2812bd04a4ec9d002823056e0000d102000000000c000000b014e36ab0ec9d002f99326d0c000000 (UID: 00000000-00007956) "RegSvcs.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000001662770c00000000000000000000000000d10250ed9d0018000000000000000000000003000000020000000000d1020c00000000000000f4ec9d00f8ec9d00ee13627700000000ee13627700000000000000000c000000a57d48a010ed9d002823056e0000d102000000000c00000030a5326d1ced9d002f99326d0c000000 (UID: 00000000-00007956) "RegSvcs.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000d102909ddf0218000000000000000000000003000000020000000000d1020c0000000000000078a930778cec9d00ee1362772812bd04ee13627700000000000000000c0000006f01e66a2812bd04a4ec9d002823056e0000d102000000000c000000b014e36ab0ec9d002f99326d0c000000 (UID: 00000000-00007956) "RegSvcs.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000001662770c00000000000000000000000000d10228ed9d0018000000000000000000000003000000020000000000d1020c00000000000000ccec9d00d0ec9d00ee13627700000000ee13627700000000000000000c000000a57d48a0e8ec9d002823056e0000d102000000000c00000030a5326df4ec9d002f99326d0c000000 (UID: 00000000-00007956) "RegSvcs.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000002812bd040000d102a386727318000000000000000000000003000000020000000000d1020c000000000000002000000014f02308ee1362772812bd04ee13627700000000000000000c000000d061df020061df022cf023082823056e0000d102000000000c0000002062c90438f023082f99326d0c000000 (UID: 00000000-00007956) "RegSvcs.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000001662770c00000000000000000000000000d1028baa307718000000000000000000000003000000020000000000d1020c000000000000001440e00268ec9d00ee1362772812bd04ee13627700000000000000000c0000006f01e66a80ec9d002823056e0000d102000000000c000000b014e36a8cec9d002f99326d0c000000 (UID: 00000000-00007956)2a:T9e5,"RegSvcs.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")2b:T882,"RegSvcs.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "RegSvcs.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "RegSvcs.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "RegSvcs.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "RegSvcs.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "RegSvcs.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "RegSvcs.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "RegSvcs.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "RegSvcs.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "RegSvcs.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "RegSvcs.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "RegSvcs.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "RegSvcs.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")2c:T4ed,"RegSvcs.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")2d:T30a3,"ie_to_edge_stub.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "LoadLibrary" with a parameter ieframe.dll (UID: 00000000-00003448) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002408) "RegSvcs.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\vaultcli.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00007956) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00007956)2e:Te035,"ie_to_edge_stub.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00007608) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003448) "ie_to_edge_stub.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003448) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter SystemParametersInfo (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetThemeAppPropertiesW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter OpenThemeDataW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipLoadImageFromStream (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipImageForceValidation (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipGetImageType (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipGetImageRawFormat (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipBitmapGetPixel (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipBitmapSetPixel (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter OpenMutex (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter OpenMutexW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter TerminateProcessW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter CloseThemeDataW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00002408) "RegSvcs.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter SysAllocStringLenW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter SystemFunction041 (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter SystemFunction041W (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter VaultEnumerateVaults (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter VaultOpenVault (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter VaultEnumerateItems (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter VaultGetItem (UID: 00000000-00007956) "RegSvcs.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00007956)2f:T647,Found reference to API (Indicator: "SendMessage"; File: "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe") Found reference to API (Indicator: "GetKeyState"; File: "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe") Found reference to API (Indicator: "GetLength"; File: "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe") Found reference to API (Indicator: "GetObject"; File: "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe") Found reference to API (Indicator: "MessageBox"; File: "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe") Found reference to API (Indicator: "SetCurrentDirectory"; File: "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00002408.00000000.66161.00EF2000.00000002.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00002408.00000000.66161.00EF2000.00000002.mdmp") Found reference to API (Indicator: "GetLength"; Source: "00000000-00002408.00000000.66161.00EF2000.00000002.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00002408.00000000.66161.00EF2000.00000002.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00002408.00000000.66161.00EF2000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectory"; Source: "00000000-00002408.00000000.66161.00EF2000.00000002.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00002408.00000000.66161.03500000.00000004.mdmp")30:Tbe0,"ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\vaultcli.dll" - [base:0; Status:c0000135]31:Tf0a,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/10.0 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5011 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 08 Nov 2023 10:44:32 GMT Last-Modified: Wed 08 Nov 2023 09:21:01 GMT Server: ECAcc (sac/2561) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/10.0 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 6373 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 08 Nov 2023 10:44:32 GMT Last-Modified: Wed 08 Nov 2023 08:58:19 GMT Server: ECAcc (sac/255D) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/10.0 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3586 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 08 Nov 2023 10:44:33 GMT Last-Modified: Wed 08 Nov 2023 09:44:47 GMT Server: ECAcc (sac/252C) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET / HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 302 Found Location: https://www.google.com/?gws_rd=ssl Cache-Control: private Content-Type: text/html; charset=UTF-8 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-Kf6MCKhcZQ1HoQxBzsPpWg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Wed 08 Nov 2023 10:44:35 GMT Server: gws Content-Length: 231 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2023-11-08-10; expires=Fri 08-Dec-2023 10:44:35 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: AEC=Ackid1ReZ0L5_yndOd0NMRI8W7fHE9Ph2zHXIzOPE with response body ==>.......32:T578,Launches browser "IEXPLORE.EXE" (UID: 00000000-00005780) Launches browser "msedge.exe" (UID: 00000000-00007824) Launches browser "msedge.exe" (UID: 00000000-00003208) Launches browser "msedge.exe" (UID: 00000000-00008144) Launches browser "msedge.exe" (UID: 00000000-00007612) Launches browser "msedge.exe" (UID: 00000000-00000956) Launches browser "msedge.exe" (UID: 00000000-00007176) Launches browser "msedge.exe" (UID: 00000000-00006444) Launches browser "msedge.exe" (UID: 00000000-00007632) Launches browser "msedge.exe" (UID: 00000000-00004792) Launches browser "msedge.exe" (UID: 00000000-00007356) Launches browser "msedge.exe" (UID: 00000000-00007976) Launches browser "msedge.exe" (UID: 00000000-00008076) Launches browser "msedge.exe" (UID: 00000000-00004080) Launches browser "msedge.exe" (UID: 00000000-00007784) Launches browser "msedge.exe" (UID: 00000000-00005196) Launches browser "msedge.exe" (UID: 00000000-00007684) Launches browser "msedge.exe" (UID: 00000000-00002656) Launches browser "msedge.exe" (UID: 00000000-00007464) Launches browser "msedge.exe" (UID: 00000000-00000184) Launches browser "msedge.exe" (UID: 00000000-00006840) Launches browser "msedge.exe" (UID: 00000000-00002660) Launches browser "msedge.exe" (UID: 00000000-00002704) Launches browser "msedge.exe" (UID: 00000000-00002784) Launches browser "msedge.exe" (UID: 00000000-00001156)33:T2bba,"ie_to_edge_stub.