26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 92:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T494,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Lazy.Generic Sample ad6484135f0e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ad6484135f0e…. Malware family: Lazy.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 7 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","keywords":["Malicious","Lazy.Generic","malware analysis","sandbox report","threat intelligence","ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c"],"about":{"@type":"SoftwareApplication","name":"ad6484135f0edf91.bin.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Lazy.Generic","antivirusDetections":{"malicious":9,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1162,Found reference to API "CoreWebView2ServiceWorkerManager members cannot be accessed after the WebView2 control is disposed." (Indicator: "access"; Source: "sample.bin"), Found reference to API "schtasks /create /tn Updater /tr evil.exe /sc onlogon" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "OnEstimatedEndTimeChanged" (Indicator: "time"; Source: "sample.bin"), file/memory contains long string with (Indicator: "time"; Source: "sample.bin"), Found reference to API "{"cmd":"rebootAck","ok":false,"msg":" (Indicator: "reboot"; Source: "sample.bin"), Found reference to API "CoreWebView2PermissionRequestedEventArgs members can only be accessed from the UI thread." (Indicator: "access"; Source: "sample.bin"), Found reference to API "CoreWebView2PermissionRequestedEventArgs members can only be accessed from the UI thread." (Indicator: "read"; Source: "sample.bin"), Found reference to API "remove_SaveFileSecurityCheckStarting" (Indicator: "security"; Source: "sample.bin"), Found reference to API "get_PhysicalKeyStatus" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "StartAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "OnServerCertificateErrorDetected" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "CoreWebView2WebMessageReceivedEventArgs members can only be accessed from the UI thread." (Indicator: "access"; Source: "sample.bin"), Found reference to API "CoreWebView2WebMessageReceivedEventArgs members can only be accessed from the UI thread." (Indicator: "read"; Source: "sample.bin"), Found reference to API "COREWEBVIEW2_WEB_ERROR_STATUS_CERTIFICATE_IS_INVALID" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "d__22" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "d__22" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "remove_ServerCertificateErrorDetected" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "set__nativeICoreWebView2ServerCertificateErrorDetectedEventArgs" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "d__59" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "d__59" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "CoreWebView2HttpResponseHeaders members can only be accessed from the UI thread." (Indicator: "access"; Source: "sample.bin"), Found reference to API "CoreWebView2HttpResponseHeaders members can only be accessed from the UI thread." (Indicator: "read"; Source: "sample.bin"), Found reference to API "set__nativeICoreWebView2ScriptDialogOpeningEventArgs" (Indicator: "open"; Source: "sample.bin"), Found reference to API "CoreWebView2FindOptions members can only be accessed from the UI thread." (Indicator: "access"; Source: "sample.bin"), Found reference to API "CoreWebView2FindOptions members can only be accessed from the UI thread." (Indicator: "read"; Source: "sample.bin"), Found reference to API "d__21" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "d__21" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "CoreWebView2DedicatedWorkerCreatedEventArgs members cannot be accessed after the WebView2 control is disposed." (Indicator: "access"; Source: "sample.bin"), Found reference to API "CoreWebView2DedicatedWorkerCreatedEventArgs members cannot be accessed after the WebView2 control is disposed." (Indicator: "creat"; Source: "sample.bin"), Found reference to API "d__15" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "d__15" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "CoreWebView2Cookie members can only be accessed from the UI thread." (Indicator: "access"; Source: "sample.bin"), Found reference to API "CoreWebView2Cookie members can only be accessed from the UI thread." (Indicator: "read"; Source: "sample.bin")28:T4e5,Pattern match: "https://learn.microsoft.com/microsoft-edge/webview2/concepts/versioning", Pattern match: "https://yudun.pages.dev/virdb/", Pattern match: "https://localhost", Pattern match: "https://localhost:8080/", Pattern match: "https://www.microsoft.com", Pattern match: "https://app.yudun.local/", Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0", Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z", Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0", Pattern match: "https://yudun.pages.dev/virdb/manifest.json", Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0", Pattern