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 34c0000 "ie_to_edge_stub.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 34c0000 "ie_to_edge_stub.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 34c0000 "ie_to_edge_stub.exe" loaded module "KERNEL32" at base 65f0000 "ie_to_edge_stub.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base f7080000 "ie_to_edge_stub.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 34c0000 "ie_to_edge_stub.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 34c0000 "ie_to_edge_stub.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 34c0000 "ie_to_edge_stub.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 1790000 "ie_to_edge_stub.exe" loaded module "KERNEL32.DLL" at base 65f0000 "ie_to_edge_stub.exe" loaded module "NTDLL.DLL" at base 6e00000 "ie_to_edge_stub.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base fe020000 "ie_to_edge_stub.exe" loaded module "SHELL32.DLL" at base 44f0000 "ie_to_edge_stub.exe" loaded module "RPCRT4.DLL" at base 6c10000 "ie_to_edge_stub.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base f5db0000 "ie_to_edge_stub.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 44f0000 "ie_to_edge_stub.exe" loaded module "USER32.DLL" at base 62d0000 "ie_to_edge_stub.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base f8d80000 "ie_to_edge_stub.exe" loaded module "MSISO.DLL" at base f50c0000 "ie_to_edge_stub.exe" loaded module "SSPICLI.DLL" at base 3050000 "ie_to_edge_stub.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 34c0000 "ie_to_edge_stub.exe" loaded module "IEFRAME.DLL" at base dd6b0000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77110000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77110000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73710000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "ADVAPI32.DLL" at base 74970000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6e870000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "SHLWAPI.DLL" at base 748c0000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74af0000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "VERSION.DLL" at base 73d20000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77110000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 6e0c0000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "USER32.DLL" at base 74f40000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 77110000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 6be90000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "RPCRT4.DLL" at base 76860000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 77110000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6df60000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6d500000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "KERNEL32.DLL" at base 76e80000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "UXTHEME.DLL" at base 73a80000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6b670000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6d3f0000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6aef0000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "NTDLL.DLL" at base 775e0000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "IMM32.DLL" at base 76bb0000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "GDI32.DLL" at base 76e50000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "GDIPLUS.DLL" at base 73d40000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "MSCOREE.DLL" at base 6d2a0000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "WLDP.DLL" at base 6f6a0000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73d20000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "USERENV.DLL" at base 6ecf0000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "WINDOWSCODECS.DLL" at base 730a0000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "KERNEL32" at base 76e80000 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" loaded module "PSAPI.DLL" at base 76cf0000 "RegSvcs.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77110000 "RegSvcs.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77110000 "RegSvcs.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77110000 "RegSvcs.exe" loaded module "KERNEL32" at base 76e80000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6d350000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 6d320000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6d310000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6ae30000 "RegSvcs.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 77110000 "RegSvcs.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 77110000 "RegSvcs.exe" loaded module "OLEAUT32.DLL" at base 772f0000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "RegSvcs.exe" loaded module "SSPICLI.DLL" at base 74000000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "RegSvcs.exe" loaded module "RASAPI32.DLL" at base 6ad30000 "RegSvcs.exe" loaded module "RASMAN.DLL" at base 6ad00000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "RegSvcs.exe" loaded module "WS2_32.DLL" at base 76f50000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 70980000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "RegSvcs.exe" loaded module "WINHTTP.DLL" at base 709e0000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 70a90000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "RegSvcs.exe" loaded module "SHELL32.DLL" at base 750c0000 "RegSvcs.exe" loaded module "USER32.DLL" at base 74f40000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "RegSvcs.exe" loaded module "IPHLPAPI.DLL" at base 73f20000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 6eb40000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6eaf0000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "RegSvcs.exe" loaded module "SECUR32.DLL" at base 6ebd0000 "RegSvcs.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 6ea80000 "RegSvcs.exe" loaded module "MSKEYPROTECT.DLL" at base 6ea70000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 6ea00000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "RegSvcs.exe" loaded module "CRYPT32.DLL" at base 74020000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6eb50000 "RegSvcs.exe" loaded module "OLEAUT32" at base 772f0000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VAULTCLI.DLL" at base 0 "RegSvcs.exe" loaded module "VAULTCLI.DLL" at base 6ecb0000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6abd000034:T8a4,"ie_to_edge_stub.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "ie_to_edge_stub.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "ie_to_edge_stub.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "ie_to_edge_stub.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "ie_to_edge_stub.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "ie_to_edge_stub.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\INPROCSERVER32") "ie_to_edge_stub.exe" touched "ShellItem Shell Namespace helper" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "RegSvcs.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "RegSvcs.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "RegSvcs.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "RegSvcs.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\INPROCSERVER32") "RegSvcs.exe" touched "Microsoft WBEM Call Context" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\INPROCSERVER32") "RegSvcs.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCSERVER32") "RegSvcs.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "RegSvcs.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "RegSvcs.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\INPROCSERVER32")35:T4c1,"ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"36:T16de,Process "IEXPLORE.EXE" (UID: 00000000-00005780) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "IEXPLORE.EXE" (UID: 00000000-00005780) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, USERNAME, CommonProgramFiles, COMPUTERNAME, HOMEPATH, TEMP, USERPROFILE, TMP, ProgramFiles" Process "IEXPLORE.EXE" (UID: 00000000-00005780) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "ie_to_edge_stub.exe" (UID: 00000000-00007608) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "ie_to_edge_stub.exe" (UID: 00000000-00007608) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00007824) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00007824) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00003208) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_7824_ZUTSHFNWNJQIWAYA", EDGE_BROWSER_PID="7824"" Process "msedge.exe" (UID: 00000000-00008144) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007612) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_7824_ZUTSHFNWNJQIWAYA", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="7824"" Process "msedge.exe" (UID: 00000000-00000956) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00000956) was launched with missing environment variables: "EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00007176) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00007176) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007356) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007356) was launched with missing environment variables: "CHROME_RESTART" Process "msedge.exe" (UID: 00000000-00007976) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT"" Process "msedge.exe" (UID: 00000000-00007976) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00008076) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00008076) was launched with missing environment variables: "CHROME_RESTART" Process "msedge.exe" (UID: 00000000-00004080) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT"" Process "msedge.exe" (UID: 00000000-00004080) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" (UID: 00000000-00002408) was launched with modified environment variables: "Path" Process "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" (UID: 00000000-00002408) was launched with missing environment variables: "CHROME_RESTART, FPS_BROWSER_APP_PROFILE_STRING, PROMPT, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, FPS_BROWSER_USER_PROFILE_STRING, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007464) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", PROMPT="$P$G", EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_7824_ZUTSHFNWNJQIWAYA", FPS_BROWSER_USER_PROFILE_STRING="Default", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="7824"" Process "msedge.exe" (UID: 00000000-00007464) was launched with modified environment variables: "Path" Process "RegSvcs.exe" (UID: 00000000-00004664) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "RegSvcs.exe" (UID: 00000000-00004664) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "RegSvcs.exe" (UID: 00000000-00004664) was launched with missing environment variables: "CHROME_RESTART, FPS_BROWSER_APP_PROFILE_STRING, PROMPT, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, FPS_BROWSER_USER_PROFILE_STRING, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID"37:T1231,Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe.log] Observed system executable string:"3,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe.log] Observed system executable string:"3,"System.Configuration Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll",0" [Source: ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe.log] Observed system executable string:"3,"System.Xml Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll",0" [Source: ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00002408-00000C25-36630350] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00002408-00000C25-37951846] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00002408-00000C25-38034572] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00002408-00000C25-38097953] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00002408-00000C25-38256376] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00002408-00000C25-38360208] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00002408-00000C25-38553149] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00002408-00000C25-38845362] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00002408-00000C25-39082537] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00002408-00000C25-39117047] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00002408-00000C25-39218268] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00002408-00000C25-39745606] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00002408-00000C25-40883929] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00002408-00000C25-40940642] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00002408-00000C25-40962797] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00002408-00000C25-42110618] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00002408-00000C25-43448693] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00002408-00000C25-43499248] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll" [Source: 00000000-00007956-00000C25-44072938] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007956-00000C25-44239069] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" [Source: 00000000-00007956-00000C25-46656369]38:Td95,Spawned process "IEXPLORE.EXE" with commandline "SCODEF:5088 CREDAT:17410 /prefetch:2" (UID: 00000000-00005780) Spawned process "ie_to_edge_stub.exe" with commandline "--from-ie-to-edge=3 --ie-frame-hwnd=60204" (UID: 00000000-00007608) Spawned process "ie_to_edge_stub.exe" with commandline "--from-ie-to-edge=1 --customer-type=1 -- "http://www.google.com/ ..." (UID: 00000000-00003448), Spawned process "msedge.exe" with commandline "--from-ie-to-edge=3 --ie-frame-hwnd=60204" (UID: 00000000-00007824), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00003208) Spawned process "msedge.exe" with commandline "--from-ie-to-edge=1 --customer-type=1 --single-argument http://w ..." (UID: 00000000-00008144) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00007612) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00000956), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007176), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00006444), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00007632), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00004792), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00007356), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00007976), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00008076), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00004080), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00007784), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00005196), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00007684), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00002656), Spawned process "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" (UID: 00000000-00002408), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00007464), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00000184), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00006840), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00002660)39:Td95,Spawned process "IEXPLORE.EXE" with commandline "SCODEF:5088 CREDAT:17410 /prefetch:2" (UID: 00000000-00005780) Spawned process "ie_to_edge_stub.exe" with commandline "--from-ie-to-edge=3 --ie-frame-hwnd=60204" (UID: 00000000-00007608) Spawned process "ie_to_edge_stub.exe" with commandline "--from-ie-to-edge=1 --customer-type=1 -- "http://www.google.com/ ..." (UID: 00000000-00003448), Spawned process "msedge.exe" with commandline "--from-ie-to-edge=3 --ie-frame-hwnd=60204" (UID: 00000000-00007824), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00003208) Spawned process "msedge.exe" with commandline "--from-ie-to-edge=1 --customer-type=1 --single-argument http://w ..." (UID: 00000000-00008144) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00007612) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00000956), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007176), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00006444), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00007632), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00004792), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00007356), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00007976), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00008076), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00004080), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00007784), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00005196), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00007684), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00002656), Spawned process "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" (UID: 00000000-00002408), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00007464), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00000184), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00006840), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00002660)3a:T549b,"urlref_httpwww.google.com" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe.log" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "shopping.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\7824_2007356429\shopping.js]- [targetUID: 00000000-00007824] "recovery-component-inner.crx" has type "Google Chrome extension version 3"- Location: [%TEMP%\7824_502271588\recovery-component-inner.crx]- [targetUID: 00000000-00007824] "edge_driver.