match: "https://xposedornot.com/", Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0", Pattern match: "www.microsoft.com/pkiops/docs/repository.htm0", Pattern match: "https://app.yudun.local/index.html", Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0m", Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^", Heuristic match: " *.sz", Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l"29:Te46,Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "VirtualAlloc failed" (Indicator: "VirtualAlloc"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "::WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "__crtCreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "__crtCreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "VirtualAlloc failed" (Indicator: "VirtualAlloc"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "::WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "VirtualAlloc failed" (Indicator: "VirtualAlloc"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "::WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")2a:Tb60,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "QueryInterface" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetObjectForIUnknown" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Release" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetComInterfaceForObject" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetExceptionForHR" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ThrowExceptionForHR" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForLastWin32Error" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadIntPtr" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt64" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetNativeVariantForObject" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt32" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt64" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeCoTaskMem" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StringToCoTaskMemAuto" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteIntPtr" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "Microsoft.Web.WebView2.Core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "YuDun.exe"2b:Td8f,Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")2c:T109d,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "__crtGetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject crash dump requested" (Indicator: "WaitForSingleObject"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject non-crash dump requested" (Indicator: "WaitForSingleObject"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject process end" (Indicator: "WaitForSingleObject"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp")2d:T8fc,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")2e:T83c,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "OPEN"; Path: "HKCU\EXPLORERCLSIDFLAGS\{66742402-F9B9-11D1-A202-0000F81FEDEE}") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXPLORERCLSIDFLAGS\{66742402-F9B9-11D1-A202-0000F81FEDEE}") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SYNCROOTMANAGER") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SYNCROOTMANAGER") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCHANDLER32")2f:Tbf7,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1065672975 [PID: 7288] "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1065679929 [PID: 7288] "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1065875830 [PID: 7288] "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1065883393 [PID: 7288] "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1066048510 [PID: 7288] "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1066056064 [PID: 7288] "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1067740874 [PID: 7288] "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1067748363 [PID: 7288] "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1068874470 [PID: 7288] "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1068882247 [PID: 7288] "YuDun.exe" queried SystemProcessInformation at 00000000-00003388-00000C15-1069638854 [PID: 3388] "YuDun.exe" queried SystemProcessInformation at 00000000-00003388-00000C15-1069647203 [PID: 3388] "YuDun.exe" queried SystemProcessInformation at 00000000-00003388-00000C15-1069829356 [PID: 3388] "YuDun.exe" queried SystemProcessInformation at 00000000-00003388-00000C15-1069837944 [PID: 3388] "YuDun.exe" queried SystemProcessInformation at 00000000-00003388-00000C15-1070035625 [PID: 3388] "YuDun.exe" queried SystemProcessInformation at 00000000-00003388-00000C15-1070044297 [PID: 3388] "YuDun.exe" queried SystemProcessInformation at 00000000-00003388-00000C15-1072863909 [PID: 3388] "YuDun.exe" queried SystemProcessInformation at 00000000-00003388-00000C15-1072871533 [PID: 3388] "YuDun.exe" queried SystemProcessInformation at 00000000-00003388-00000C15-1123744496 [PID: 3388] "YuDun.exe" queried SystemProcessInformation at 00000000-00003388-00000C15-1123752945 [PID: 3388] "YuDun.exe" queried SystemProcessInformation at 00000000-00003388-00000C15-1123997617 [PID: 3388] "YuDun.exe" queried SystemProcessInformation at 00000000-00003388-00000C15-1124004481 [PID: 3388] "YuDun.exe" queried SystemProcessInformation at 00000000-00003388-00000C15-1124012044 [PID: 3388] "YuDun.exe" queried SystemProcessInformation at 00000000-00003388-00000C15-1124018430 [PID: 3388] "YuDun.exe" queried SystemProcessInformation at 00000000-00003388-00000C15-1124052018 [PID: 3388]30:T107a,"msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\a5f4f9fc-9383-4ac2-bff4-2657ea5d9f18.tmp" to "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Local State" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\Site Characteristics Database\000001.dbtmp" to "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Site Characteristics Database\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp" to "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\Extension Rules\000001.dbtmp" to "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension Rules\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\Code Cache\js\index-dir\temp-index" to "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\Code Cache\wasm\index-dir\temp-index" to "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp" to "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\shared_proto_db\metadata\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\shared_proto_db\000001.dbtmp" to "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\shared_proto_db\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\Extension Scripts\000001.dbtmp" to "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension Scripts\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\Extension State\000001.dbtmp" to "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension State\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\component_crx_cache\5ab03da0-c3b0-4b33-9778-3aabd9bb1325.tmp" to "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\component_crx_cache\metadata.json" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\ec7517c9-5299-49e8-8897-54c6396d2518.tmp" to "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Secure Preferences" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\1d49a363-8f97-441d-a125-fa622b45d613.tmp" to "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Preferences" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\Shared Dictionary\cache\index-dir\temp-index" to "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\Network\72d93f09-4375-463b-9bff-d9fc6421055c.tmp" to "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\Network\b80781d5-cc21-4429-b220-b58cdb1953fe.tmp" to "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\Sdch Dictionaries" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\Network\68868594-38c5-4ea0-8639-b69a52eba378.tmp" to "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\Network Persistent State"31:T4c7,Process "WerFault.exe" [UID: 00000000-00002460] Process "WerFault.exe" [UID: 00000000-00006696] Process "WerFault.exe" [UID: 00000000-00001760] Process "WerFault.exe" [UID: 00000000-00008840] Process "WerFault.exe" [UID: 00000000-00007908] Process "WerFault.exe" [UID: 00000000-00008336] Process "WerFault.exe" [UID: 00000000-00003480] Process "WerFault.exe" [UID: 00000000-00008248] Process "WerFault.exe" [UID: 00000000-00008872] Process "WerFault.exe" [UID: 00000000-00007500] Process "WerFault.exe" [UID: 00000000-00005136] Process "WerFault.exe" [UID: 00000000-00004256] Process "WerFault.exe" [UID: 00000000-00007804] Process "WerFault.exe" [UID: 00000000-00001004] Process "WerFault.exe" [UID: 00000000-00007812] Process "WerFault.exe" [UID: 00000000-00007824] Process "WerFault.exe" [UID: 00000000-00002380] Process "WerFault.exe" [UID: 00000000-00009112] Process "WerFault.exe" [UID: 00000000-00007184] Process "WerFault.exe" [UID: 00000000-00002756] Process "WerFault.exe" [UID: 00000000-00006068] Process "WerFault.exe" [UID: 00000000-00006452] Process "WerFault.exe" [UID: 00000000-00003356] Process "WerFault.exe" [UID: 00000000-00008340] Process "WerFault.exe" [UID: 00000000-00002804]32:T491,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Contains CRYPTO related strings Matched sigs: Able to decrypt/decode data Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to performs encryption on the data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform crypto operations Matched sigs: YARA signature match - PowerShell with Base64 encoding33:Tcd2,Found XOR loop in file "Microsoft.Web.WebView2.Core.dll" at offset 198107; code bytes = 30d0 Found XOR loop in file "Microsoft.Web.WebView2.Core.dll" at offset 198123; code bytes = 30d0 Found XOR loop in file "Microsoft.Web.WebView2.Core.dll" at offset 691254; code bytes = 30d0 Found XOR loop in file "Microsoft.Web.WebView2.Core.dll" at offset 175335; code bytes = 8030 Found XOR loop in file "Microsoft.Web.WebView2.Core.dll" at offset 176735; code bytes = 8030 Found XOR loop in file "Microsoft.Web.WebView2.Core.dll" at offset 688882; code bytes = 8030 Found XOR loop in file "Microsoft.Web.WebView2.Core.dll" at offset 693871; code bytes = 8030 Found XOR loop in file "WebView2Loader.dll" at offset 130448; code bytes = 30d0 Found XOR loop in file "WebView2Loader.dll" at offset 146452; code bytes = 30d0 Found XOR loop in file "WebView2Loader.dll" at offset 157750; code bytes = 30d0 Found XOR loop in file "WebView2Loader.dll" at offset 21647; code bytes = 33c1 Found XOR loop in file "WebView2Loader.dll" at offset 158271; code bytes = 33c1 Found XOR loop in file "WebView2Loader.dll" at offset 25020; code bytes = 8030 Found XOR loop in file "WebView2Loader.dll" at offset 68012; code bytes = 8030 Found XOR loop in file "WebView2Loader.dll" at offset 155378; code bytes = 8030 Found XOR loop in file "WebView2Loader.dll" at offset 160367; code bytes = 8030 Found XOR loop in file "Microsoft.Web.WebView2.WinForms.dll" at offset 31798; code bytes = 30d0 Found XOR loop in file "Microsoft.Web.WebView2.WinForms.dll" at offset 29426; code bytes = 8030 Found XOR loop in file "Microsoft.Web.WebView2.WinForms.dll" at offset 34415; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 200503; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 200519; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 693650; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 732410; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 869820; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 885824; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 897122; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1066580; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1067750; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1080407; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 761019; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 897643; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 177731; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 179131; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 691278; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 696267; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 730038; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 735027; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 764392; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 807384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 894750; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 899739; code bytes = 803034:T515,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007288-00000C2C-1067685155") Found reference to API "NtQuerySystemInformationW" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003388-00000C2C-1123743738") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")35:T4c5,Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007288-00000C2C-1067685155") Found string "NtQuerySystemInformationW" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003388-00000C2C-1123743738") Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found string "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found string "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found string "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found string "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")36:T545,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "WebView2Loader.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "YuDun.exe") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00007288-00000C2C-1068036390") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")37:T437,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007288-00000C2C-1066774221") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00007288-00000C2C-1066774864") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00007228-00000C2C-1124568941") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")38:Te48,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "__crtGetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00005148.00000000.189261.70EC4000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00005148.00000000.189261.70EC4000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005148.00000000.189261.70EC4000.00000002.mdmp")39:T6f4,Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")3a:T792,Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00005148.00000000.189261.70EC4000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00005148.00000000.189261.70EC4000.00000002.mdmp")3b:Tfbfd,Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00007288-00000C2C-1068267100") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00007288-00000C2C-1068267426") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00007288-00000C2C-1068336570") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00007288-00000C2C-1068336635") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00003388-00000C2C-1122824462") Found reference to API "Mojo.Channel.WriteSendMessageProcessType" (Indicator: "sendmessage"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "AttemptToNotifyRunningChrome:SendMessage" (Indicator: "sendmessage"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "AttemptToNotifyRunningChrome:SendMessage" (Indicator: "sendmessage"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "runtime.sendMessage" (Indicator: "sendmessage"; Source: "00000000-00005148.00000000.189261.00090000.00000004.mdmp, 00000000-00005148.00000000.189261.005E0000.00000004.mdmp") Found reference to API "postMessage" (Indicator: "postmessage"; Source: "00000000-00005148.00000000.189261.00100000.00000002.mdmp") Found reference to API "globalParams = {'sdkVersion': 7,'useNativeEvent': true,'usePostMessageWithAdditionalObjects': true};(()=>{if(window.EmbeddedBrowserWebView){window.chrome||(window.chrome={});const e=window.EmbeddedBrowserWebView,t=window.gc,r=globalParams.sdkVersion<=2,s=globalParams.sdkVersion>=7,o=globalParams.useNativeEvent,a=globalParams.logNativeEvent,i=globalParams.useTextureStream,n=globalParams.usePostMessageWithAdditionalObjects;if(delete window.EmbeddedBrowserWebView,delete window.gc,delete globalParams,window.top===window||s){function copyObject(e){let t=function copiedObject(...t){return new e(...t)};return window.Object.getOwnPropertyNames(e).concat(window.Object.getOwnPropertySymbols(e)).forEach((r=>{let s=e[r];"function"==typeof s&&(s=s.bind(e)),t[r]=s})),t}const c=copyObject(window.Object),l=copyObject(window.Promise),p=copyObject(window.JSON),h=copyObject(window.console),d=copyObject(window.EventTarget),u=copyObject(window.Proxy),_=copyObject(window.FinalizationRegistry),m=copyObject(window.Set);function delayPropertyCreation(e,t,r){c.defineProperty(e,t,{configurable:!0,enumerable:!0,get:()=>{const s=r();return c.defineProperty(e,t,{configurable:!0,enumerable:!0,writable:!0,value:s}),s}})}delayPropertyCreation(chrome,"webview",(function createChromeWebView(){class LocalRefTracker{constructor(e){this._idToCallback={},this._nextId=1,this._log=e,this._group=null,_&&(this._group=new _(this._cleanup.bind(this)))}_cleanup(e){e&&this._idToCallback[e]&&(this._log("cleanup for "+e),this._idToCallback[e](),delete this._idToCallback[e])}watchForRelease(e,t){if(this._group){const r=this._nextId++,s=e._debugId?.join(" ")||e._debugId;this._log("watching for cleanup of "+r+" ("+s+")"),this._idToCallback[r]=t,this._group.register(e,r)}}cleanupSome(){return t&&(async()=>{await t({type:"full",heap:"all",flags:["force"],execution:"async"})})(),!0}}class ParamTracker{constructor(){this._paramTracker={},this._cleanupRegistry=null,_&&(this._cleanupRegistry=new _((e=>{this.removeParams(e)})))}setParams(e,t){t&&t.length&&(this._paramTracker[e]=t)}getParams(e){return this._paramTracker[e]}hasParams(e){return void 0!==this._paramTracker[e]}removeParams(e){delete this._paramTracker[e]}bindParamsToObjectLifetime(e,t){this._cleanupRegistry&&t&&this._cleanupRegistry.register(e,t)}updateArrayParams(e,t,r){if(t&&r&&this.hasParams(e)){const s=this.getParams(e);for(let e=0;ethis._maxRemoteSequenceId&&(this._maxRemoteSequenceId=e)}addReference(e){null!=e?this._mapRemoteIdToRefCount.hasOwnProperty(e)?++this._mapRemoteIdToRefCount[e]:this._mapRemoteIdToRefCount[e]=1:h.assert(!1,"invalid remoteId in addReference:"+e)}removeReference(e){if(null==e)return void h.assert(!1,"invalid remoteId in removeReference:"+e);h.assert(this._mapRemoteIdToRefCount.hasOwnProperty(e));0===--this._mapRemoteIdToRefCount[e]&&(delete this._mapRemoteIdToRefCount[e],this._releaseObjectsCallback&&(this._releaseObjectsCallback(this._maxRemoteSequenceId,p.stringify([e])),this._log("Sending remote release message "+e)))}}class IdGenerator{constructor(){this._nextId=1}getNextId(){return this._nextId++}}class Deferral{constructor(){let e=this.controls={clear:function(){e.resolve=e.reject=e.clear=function(){},e=null}};this.promise=new l(((t,r)=>{this.controls.resolve=function deferralResolve(...r){const s=t.apply(null,r);return e.clear(),s},this.controls.reject=function deferralReject(...t){const s=r.apply(null,t);return e.clear(),s}}))}}class ObjectSerializer{constructor(e,t,r,s){this._idGenerator=e,this._groupId=t,this._proxyOptions=r,this._proxyOptionsSymbol=Symbol("EmbeddedBrowserWebView.proxyOptions"),this._options=s,this._serializationOptionsPropertyName="1B9FCAB5-FB86-4D78-91DE-7BC2B4077E5B",this._objectIdToObject={},this._paramTracker=new ParamTracker,this._skipPropertyNames=["name","length","arguments","caller"]}_getProxyOptions(e){return e&&e.hasOwnProperty(this._proxyOptionsSymbol)?e[this._proxyOptionsSymbol]:null}_hasProxyOptions(e){return null!