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\7824_2007356429\edge_driver.js]- [targetUID: 00000000-00007824] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00002656] "auto_open_controller.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\7824_2007356429\auto_open_controller.js]- [targetUID: 00000000-00007824] "edge_confirmation_page_validator.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\7824_2007356429\edge_confirmation_page_validator.js]- [targetUID: 00000000-00007824] "edge_checkout_page_validator.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\7824_2007356429\edge_checkout_page_validator.js]- [targetUID: 00000000-00007824] "product_page.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\7824_2007356429\product_page.js]- [targetUID: 00000000-00007824] "f_0004cc" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cc]- [targetUID: 00000000-00007176] "v1FieldTypes.json" has type "JSON data"- Location: [%TEMP%\7824_375037313\v1FieldTypes.json]- [targetUID: 00000000-00006928] "f_0004c7" has type "gzip compressed data original size modulo 2^32 927935"- [targetUID: N/A] "shoppingfre.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\7824_2007356429\shoppingfre.js]- [targetUID: 00000000-00007824] "f_0004c4" has type "gzip compressed data original size modulo 2^32 891308"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c4]- [targetUID: 00000000-00007176] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1]- [targetUID: 00000000-00007824] "index" has type "FoxPro FPT blocks size 768 next free block index 3284796353 field type 0 dBase III DBT version number 0 next free block index 3238251203"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index]- [targetUID: 00000000-00008144] "edge_autofill_field_data.json" has type "JSON data"- Location: [%TEMP%\7824_375037313\edge_autofill_field_data.json]- [targetUID: 00000000-00006928] "f_0004c6" has type "gzip compressed data original size modulo 2^32 226230"- [targetUID: N/A] "2d15f065-90ea-4ea5-ac9b-b7133b7501d7.tmp" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\2d15f065-90ea-4ea5-ac9b-b7133b7501d7.tmp]- [targetUID: 00000000-00007824] "f_0004ca" has type "gzip compressed data original size modulo 2^32 265759"- [targetUID: N/A] "ff7edeea-1e7a-41cd-a749-15d3b7424b27.tmp" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\ff7edeea-1e7a-41cd-a749-15d3b7424b27.tmp]- [targetUID: 00000000-00007824] "data.txt" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\7824_2009792466\data.txt]- [targetUID: 00000000-00007824] "f_0004c5" has type "gzip compressed data original size modulo 2^32 216367"- [targetUID: N/A] "Entities" has type "UTF-8 Unicode text"- Location: [%TEMP%\7824_627108987\Mu\Entities]- [targetUID: 00000000-00007176] "f_0004c9" has type "gzip compressed data original size modulo 2^32 186188"- [targetUID: N/A] "198b827f-edda-4e8e-9777-1b7a5e8093cb.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "bdf61286-e9f6-4942-ba8f-e979e0739075.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\bdf61286-e9f6-4942-ba8f-e979e0739075.tmp]- [targetUID: 00000000-00007824] "ae435cd3-a15f-427b-bcba-a9bf2eb32f7b.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ae435cd3-a15f-427b-bcba-a9bf2eb32f7b.tmp]- [targetUID: 00000000-00007824] "e8803fc3-d09c-43fc-950f-6e5cddb33047.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\e8803fc3-d09c-43fc-950f-6e5cddb33047.tmp]- [targetUID: 00000000-00007824] "4f249016-d14e-4a4d-9084-e104ff5b96f9.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\4f249016-d14e-4a4d-9084-e104ff5b96f9.tmp]- [targetUID: 00000000-00007824] "1f0a12c8-0d92-4beb-a790-faa08337c10b.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\1f0a12c8-0d92-4beb-a790-faa08337c10b.tmp]- [targetUID: 00000000-00007824] "b3d2ecc9-fa76-495b-9825-830a35f5b76f.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\b3d2ecc9-fa76-495b-9825-830a35f5b76f.tmp]- [targetUID: 00000000-00007824] "3c101290-645a-4c4f-91d3-d1a26168812a.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\3c101290-645a-4c4f-91d3-d1a26168812a.tmp]- [targetUID: 00000000-00007824] "dfc74904-44f6-4263-993a-4838a06b78d6.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\dfc74904-44f6-4263-993a-4838a06b78d6.tmp]- [targetUID: 00000000-00007824] "df8d3c3c-2490-45c9-949a-8c10ebf3c9ce.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\df8d3c3c-2490-45c9-949a-8c10ebf3c9ce.tmp]- [targetUID: 00000000-00007824] "8e79919c-1fd6-4f78-8779-c78254f6bbce.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\8e79919c-1fd6-4f78-8779-c78254f6bbce.tmp]- [targetUID: 00000000-00007824] "f_0004c3" has type "gzip compressed data max compression original size modulo 2^32 183714"- [targetUID: N/A] "edge_tracking_page_validator.js" has type "UTF-8 Unicode text with very long lines with no line terminators"- Location: [%TEMP%\7824_2007356429\edge_tracking_page_validator.js]- [targetUID: 00000000-00007824] "f_0004c8" has type "gzip compressed data original size modulo 2^32 120563"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c8]- [targetUID: 00000000-00007176] "LICENSE" has type "ASCII text"- Location: [%TEMP%\7824_627108987\Mu\LICENSE]- [targetUID: 00000000-00007824] "c675808a-9710-4aaf-b82d-1965b1754c3d.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\c675808a-9710-4aaf-b82d-1965b1754c3d.tmp]- [targetUID: 00000000-00007824] "Advertising" has type "ASCII text"- Location: [%TEMP%\7824_627108987\Mu\Advertising]- [targetUID: 00000000-00007176] "cc5e84b5-db96-4bdb-9215-906b8ce33237.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\cc5e84b5-db96-4bdb-9215-906b8ce33237.tmp]- [targetUID: 00000000-00007824] "5c68d2c5-2ff4-4071-b32e-70ac1175b17d.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "4ff3d7f9-406d-4c85-8efb-89a63a3c0706.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\4ff3d7f9-406d-4c85-8efb-89a63a3c0706.tmp]- [targetUID: 00000000-00007824] "1c0870cf-3c9e-4195-9088-34aeec7e67a3.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "e2f60dd0-a5f2-4bfe-b04b-7a1d699bbd67.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\e2f60dd0-a5f2-4bfe-b04b-7a1d699bbd67.tmp]- [targetUID: 00000000-00007824] "5053cdb7-4855-4e14-9f5e-14cd0792996a.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\5053cdb7-4855-4e14-9f5e-14cd0792996a.tmp]- [targetUID: 00000000-00007824] "crl-set" has type "data"- Location: [%TEMP%\7824_1327594494\crl-set]- [targetUID: 00000000-00007320] "f_0004cb" has type "Web Open Font Format (Version 2) TrueType length 21700 version 1.0"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cb]- [targetUID: 00000000-00007176] "arbitration_service_config.json" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\arbitration_service_config.json]- [targetUID: 00000000-00007824] "Entities" has type "ASCII text"- Location: [%TEMP%\7824_627108987\Sigma\Entities]- [targetUID: 00000000-00007176] "temp-index" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index]- [targetUID: 00000000-00007824] "httpErrorPagesScripts_1_" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- [targetUID: N/A] "shopping_iframe_driver.js" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\7824_2007356429\shopping_iframe_driver.js]- [targetUID: 00000000-00007824] "data_2" has type "dBase III DBT version number 0 next free block index 3238316739"- [targetUID: 00000000-00007824] "data_3" has type "dBase III DBT version number 0 next free block index 3238316739"- [targetUID: 00000000-00007824] "data_0" has type "FoxPro FPT blocks size 512 next free block index 3284796609 field type 0 dBase III DBT version number 0 next free block index 3238316739"- [targetUID: 00000000-00007824] "Content" has type "ASCII text"- Location: [%TEMP%\7824_627108987\Mu\Content]- [targetUID: 00000000-00007176] "bbf58c64-c3fd-4904-81bb-fa634711136b.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\bbf58c64-c3fd-4904-81bb-fa634711136b.tmp]- [targetUID: 00000000-00007176] "1b6acc11-31de-43f4-8c6f-600ac5059e8d.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\1b6acc11-31de-43f4-8c6f-600ac5059e8d.tmp]- [targetUID: 00000000-00007176] "ee0f4553-6da9-4af7-8166-990fcc3988dd.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\ee0f4553-6da9-4af7-8166-990fcc3988dd.tmp]- [targetUID: 00000000-00007176] "Staging" has type "ASCII text"- Location: [%TEMP%\7824_627108987\Sigma\Staging]- [targetUID: 00000000-00007176] "errorPageStrings_1_" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- [targetUID: N/A] "edge_autofill_global_block_list.json" has type "JSON data"- Location: [%TEMP%\7824_375037313\edge_autofill_global_block_list.json]- [targetUID: 00000000-00006928] "Analytics" has type "ASCII text"- Location: [%TEMP%\7824_627108987\Mu\Analytics]- [targetUID: 00000000-00007176] "info_48_1_" has type "PNG image data 47 x 48 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "Social" has type "ASCII text"- Location: [%TEMP%\7824_627108987\Sigma\Social]- [targetUID: 00000000-00007176] "84e3e9e6-72d1-4b74-803b-df6b86f22963.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 12260"- Location: [%TEMP%\84e3e9e6-72d1-4b74-803b-df6b86f22963.tmp]- [targetUID: 00000000-00005196] "navcancl_1_" has type "HTML document UTF-8 Unicode (with BOM) text with CRLF line terminators"- [targetUID: N/A] "0731d0aa-a62b-414f-8ba3-2f503142201a.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\0731d0aa-a62b-414f-8ba3-2f503142201a.tmp]- [targetUID: 00000000-00007176] "f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\TokenBroker\Cache\f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres]- [targetUID: 00000000-00007824] "84394bf81005269b_0" has type "data"- [targetUID: N/A] "9401376df0c24f3d_0" has type "data"- [targetUID: N/A] "ErrorPageTemplate_1_" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- [targetUID: N/A] "12D25EEC119B36D4F609776800B40F1F_5DECD62093904BD448BCAAAAC2AD01C7" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\12D25EEC119B36D4F609776800B40F1F_5DECD62093904BD448BCAAAAC2AD01C7]- [targetUID: 00000000-00005780] "DE0D974FB4DC3536B9035FD604565AB7_4708B902F5E44C206F9CFEAB460AFD60" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\DE0D974FB4DC3536B9035FD604565AB7_4708B902F5E44C206F9CFEAB460AFD60]- [targetUID: 00000000-00005780] "verified_contents.json" has type "JSON data"- Location: [%TEMP%\7824_1002458733\_metadata\verified_contents.json]- [targetUID: 00000000-00007824] "Fingerprinting" has type "ASCII text"- Location: [%TEMP%\7824_627108987\Mu\Fingerprinting]- [targetUID: 00000000-00007176] "shopping.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\7824_2007356429\shopping.html]- [targetUID: 00000000-00007824] "5ec8fff7368f771a_0" has type "data"- [targetUID: N/A] "410abe19d7b34552_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\410abe19d7b34552_0]- [targetUID: 00000000-00007824] "2ba88413fd7dc29e_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\2ba88413fd7dc29e_0]- [targetUID: 00000000-00007824] "4ff683f661a61bb8_0" has type "data"- [targetUID: N/A] "shopping_fre.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\7824_2007356429\shopping_fre.html]- [targetUID: 00000000-00007824] "Cryptomining" has type "ASCII text"- Location: [%TEMP%\7824_627108987\Mu\Cryptomining]- [targetUID: 00000000-00007176] "manifest.json" has type "JSON data"- Location: [%TEMP%\7824_1002458733\manifest.json]- [targetUID: 00000000-00007320] "Advertising" has type "ASCII text"- Location: [%TEMP%\7824_627108987\Sigma\Advertising]- [targetUID: 00000000-00007176] "CompatExceptions" has type "ASCII text"- Location: [%TEMP%\7824_627108987\Mu\CompatExceptions]- [targetUID: 00000000-00007176] "43cd179b2f5ec06a_0" has type "data"- [targetUID: N/A] "DE0D974FB4DC3536B9035FD604565AB7_4708B902F5E44C206F9CFEAB460AFD60" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\DE0D974FB4DC3536B9035FD604565AB7_4708B902F5E44C206F9CFEAB460AFD60]- [targetUID: 00000000-00005780] "12D25EEC119B36D4F609776800B40F1F_5DECD62093904BD448BCAAAAC2AD01C7" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\12D25EEC119B36D4F609776800B40F1F_5DECD62093904BD448BCAAAAC2AD01C7]- [targetUID: 00000000-00005780] "491626c001d2a009_0" has type "data"- [targetUID: N/A] "LICENSE" has type "ASCII text"- Location: [%TEMP%\7824_1002458733\LICENSE]- [targetUID: 00000000-00007824] "80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177" has type "data"- [targetUID: 00000000-00005780] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- [targetUID: 00000000-00005780] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00005780] "background_gradient_1_" has type "JPEG image data JFIF standard 1.02 aspect ratio density 100x100 segment length 16 baseline precision 8 1x800 components 3"- [targetUID: N/A] "bullet_1_" has type "PNG image data 15 x 15 8-bit colormap non-interlaced"- [targetUID: N/A] "80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177]- [targetUID: 00000000-00005780] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00005780] "3337ac3ba6d2957c_0" has type "data"- [targetUID: N/A] "7efd815e543a3723_0" has type "data"- [targetUID: N/A] "Social" has type "ASCII text"- Location: [%TEMP%\7824_627108987\Mu\Social]- [targetUID: 00000000-00007176] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG]- [targetUID: 00000000-00002656] "26f2df2ba4762c22_0" has type "data"- [targetUID: N/A] "settings.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\settings.dat]- [targetUID: 00000000-00008144] "160fa918-d581-4932-9e4e-1075c4713595_1_.htm" has type "HTML document ASCII text with CRLF line terminators"- [targetUID: N/A] "regex_patterns.json" has type "JSON data"- Location: [%TEMP%\7824_375037313\regex_patterns.json]- [targetUID: 00000000-00006928] "Fingerprinting" has type "ASCII text"- Location: [%TEMP%\7824_627108987\Sigma\Fingerprinting]- [targetUID: 00000000-00007176] "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%TEMP%\7824_502271588\manifest.json]- [targetUID: 00000000-00007320] "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%TEMP%\7824_2007356429\manifest.json]- [targetUID: 00000000-00007320] "manifest.json" has type "JSON data"- Location: [%TEMP%\7824_627108987\manifest.json]- [targetUID: 00000000-00007320] "Analytics" has type "ASCII text"- Location: [%TEMP%\7824_627108987\Sigma\Analytics]- [targetUID: 00000000-00007176] "Last Browser" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Last Browser]- [targetUID: 00000000-00007824] "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%TEMP%\7824_375037313\manifest.json]- [targetUID: 00000000-00007320] "manifest.json" has type "JSON data"- Location: [%TEMP%\7824_1327594494\manifest.json]- [targetUID: 00000000-00007320] "TransparentAdvertisers" has type "ASCII text"- Location: [%TEMP%\7824_627108987\Mu\TransparentAdvertisers]- [targetUID: 00000000-00007824] "Variations" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Variations]- [targetUID: 00000000-00008144] "Other" has type "ASCII text"- Location: [%TEMP%\7824_627108987\Sigma\Other]- [targetUID: 00000000-00007176] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\7824_502271588\manifest.fingerprint]- [targetUID: 00000000-00007824] "manifest.fingerprint" has type "ASCII text with no line terminators"- [targetUID: 00000000-00007824] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\7824_2009792466\manifest.fingerprint]- [targetUID: 00000000-00007824] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\7824_1327594494\manifest.fingerprint]- [targetUID: 00000000-00007824] "LICENSE" has type "ASCII text with no line terminators"- Location: [%TEMP%\7824_627108987\Sigma\LICENSE]- [targetUID: 00000000-00007824] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\7824_2007356429\manifest.fingerprint]- [targetUID: 00000000-00007824] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\7824_375037313\manifest.fingerprint]- [targetUID: 00000000-00007824] "manifest.json" has type "JSON data"- Location: [%TEMP%\7824_2009792466\manifest.json]- [targetUID: 00000000-00007320] ".ses" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\.ses]- [targetUID: 00000000-00007824] "Content" has type "ASCII text"- Location: [%TEMP%\7824_627108987\Sigma\Content]- [targetUID: 00000000-00007176] "Other" has type "ASCII text"- Location: [%TEMP%\7824_627108987\Mu\Other]- [targetUID: 00000000-00007176] "Cryptomining" has type "ASCII text"- Location: [%TEMP%\7824_627108987\Sigma\Cryptomining]- [targetUID: 00000000-00007176] "Last Version" has type "ASCII text with no line terminators"- [targetUID: N/A] "8982b009-94a5-47a3-bb58-4d940d8da28b.tmp" has type "very short file (no magic)"- [targetUID: N/A] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1]- [targetUID: 00000000-00007824] "dd05dd82-4af3-49c4-8f5c-77ded68640d7.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\dd05dd82-4af3-49c4-8f5c-77ded68640d7.tmp]- [targetUID: 00000000-00008144]3b:T1336,"2d15f065-90ea-4ea5-ac9b-b7133b7501d7.tmp" has type "JSON data" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\2d15f065-90ea-4ea5-ac9b-b7133b7501d7.tmp] "ff7edeea-1e7a-41cd-a749-15d3b7424b27.tmp" has type "JSON data" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\ff7edeea-1e7a-41cd-a749-15d3b7424b27.tmp] "198b827f-edda-4e8e-9777-1b7a5e8093cb.tmp" has type "ASCII text with very long lines with no line terminators" "bdf61286-e9f6-4942-ba8f-e979e0739075.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\bdf61286-e9f6-4942-ba8f-e979e0739075.tmp] "ae435cd3-a15f-427b-bcba-a9bf2eb32f7b.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ae435cd3-a15f-427b-bcba-a9bf2eb32f7b.tmp] "e8803fc3-d09c-43fc-950f-6e5cddb33047.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\e8803fc3-d09c-43fc-950f-6e5cddb33047.tmp] "4f249016-d14e-4a4d-9084-e104ff5b96f9.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\4f249016-d14e-4a4d-9084-e104ff5b96f9.tmp] "1f0a12c8-0d92-4beb-a790-faa08337c10b.