==this._getProxyOptions(e)}_setProxyOptions(e,t){c.defineProperty(e,this._proxyOptionsSymbol,{value:t,configurable:!0})}_getOrCreateProxyOptions(e){let t=this._getProxyOptions(e);if(!t){const r=this._idGenerator.getNextId();t={remoteObjectId:r,groupId:this._groupId,type:"proxy",remoteSequenceId:0},this._setProxyOptions(e,t),this._objectIdToObject[r]=e}return t}_updateSequenceNumberForProxyOptions(e,t){h.assert(e),e.groupId===this._groupId&&(h.assert(e.remoteSequenceId<=t),e.remoteSequenceId=t)}getObjectByObjectId(e){return this._objectIdToObject[e]}setObjectProxyOptionsFromResponse(e,t){this._setProxyOptions(e,t.parameters.result[this._serializationOptionsPropertyName])}setObjectByWellKnownObjectId(e,t){h.assert(t<1),this._objectIdToObject[t]=e}getObjectIdBySerializedObjectMessage(e){let t=null;return e&&e.parameters&&e.parameters.result&&e.parameters.result.hasOwnProperty(this._serializationOptionsPropertyName)&&(t=e.parameters.result[this._serializationOptionsPropertyName].remoteObjectId,void 0===t&&(t=null)),t}getHostKeyNamesBySerializedObjectMessage(e){let t=[];return e&&e.parameters&&e.parameters.result&&e.parameters.result.hasOwnProperty(this._serializationOptionsPropertyName)&&(t=e.parameters.result[this._serializationOptionsPropertyName].hostKeyNames||[]),t}updateSequenceNumberFromSerializedObjectMessage(e){if(e&&e.parameters&&e.parameters.result&&e.parameters.result.hasOwnProperty(this._serializationOptionsPropertyName)){const t=e.parameters.result[this._serializationOptionsPropertyName];t.seq_no&&this._proxyOptions.remoteRefTracker.addSequenceId(t.seq_no)}}releaseObjects(e,t){for(const r of t){const t=this.getObjectByObjectId(r);if(t){const s=this._getProxyOptions(t);s&&s.remoteSequenceId<=e&&(delete t[this._proxyOptionsSymbol],delete this._objectIdToObject[r])}}}getAndClearIsCacheableBySerializedObjectMessage(e){let t=!1;return e&&e.parameters&&(t=e.parameters.cache_able,delete e.parameters.cache_able,!t&&e.parameters.result&&e.parameters.result.hasOwnProperty(this._serializationOptionsPropertyName)&&(t=e.parameters.result[this._serializationOptionsPropertyName].cache_able,delete e.parameters.result[this._serializationOptionsPropertyName].cache_able)),t}serialize(e,t){try{const r=this;return p.stringify(e,(function(e,s){let o=s;if("function"==typeof s||r._hasProxyOptions(s)){let a=r._getOrCreateProxyOptions(s);if(r._updateSequenceNumberForProxyOptions(a,t),o={},o[r._serializationOptionsPropertyName]=a,"toString"===e)try{o.value=s()}catch(e){}}else r._options.shouldSerializeDates&&this[e]instanceof Date?o={[r._serializationOptionsPropertyName]:{type:"date"},value:this[e].getTime()}:void 0===s&&(o=null);return o}))}catch(e){throw e}}deserialize(e,t,r,s){let o=s?s[this._serializationOptionsPropertyName]:null;return o&&o.type&&"date"==o.type?this._options.shouldSerializeDates?new Date(s.value.jsTime):s.value.date:t?p.parse(p.stringify(s),((s,o)=>{let a=o,i=o&&o[this._serializationOptionsPropertyName];if(i)if(i.remoteObjectId&&i.groupId!==this._groupId){let n,l,p,d,u;if(i.seq_no&&this._proxyOptions.remoteRefTracker.addSequenceId(i.seq_no),i.scriptBehavior)switch(i.scriptBehavior){case 1:n={},c.getOwnPropertyNames(Array.prototype).concat(c.getOwnPropertySymbols(Array.prototype)).filter((e=>"length"!=e)).forEach((e=>{n[e]=Array.prototype[e]})),n[Symbol.isConcatSpreadable]=!0,l=function(){const e=this.getHostProperty("length");if(void 0===this._arrayPropertyNames&&(this._arrayPropertyNames=[]),this._arrayPropertyNames.length>e)this._arrayPropertyNames.length=e;else if(this._arrayPropertyNames.length"length"!=e)).forEach((t=>{n[t]=e[t]})),n[Symbol.isConcatSpreadable]=!0}else{switch(typeof n){case"string":n=new String(n),s=["toString","valueOf"];break;case"boolean":n=new Boolean(n),s=["toString","valueOf"];break;case"number":n=new Number(n),s=["toExponential","toFixed","toLocaleString","toPrecision","toString","valueOf"]}s.forEach((e=>n[e]=n[e].bind(n))),n[Symbol.isConcatSpreadable]=!1}}l||(l=i.hostKeyNames?this.deserialize(e,t,r,i.hostKeyNames):[]),p||(p=i.hostPrecacheProperties?this.deserialize(e,t,r,i.hostPrecacheProperties):[]),d||i.outArrayResult&&(d=this.deserialize(e,t,r,i.outArrayResult)),u||i.outArrayIndex&&(u=i.outArrayIndex);const _=!!s;if(a=this.createKnownRemoteProxy(i.remoteObjectId,_,e,r,n,l),this._setProxyOptions(a,i),p)for(const[e,t]of c.entries(p))this._proxyOptions.objectSerializer._skipPropertyNames.includes(e)||a.setLocalProperty(e,t);d&&u&&this._proxyOptions.objectSerializer._paramTracker.updateArrayParams(o.callId,d,u)}else i.remoteObjectId?(h.assert(i.groupId===this._groupId),h.assert(this._objectIdToObject.hasOwnProperty(i.remoteObjectId)),a=this._objectIdToObject[i.remoteObjectId]):"undefined"===i.type&&(a=void 0);return a})):s}deserializeArray(e,t,r,s){return s.map(this.deserialize.bind(this,e,t,r))}createKnownRemoteProxy(e,t,r,s,o,a){const i={};i[this._serializationOptionsPropertyName]={remoteObjectId:e};const n={remoteObjectId:e,parameters:{result:i}};let c=null;return c=r?new SyncRemoteProxy(this._proxyOptions,n,s,a):new KnownAsyncRemoteProxy(this._proxyOptions,t,n,s,a),c.createPublicObject(o)}}class