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\1f0a12c8-0d92-4beb-a790-faa08337c10b.tmp] "b3d2ecc9-fa76-495b-9825-830a35f5b76f.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\b3d2ecc9-fa76-495b-9825-830a35f5b76f.tmp] "3c101290-645a-4c4f-91d3-d1a26168812a.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\3c101290-645a-4c4f-91d3-d1a26168812a.tmp] "dfc74904-44f6-4263-993a-4838a06b78d6.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\dfc74904-44f6-4263-993a-4838a06b78d6.tmp] "df8d3c3c-2490-45c9-949a-8c10ebf3c9ce.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\df8d3c3c-2490-45c9-949a-8c10ebf3c9ce.tmp] "8e79919c-1fd6-4f78-8779-c78254f6bbce.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\8e79919c-1fd6-4f78-8779-c78254f6bbce.tmp] "c675808a-9710-4aaf-b82d-1965b1754c3d.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\c675808a-9710-4aaf-b82d-1965b1754c3d.tmp] "cc5e84b5-db96-4bdb-9215-906b8ce33237.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\cc5e84b5-db96-4bdb-9215-906b8ce33237.tmp] "5c68d2c5-2ff4-4071-b32e-70ac1175b17d.tmp" has type "ASCII text with very long lines with no line terminators" "4ff3d7f9-406d-4c85-8efb-89a63a3c0706.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\4ff3d7f9-406d-4c85-8efb-89a63a3c0706.tmp] "1c0870cf-3c9e-4195-9088-34aeec7e67a3.tmp" has type "ASCII text with very long lines with no line terminators" "e2f60dd0-a5f2-4bfe-b04b-7a1d699bbd67.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\e2f60dd0-a5f2-4bfe-b04b-7a1d699bbd67.tmp] "5053cdb7-4855-4e14-9f5e-14cd0792996a.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\5053cdb7-4855-4e14-9f5e-14cd0792996a.tmp] "bbf58c64-c3fd-4904-81bb-fa634711136b.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\bbf58c64-c3fd-4904-81bb-fa634711136b.tmp] "1b6acc11-31de-43f4-8c6f-600ac5059e8d.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\1b6acc11-31de-43f4-8c6f-600ac5059e8d.tmp] "ee0f4553-6da9-4af7-8166-990fcc3988dd.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\ee0f4553-6da9-4af7-8166-990fcc3988dd.tmp] "84e3e9e6-72d1-4b74-803b-df6b86f22963.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 12260" - Location: [%TEMP%\84e3e9e6-72d1-4b74-803b-df6b86f22963.tmp] "0731d0aa-a62b-414f-8ba3-2f503142201a.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\0731d0aa-a62b-414f-8ba3-2f503142201a.tmp]3c:T63b,"ie_to_edge_stub.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "ie_to_edge_stub.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "ie_to_edge_stub.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "ie_to_edge_stub.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "ie_to_edge_stub.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "ie_to_edge_stub.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "ie_to_edge_stub.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "ie_to_edge_stub.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "ie_to_edge_stub.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "ie_to_edge_stub.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "ie_to_edge_stub.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "") "ie_to_edge_stub.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "ie_to_edge_stub.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "")3d:Tb8d,"ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "IE_TO_EDGE_STUB"; Value: "") "ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGE\IETOEDGE"; Key: "LOGGING"; Value: "") "ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\EDGE\IETOEDGE"; Key: "LOGGING"; Value: "") "ie_to_edge_stub.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGE\IETOEDGE"; Key: "DISABLEDPENDINGAUTOUPDATECONSENT"; Value: "")3e:T5c0,"ie_to_edge_stub.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "ie_to_edge_stub.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "ie_to_edge_stub.exe" reads file "c:\users\%osuser%\music\desktop.ini" "ie_to_edge_stub.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "ie_to_edge_stub.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "ie_to_edge_stub.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "ie_to_edge_stub.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"3f:T46f,"ie_to_edge_stub.exe" trying to touch file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\WININET.DLL" "ie_to_edge_stub.exe" trying to touch file "C:\Windows\System32\wininet.dll" "ie_to_edge_stub.exe" trying to touch file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\URLMON.DLL" "ie_to_edge_stub.exe" trying to touch file "C:\Windows\System32\urlmon.dll" "ie_to_edge_stub.exe" trying to touch file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\IERTUTIL.DLL" "ie_to_edge_stub.exe" trying to touch file "C:\Windows\System32\iertutil.dll" "ie_to_edge_stub.exe" trying to touch file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\CRYPTBASE.DLL" "ie_to_edge_stub.exe" trying to touch file "C:\Windows\System32\cryptbase.dll" "ie_to_edge_stub.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "ie_to_edge_stub.exe" trying to touch file "C:\Windows\System32\ole32.dll" "ie_to_edge_stub.exe" trying to touch file "C:\Windows\System32\imm32.dll"40:Tacc,"ie_to_edge_stub.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\WININET.DLL" "ie_to_edge_stub.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\URLMON.DLL" "ie_to_edge_stub.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\IERTUTIL.DLL" "ie_to_edge_stub.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\CRYPTBASE.DLL" "ie_to_edge_stub.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\FLTLIB.DLL" "ie_to_edge_stub.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\CLDAPI.DLL" "ie_to_edge_stub.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\CLDAPI.dll" "ie_to_edge_stub.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\AEPIC.DLL" "ie_to_edge_stub.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\AEPIC.dll" "ie_to_edge_stub.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\BCRYPT.DLL" "ie_to_edge_stub.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\bcrypt.dll" "ie_to_edge_stub.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\PROPSYS.DLL" "ie_to_edge_stub.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\PROPSYS.dll" "ie_to_edge_stub.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\EDPUTIL.DLL" "ie_to_edge_stub.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\edputil.dll" "ie_to_edge_stub.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\SSPICLI.DLL" "ie_to_edge_stub.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\SspiCli.dll" "ie_to_edge_stub.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\107.0.1418.56\BHO\NETUTILS.DLL"41:Tfd9,"ie_to_edge_stub.exe" trying to access non-existent file "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe:ZONE.IDENTIFIER" "ie_to_edge_stub.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe:Zone.Identifier" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AB9AE87DACA1D75EECBD727E982877D19EF1ED22BF0A180AC974D283DC9979CA.EXE.LOG" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" trying to access non-existent file "\Device\HarddiskVolume2\AB9AE87DACA1D75EECBD727E982877D19EF1ED22BF0A180AC974D283DC9979CA.EXE.CONFIG" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" trying to access non-existent file "C:\ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe.config" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\WAW" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" trying to access non-existent file "\Device\HarddiskVolume2\AB9AE87DACA1D75EECBD727E982877D19EF1ED22BF0A180AC974D283DC9979CA.INI" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" trying to access non-existent file "C:\ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.INI" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DRAWING.INI" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" trying to access non-existent file "\Device\HarddiskVolume2\AB9AE87DACA1D75EECBD727E982877D19EF1ED22BF0A180AC974D283DC9979CA.EXE.LOCAL" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" trying to access non-existent file "C:\ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe.Local\" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\ACCESSIBILITY" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\ACCESSIBILITY.INI" "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.INI"42:T2e34,Heuristic match: "9kAt.aT" Heuristic match: "#5.VN" Pattern match: "j.IsdB/:&m/TW" Pattern match: "W.T.Mzv/dnmeDmGH]3#;bwrqz@" Pattern match: "https://chrome.google.com/webstore},urls:[https://chrome.google.com/webstore]},description:Discover" Pattern match: "avocet.io/aprecision.net/adpdealerservices.com/nuffnang.com.my/demdex.net/augur.io/cmmeglobal.com/adrolays.com/atrinsic.com/acuityads.com/wishabi.net/admedia.com/vertamedia.com/adworx.at/2leep.com/globe7.com/awaps.yandex.ru/i-behavior.com/reklamstore.com/m" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53r3l?ver=5412,PORTRAIT:https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53bta?ver=2bf3,update_period:86400},creativeId:128000000003595" Pattern match: "https://www.bing.com/search?q=" Pattern match: "https://www.bestbuy.com/site/help-topics/price-match-guarantee/pcmcat290300050002.c?id=pcmcat290300050002},costco.com:{policyDays:30,supportPageUrl:https://customerservice.costco.com/app/answers/detail/a_id/628/~/price-adjustment---costco.com-orders,u" Pattern match: "google.as/cambio.com/chrome.google.com/theboombox.com/baynote.com/aolanswers.com/tidaltv.com/disqus.com/heyzap.com/google.com.au/google.co.id/google.kg/google.co.ve/google.nr/yahoo.com/autoblog.com/feedproxy.google.com/s-msn.com/mandatory.com/noisecreep.co" Pattern match: "https://www.clarity.ms,supports_spdy:true},{anonymization:[],server:https://microsoftedgewelcome.microsoft.com,supports_spdy:true},{anonymization:[],server:https://edgefrecdn.azureedge.net,supports_spdy:true},{anonymization:[],server" Pattern match: "cmail26.com/indexww.com/mkt5654.com/snapchat.com/mgid.com/zendable.com/mkt3798.com/adsafety.net/technical-service.net/hybrid.ai/contentsquare.net/mkt32.net/helpscout.net/admanmedia.com/mkt8756.com/dmxleo.com/mkt9430.com/basis.net/mailstat.us/mkt7832.com/bf" Pattern match: "autofill.account.microsoft.com/,type" Pattern match: "acxiom.com/atinternet.com/hitslink.com/mm7.net/go-mpulse.net/retailautomata.com/free-pagerank.com/amplitude.com/i-stats.com/dl-rms.com/enquisite.com/p.brsrvr.com/onestat.com/lyris.com/alexametrics.com/inboundwriter.com/awio.com/betssonpalantir.com/xiti.com" Pattern match: "emaillabs.co/open.mkt4477.com/open.mkt10008.com/open.mkt6917.com/open.mkt1946.com/convertkit-mail5.com/social-tracker.msedgedemo.example/open.mkt8062.com/open.mkt8008.com/open.mkt6316.com/m3651.net/open.mkt6793.com/open.mkt3838.com/open.mkt4158.com/eds5.ma" Pattern match: "http://www.w3.org/TR/html4/loose.dtd" Pattern match: "www.google.com/xjs/_/js/k=xjs.hd.en.EQqozfh3j4k.O/ck=xjs.hd.zF0TDmtzxbY.L.W.O/am=CAAAAAAAAAAAAAAAAAAAAAIAAACifsIhgA0gQCAABAAAgCAACFgxhRAMABDwUCYAACAWIAiBAUBU8J4HAICEKgAAAAAAEPaDCAAAIAAAAAMAABDQBDRACFQEBAAAAJAHAMADQAyiLQAAAAAAAAAAAAACkiAYXJAAKAiAAAAAAAAAAAA" Pattern match: "www.google.com/xjs/_/js/k=xjs.hd.en.EQqozfh3j4k.O/am=CAAAAAAAAAAAAAAAAAAAAAIAAACifsIhgA0gQCAABAAAgCAACFgxhRAMABDwUCYAACAWIAiBAUBU8J4HAICEKgAAAAAAEPaDCAAAIAAAAAMAABDQBDRACFQEBAAAAJAHAMADQAyiLQAAAAAAAAAAAAACkiAYXJAAKAiAAAAAAAAAAAAAAEhJkxcDCQ/d=1/ed=1/dg=2/rs" Pattern match: "ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.s" Pattern match: "www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.cr6DI3NzUcU.es5.O/ck=boq-one-google.OneGoogleWidgetUi.bFYcbJ5k0Tw.L.W.O/am=CGFIGw/d=1/exm=A7fCU,BVgquf,COQbmf,EEDORb,EFQ78c,GkRiKb,IZT63,JNoxi,KG2eXe,KUM7Z,L1AAkb,LEikZe,MI6k7c" Pattern match: "www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.cr6DI3NzUcU.es5.O/ck=boq-one-google.OneGoogleWidgetUi.bFYcbJ5k0Tw.L.W.O/am=CGFIGw/d=1/exm=_b,_tp/excm=_b,_tp,calloutview/ed=1/wt=2/ujg=1/rs=AM-SdHsp2X9m3WEKe8HnJ9DMxq3Rh6tmdw/e" Pattern match: "anybest.site/webmine.pro/jsecoin.com/flightzy.bid/nerohut.com/flightsy.bid/coinpot.co/yololike.space/flightzy.win/zymerget.bid/bitcoin-pay.eu/freecontent.stream/authedwebmine.cz/zymerget.faith/hostingcloud.racing/mineralt.io/dinorslick.icu/coinhive.com/bms" Pattern match: "https://clients2.google.com/service/update2/crx" Pattern match: "ufpcdn.com/vdx.tv/ebaystatic.com/ad4m.at/00px.net/warumbistdusoarm.space/ownpage.fr/smct.io/ansira.com/photorank.me/fengkongcloud.com/vtex.com.br/vocento.com/ie8eamus.com/flocktory.com/justpremium.com/dynata.com/stripst.com/adskeeper.com/curalate.com/vptms" Pattern match: "auth.adobe.com/^/horizonte.browserapps.amazon.com/^/horizonte.browserapps.amazon.de/^/horizonte.browserapps.amazon.ca/^/acrobatservices.adobe.com/^/signin.aws.amazon.com/^/horizonte-browserapps.amazon.com.br/^/zendesk.com/^/my.salesforce.com/^/disqus.com/^" Heuristic match: "Google LLC and its affiliates (Google) own all legal right, title andinterest in and to the content decryption module software (Software) andrelated documentation, including any intellectual property rights in theSoftware. You may not use, modify, sell" Pattern match: "www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.cr6DI3NzUcU.es5.O/am=CGFIGw/d=1/excm=_b,_tp,calloutview/ed=1/dg=0/wt=2/ujg=1/rs=AM-SdHsaRCadY6Dj8gF6WdA17P7S27aTvw/m=_b,_tp" Pattern match: "www.gstatic.com/og/_/js/k=og.qtm.en_US.I43EUmH7Doc.2019.O/rt=j/m=qabr,q_d,qcwid,qapid,qald,q_dg/exm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/rs=AA2YrTu5qD9kyMuaVDC1w0N4k2sR6rPyNA" Pattern match: "mail.google.com/apps.fbsbx.com/fb.com/developers.google.com/friendfeed.com/social-tracker.msedgedemo.example/googlemail.com/facebook.com/plus.google.com/fbsbx.com/voice.google.com/facebook.de/facebook.fr/wave.google.com/twimg.com/orkut.com/twitter.jp/gmail" Pattern match: "assets.db/MANIFEST-0000012023/11/08-10:44:31.944" Pattern match: "apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.CzrNRWo3AFk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8xPbrtpW2bPUIcgU2adGqIEpV82Q/cb=gapi.loaded_0" Pattern match: "https://support.microsoft.com/en-us/office/160fa918-d581-4932-9e4e-1075c4713595?ui=en-us&rs=en-us&ad=us" Pattern match: "zadn.vn/ansira.com/fcmatch.google.com/origo.hu/fcmatch.youtube.com/refersion.com/flocktory.com/vtex.com.br/rqtrk.eu/vocento.com/fingerprinter.msedgedemo.example/" Pattern match: "gimbal.com/thirdwatch.ai/fndrsp.net/analytics-tracker.msedgedemo.example/cuebiq.com/inrix.com/zoominfo.com/clarity.ms/" Pattern match: "microsoftedgeinsider.com/Fabrikam^microsoftedgeinsider.com/VanArsdel^microsoftedgeinsider.com/" Pattern match: "fcmatch.youtube.com/fcmatch.google.com/other-tracker.msedgedemo.example/" Pattern match: "http://www.w3.org/2000/svg" Heuristic match: "ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Pattern match: "www.google.com" Pattern match: "www.google.comConnection" Heuristic match: "adservice.google.com" Heuristic match: "api.ipify.org" Heuristic match: "apis.google.com" Heuristic match: "arc.msn.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "ogs.google.com" Heuristic match: "play.google.com" Heuristic match: "ssl.gstatic.com" Pattern match: "www.gstatic.com" Pattern match: "Math.PI/180" Pattern match: "https://www.bing.com/api/shopping/v1/ux/images/autoApply/Shopping_Finished_Dark_01.mp4:https://www.bing.com/api/shopping/v1/ux/images/autoApply/Shopping_Finished_01.mp4}function" Pattern match: "https://support.goodrx.com/hc/en-us/articles/115005225563-Terms-of-Use" Pattern match: "https://www.bing.com/api/shopping/v1/savings/goodrx/getCouponFromKey,s" Pattern match: "https://www.bing.com/api/shopping/v1/ux/images/instantATC/inprogress_Cart.svg,C.style.marginLeft=auto,C.style.marginRight=auto,C.style.marginTop=20px;const" Pattern match: "https://www.coupons.com===e.origin" Pattern match: "https://privacy.microsoft.com/en-us/privacystatement,l.textContent=s,r.textContent=o,r.appendChild(l),r.className=txtMedium,r.style.textAlign=start;const" Pattern match: "https://cashback.microsoft.com/details?merchant=${o.merchantName}&domain=${Ue.GetL2DomainName()}`,n.target=_blank,n.textContent=this.platformInstance.GetResourceString(IC.noCouponsCashbackActivatedOfferDetails),n.style.color=this.utilities.IsDarkTheme()?" Pattern match: "https://cashback.microsoft.com/details?merchant=${t}&domain=${Ue.GetL2DomainName()" Pattern match: "https://cashback.microsoft.com/details?merchant=${r.merchantName}&domain=${Ue.GetL2DomainName()" Pattern match: "https://www.${A}`;window.open(e)" Pattern match: "https://github.com/microsoft/fast/issues/5848" Pattern match: "https://choice.microsoft.com" Pattern match: "https://www.bing.com/api/shopping/v1/ux/images/priceComparison/adSlug.png/" Pattern match: "https://bing.com/th?id=${this.cheapestFlight.Logo.ThumbnailId}&w=60&h=60`||}getDataString(t){var" Pattern match: "https://www.${e}${i.RetailerCartPage}`:`https://www.