RemoteMessenger{constructor(e,t,r,s,o){this._postRemoteObjectCall=e,this._log=r,this._idGenerator=s,this._objectSerializer=o,this._callIdToDetails={},t&&(t.addEventListener("remoteproxycall",(e=>{this._handleRemoteProxyCallEvent(e.data)})),t.addEventListener("remoteproxyrelease",(e=>{this._handleRemoteProxyReleaseEvent(e.data)})))}_setNativeRemoteObjectEventTarget(e){e.addEventListener("remoteproxycall",(e=>{this._handleRemoteProxyCallEvent(p.parse(e.data))})),e.addEventListener("remoteproxyrelease",(e=>{this._handleRemoteProxyReleaseEvent(p.parse(e.data))}))}_handleRemoteProxyCallEvent(e){this._log("remoteproxycall event",e),"request"===e.parameters.kind?this._handleRequest(e):(h.assert("response"===e.parameters.kind),this._handleResponse(e))}_handleRemoteProxyReleaseEvent(e){this._log("remoteproxyrelease event",e),this._handleReleaseObjects(e)}_postRemoteProxyMessage(e,t,r,s,o){this._log("post remote message",{remoteObjectId:e,methodName:t,parameters:r,callId:s,sync:o});const a=this._postRemoteObjectCall(e,t,this._objectSerializer.serialize(r,s),s,o?1:0);return o&&a&&this._log("sync remote message response",a),a}postSyncRequestMessage(e,t,r,s,o){const a=this._idGenerator.getNextId(),i=this.GetTypedArrayParametersIndices(s),n=this._postRemoteProxyMessage(e,t,{kind:"request",options:{operation:r,typedArrayIndices:i},parameters:s},a,!0);if(!n.parameters)throw new Error("No parameters in result: "+p.stringify(n,null,1));if(n.parameters.error){const e=this._objectSerializer.deserialize(!0,!1,o,n.parameters.error);if(!!chrome.webview.hostObjects.getLocalProperty("options")?.ignoreMemberNotFoundError&&(e.includes("0x80020003")||e.includes("0x80020006")))return{value:void 0,cache_able:!1};throw new Error(e)}{const e=this._objectSerializer.getAndClearIsCacheableBySerializedObjectMessage(n);s&&s.length&&n.parameters&&n.parameters.result&&n.parameters.result.hasOwnProperty(this._objectSerializer._serializationOptionsPropertyName)&&(this._objectSerializer._paramTracker.setParams(a,s),n.parameters.result.callId=a);const t={value:this._objectSerializer.deserialize(!0,n.parameters.has_object,o,n.parameters.result),cache_able:e};return this._objectSerializer._paramTracker.removeParams(a),t}}postRequestMessage(e,t,r,s){const o=this._idGenerator.getNextId(),a=this._callIdToDetails[o]={},i=new Deferral;a.deferral=i.controls,s&&s.length&&this._objectSerializer._paramTracker.setParams(o,s);const n=this.GetTypedArrayParametersIndices(s);return this._postRemoteProxyMessage(e,t,{kind:"request",options:{operation:r,typedArrayIndices:n},parameters:s},o),i.promise._callId=o,i.promise}_postResponseMessage(e,t,r){if(0!=e.callId){const s={kind:"response"};t?s.result=r:s.error=r,this._postRemoteProxyMessage(0,"",s,e.callId)}}_handleRequest(e){h.assert("request"===e.parameters.kind);const t=!!chrome.webview.hostObjects.getLocalProperty("options")?.defaultSyncProxy,r=this._objectSerializer.deserializeArray(t,e.parameters.has_object,"request",e.parameters.parameters),s=this._objectSerializer.getObjectByObjectId(e.remoteObjectId);try{let t;switch(e.parameters.options.operation){case"get":t=s[e.methodName];break;case"set":t=s[e.methodName]=r[0];break;case"apply":t=(e.methodName?s[e.methodName]:s).apply(null,r)}t&&t.then?t.then((t=>this._postResponseMessage(e,!0,t)),(t=>this._postResponseMessage(e,!1,t))):this._postResponseMessage(e,!0,t)}catch(t){this._postResponseMessage(e,!1,t)}}_handleResponse(e){h.assert("response"===e.parameters.kind),h.assert(void 0!==e.parameters.error||void 0!==e.parameters.result,"response data should have either error or result");const t=this._callIdToDetails[e.callId];delete this._callIdToDetails[e.callId],h.assert(t,"no call detail for "+e.callId),void 0!==t&&(e.parameters.error?t.deferral.reject(e):t.deferral.resolve(e))}_handleReleaseObjects(e){h.assert(e.sequence_number),h.assert(e.object_ids_array),this._objectSerializer.releaseObjects(e.sequence_number,e.object_ids_array)}GetTypedArrayParametersIndices(e){let t=[];if(this._objectSerializer._options.shouldPassTypedArraysAsArrays)for(let r=0;rt.add(e)));return t.add("_callId"),t.add("_shouldCancel"),t}_isLocalProperty(e){return"symbol"==typeof e||this._innerPropertyNames.has(e)||this._forceLocalProperties.has(e)}getLocalProperty(e){return this[e]}setLocalProperty(e,t){return this._innerPropertyNames.add(e),this[e]=t}_getAmbiguous(e){return this._forceRemoteProperties.has(e)?this.getForceRemoteProperty(e):this._isLocalProperty(e)?this.getLocalProperty(e):this.getHostProperty(e)}_setAmbiguous(e,t){return this._forceRemoteProperties.has(e)?this.setForceRemoteProperty(e,t):this._isLocalProperty(e)?this.setLocalProperty(e,t):this.setHostProperty(e,t)}_ownKeys(){let e=("function"==typeof this._hostKeyNames?this._hostKeyNames():this._hostKeyNames)||[],t=c.getOwnPropertyDescriptors(this),r=c.keys(t).filter((e=>!t[e].configurable));return e=e.concat(r),e}_getOwnPropertyDescriptor(e){return("function"==typeof this._hostKeyNames?this._hostKeyNames():this._hostKeyNames)?.includes(e)?{writable:!0,configurable:!0,enumerable:!0}:Reflect.getOwnPropertyDescriptor(this,e)}_cancel(){const e=this._callId;e?