${e}`,a=new" Pattern match: "https://microsoft.com/en-us/edge/launch/59?form=ML2F1I" Heuristic match: "`}};var jM=class{constructor(t,e){i(this,flyoutData,void 0),i(this,commonAssets,void 0),i(this,cashbackAssets,void 0),this.flyoutData=t,this.commonAssets=e,this.cashbackAssets=new VM}styleDefaultState(t,e){t&&(t.disabled=!1,t.appearance=accent" Pattern match: "https://startapp.microsoft.com/start?adjust=10bdvh2b_102v7fda" Pattern match: "http://www.w3.org/2000/svg},t" Pattern match: "https://privacy.microsoft.com/privacystatement,target:_blank,onClick:s},n.strings.commonMicrosoftPolicy" Pattern match: "https://aka.ms/inbox-coupons-feedback,target:_blank},t.strings.feedbackForm" Pattern match: "https://aka.ms/inboxcoupons,metadata:{isExpanded:p}};return" Pattern match: "https://www.bing.com/api/shopping/v1/savings/goodrx/getCouponFromKey,r=await" Pattern match: "https://{hostName}/{localeCode}/shopping/deals,backgroundStyles:--shopping-stripe-heading-color" Pattern match: "http://www.w3.org/2000/svg};return" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=518021,target:_blank,appearance:hypertext,rel:noopener" Pattern match: "https://+e" Pattern match: "https://www.microsoft.com/" Pattern match: "http://schema.org/WebPage" Pattern match: "www.gstatic.com,og.qtm.en_US.I43EUmH7Doc.2019.O,com,en,538,0,[4,2,,,,579700059,0],null,rWdLZYj5F4CMkPIPkJGJkA8,null,0,og.qtm.QDAqXNqS-jk.L.W.O,AA2YrTu5qD9kyMuaVDC1w0N4k2sR6rPyNA,AA2YrTunpcuw_NzFhp5BJwL6GIxfNXRFgQ,,2,1,200,USA" Pattern match: "https://www.google.com;b+=/gen_204?use_corp=on&;b+=a.Ia(2040-b.length);Wc(_.Rc(b)||_.Vc)};Wc=function(a){var" Pattern match: "www.google.com/search?gws_rd%3Dssl%26q%3Dreflection%2Bnebula%26um%3D1%26ie%3DUTF-8%26tbm%3Disch%26csf%3Db\x22,\x22id\x22:\x22stellar\x22,\x22msg\x22:\x22I\x27m" Pattern match: "http://www.google.com/" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Pattern match: "Microsoft.Net/assembly/GAC_32/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=42127"43:Taed,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6l" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffH" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com"44:Tbc3,"ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\* (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "FindNextFileW" with parameter 36eaccfde177c2e7b93b8dbdde4e012a (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WAW\* (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\* (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\* (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\* (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "FindNextFileW" with parameter 96f7edb07b12303f0ec2595c7f3778c7 (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\* (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "FindNextFileW" with parameter 15af16d373cf0528cb74fc73d365fdbf (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Accessibility\* (UID: 00000000-00002408) "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\* (UID: 00000000-00002408)45:T793,file/memory contains long string with (Indicator: "aes"; File: "bbf58c64-c3fd-4904-81bb-fa634711136b.tmp") file/memory contains long string with (Indicator: "aes"; File: "1b6acc11-31de-43f4-8c6f-600ac5059e8d.tmp") file/memory contains long string with (Indicator: "aes"; File: "ee0f4553-6da9-4af7-8166-990fcc3988dd.tmp") file/memory contains long string with (Indicator: "aes"; File: "84394bf81005269b_0") file/memory contains long string with (Indicator: "aes"; File: "9401376df0c24f3d_0") file/memory contains long string with (Indicator: "aes"; File: "5ec8fff7368f771a_0") file/memory contains long string with (Indicator: "aes"; File: "410abe19d7b34552_0") file/memory contains long string with (Indicator: "aes"; File: "2ba88413fd7dc29e_0") file/memory contains long string with (Indicator: "aes"; File: "4ff683f661a61bb8_0") file/memory contains long string with (Indicator: "base64"; File: "edge_confirmation_page_validator.js") file/memory contains long string with (Indicator: "base64"; File: "shoppingfre.js") file/memory contains long string with (Indicator: "base64"; File: "auto_open_controller.js") file/memory contains long string with (Indicator: "base64"; File: "edge_driver.js") file/memory contains long string with (Indicator: "aes"; File: "edge_driver.js") file/memory contains long string with (Indicator: "base64"; File: "product_page.js") file/memory contains long string with (Indicator: "base64"; File: "edge_checkout_page_validator.js") file/memory contains long string with (Indicator: "base64"; File: "shopping.js") file/memory contains long string with (Indicator: "aes"; File: "urlref_httpwww.google.com") file/memory contains long string with (Indicator: "base64"; File: "urlref_httpwww.google.com") Found string "description="Uses RsaCryptoServiceProvider to encrypt and decrypt"" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00002408.00000000.66161.03500000.00000004.mdmp")46:T54b,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002408.00000000.66161.03500000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002408.00000000.66161.03500000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002408.00000000.66161.03500000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002408.00000000.66161.03500000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002408.00000000.66161.03500000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002408.00000000.66161.03500000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002408.00000000.66161.03500000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002408.00000000.66161.03500000.00000004.mdmp")47:T9af,"ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FONTCACHE\PARAMETERS"; Key: "CLIENTCACHESIZE"; Value: "") "ab9ae87daca1d75eecbd727e982877d19ef1ed22bf0a180ac974d283dc9979ca.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\REGSVCS.EXE"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "")48:T119b,Dropped file: "000003.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00002656] Dropped file: "f_0004cc" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cc]- [targetUID: 00000000-00007176] Dropped file: "f_0004c4" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c4]- [targetUID: 00000000-00007176] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1]- [targetUID: 00000000-00007824] Dropped file: "index" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index]- [targetUID: 00000000-00008144] Dropped file: "2d15f065-90ea-4ea5-ac9b-b7133b7501d7.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\2d15f065-90ea-4ea5-ac9b-b7133b7501d7.tmp]- [targetUID: 00000000-00007824] Dropped file: "ff7edeea-1e7a-41cd-a749-15d3b7424b27.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\ff7edeea-1e7a-41cd-a749-15d3b7424b27.tmp]- [targetUID: 00000000-00007824] Dropped file: "bdf61286-e9f6-4942-ba8f-e979e0739075.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\bdf61286-e9f6-4942-ba8f-e979e0739075.tmp]- [targetUID: 00000000-00007824] Dropped file: "ae435cd3-a15f-427b-bcba-a9bf2eb32f7b.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ae435cd3-a15f-427b-bcba-a9bf2eb32f7b.tmp]- [targetUID: 00000000-00007824] Dropped file: "e8803fc3-d09c-43fc-950f-6e5cddb33047.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\e8803fc3-d09c-43fc-950f-6e5cddb33047.tmp]- [targetUID: 00000000-00007824] Dropped file: "4f249016-d14e-4a4d-9084-e104ff5b96f9.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\4f249016-d14e-4a4d-9084-e104ff5b96f9.tmp]- [targetUID: 00000000-00007824] Dropped file: "1f0a12c8-0d92-4beb-a790-faa08337c10b.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\1f0a12c8-0d92-4beb-a790-faa08337c10b.tmp]- [targetUID: 00000000-00007824] Dropped file: "b3d2ecc9-fa76-495b-9825-830a35f5b76f.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\b3d2ecc9-fa76-495b-9825-830a35f5b76f.tmp]- [targetUID: 00000000-00007824] Dropped file: "3c101290-645a-4c4f-91d3-d1a26168812a.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\3c101290-645a-4c4f-91d3-d1a26168812a.tmp]- [targetUID: 00000000-00007824] Dropped file: "dfc74904-44f6-4263-993a-4838a06b78d6.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\dfc74904-44f6-4263-993a-4838a06b78d6.tmp]- [targetUID: 00000000-00007824] Dropped file: "df8d3c3c-2490-45c9-949a-8c10ebf3c9ce.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\df8d3c3c-2490-45c9-949a-8c10ebf3c9ce.tmp]- [targetUID: 00000000-00007824] Dropped file: "8e79919c-1fd6-4f78-8779-c78254f6bbce.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\8e79919c-1fd6-4f78-8779-c78254f6bbce.tmp]- [targetUID: 00000000-00007824] Dropped file: "f_0004c8" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c8]- [targetUID: 00000000-00007176] Dropped file: "c675808a-9710-4aaf-b82d-1965b1754c3d.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\c675808a-9710-4aaf-b82d-1965b1754c3d.tmp]- [targetUID: 00000000-00007824] Dropped file: "cc5e84b5-db96-4bdb-9215-906b8ce33237.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\cc5e84b5-db96-4bdb-9215-906b8ce33237.tmp]- [targetUID: 00000000-00007824] Dropped file: "4ff3d7f9-406d-4c85-8efb-89a63a3c0706.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\4ff3d7f9-406d-4c85-8efb-89a63a3c0706.tmp]- [targetUID: 00000000-00007824] Dropped file: "e2f60dd0-a5f2-4bfe-b04b-7a1d699bbd67.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\e2f60dd0-a5f2-4bfe-b04b-7a1d699bbd67.tmp]- [targetUID: 00000000-00007824] Dropped file: "5053cdb7-4855-4e14-9f5e-14cd0792996a.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\5053cdb7-4855-4e14-9f5e-14cd0792996a.tmp]- [targetUID: 00000000-00007824] Dropped file: "f_0004cb" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cb]- [targetUID: 00000000-00007176] Dropped file: "arbitration_service_config.json" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\arbitration_service_config.json]- [targetUID: 00000000-00007824]49:T6610,"

Google apps