(this._options.remoteMessenger.postRequestMessage(this._remoteObjectId,""+e,"cancel",[]),e in this._options.remoteMessenger._callIdToDetails&&this._options.remoteMessenger._callIdToDetails[e].deferral.reject(new Error("Promise canceled"))):this._shouldCancel=!0}overwriteTargetObject(e){const t=["_then","_catch","_isLocalProperty","_tryCacheResult","_ownKeys","_getOwnPropertyDescriptor","async","sync","_getAmbiguous","_setAmbiguous","getLocalProperty","setLocalProperty","getHostProperty","setHostProperty","getForceRemoteProperty","setForceRemoteProperty","applyHostFunction","overwriteTargetObject","createPublicObject","_callId","_shouldCancel","_cancel"].concat(c.keys(this)),s={getLocalProperty:"getLocal",setLocalProperty:"setLocal",getHostProperty:"getRemote",setHostProperty:"setRemote",applyHostFunction:"applyRemote"};t.forEach((t=>{const o=this[t];if(void 0===o?delete e[t]:"function"==typeof o?e[t]=this[t].bind(e):void 0!==o&&(e[t]=this[t]),r&&o){const r=s[t];r&&(e[r]=e[t])}})),e._thenable&&(e.then=e._then,e.catch=e._catch),e._innerPropertyNames=RemoteProxy._getPropertyNames(e),this._redirectedThis=e}createPublicObject(e){e=e||function CallableTarget(){},this.overwriteTargetObject(e);const t=new u(e,{apply:(e,t,r)=>e.applyHostFunction(r),get:(e,t,r)=>e._getAmbiguous(t),set:(e,t,r)=>(e._setAmbiguous(t,r),!0),defineProperty:(e,t,r)=>(e._innerPropertyNames.add(t),c.defineProperty(e,t,r)),construct:(e,t)=>e.applyHostFunction(t),ownKeys:e=>e._ownKeys(),getOwnPropertyDescriptor:(e,t)=>e._getOwnPropertyDescriptor(t),has:(e,t)=>void 0!==e._getOwnPropertyDescriptor(t)});return t}_tryCacheResult(e,t,r){if(this._options.objectSerializer.getAndClearIsCacheableBySerializedObjectMessage(r)){const s=this._options.objectSerializer.deserialize(e,r.parameters.has_object,this._debugId.concat(t),r.parameters.result);this._options.objectSerializer._skipPropertyNames.includes(t)||this.setLocalProperty(t,s),this._options.objectSerializer._paramTracker.removeParams(r.callId)}}}class AsyncRemoteProxy extends RemoteProxy{constructor(e,t,r,s,o,a){super(e,t,o,a||[]),this.getLocalProperty=this.getLocalProperty,this.setLocalProperty=this.setLocalProperty,this._responsePromise=s?r.then((e=>{if(null==this._redirectedThis._shouldCancel||0==this._redirectedThis._shouldCancel){const t=s(e);return this._callId=t._callId,this.overwriteTargetObject(this._redirectedThis),t.workPromise}return l.reject(new Error("Promise canceled"))})):r}createPublicObject(e){e=e||function CallableTarget(){};const t=super.createPublicObject(e);return null!=this._responsePromise._callId&&(e._callId=this._responsePromise._callId),e._responsePromise.then((function(r){const s=e._options.objectSerializer.getObjectIdBySerializedObjectMessage(r);r.callId&&e._options.objectSerializer._paramTracker.bindParamsToObjectLifetime(t,r.callId),null!==s&&(e._options.remoteRefTracker.addReference(s),e._options.localRefTracker.watchForRelease(e,e._options.remoteRefTracker.removeReference.bind(e._options.remoteRefTracker,s)))})).catch((e=>{window.debugChromeWebViewRemoteObjects&&h.log("caught without rethrowing '"+e.parameters.error+"'")})),e._responsePromise=e._responsePromise.then((function(r){const s=e._options.objectSerializer,o=s.getObjectIdBySerializedObjectMessage(r);if(null!==o){let a=s.getHostKeyNamesBySerializedObjectMessage(r);"function"!=typeof a&&0==a.length&&(a=e._hostKeyNames);new KnownAsyncRemoteProxy(e._options,e._thenable,r,e._debugId,a).overwriteTargetObject(e),0!=o&&s.setObjectProxyOptionsFromResponse(t,r)}return r})),t}sync(){return this._responsePromise.then((e=>this._options.objectSerializer.deserialize(!0,e.parameters.has_object,this._debugId.concat("sync"),e.parameters.result)),(e=>{let t=e;throw e instanceof Error||(t=new Error(this._options.objectSerializer.deserialize(!0,e.parameters.has_object,this._debugId.concat("sync"),e.parameters.error))),t}))}applyHostFunction(e){return new AsyncRemoteProxy(this._options,!0,this._responsePromise,(t=>{const r=this._options.objectSerializer.getObjectIdBySerializedObjectMessage(t);if(null!==r){let t=this._options.remoteMessenger.postRequestMessage(r,"","apply",e);return{workPromise:t,_callId:t._callId}}throw new Error("Unable to call method on non-function.")}),this._debugId.concat("()")).createPublicObject()}getHostProperty(e){return new AsyncRemoteProxy(this._options,!0,this._responsePromise.then((t=>{const r=this._options.objectSerializer.getObjectIdBySerializedObjectMessage(t);return null!==r?this._options.remoteMessenger.postRequestMessage(r,e,"get",[]).then((t=>(this._tryCacheResult(!1,e,t),t))):l.resolve({remoteObjectId:-1,parameters:{result:t.parameters.result[e]}})})),null,this._debugId.concat(e)).createPublicObject()}getForceRemoteProperty(e){return this.getHostProperty(e).then((e=>e),(t=>{if(this._isLocalProperty(e))return this.getLocalProperty(e);throw t}))}setForceRemoteProperty(e,t){return this.setHostProperty(e,t).then((e=>e),(r=>{if(this._isLocalProperty(e))return this.setLocalProperty(e,t);throw r}))}setHostProperty(e,t){return this._responsePromise.then((r=>{const s=this._options.objectSerializer.getObjectIdBySerializedObjectMessage(r);return null!==s?new AsyncRemoteProxy(this._options,!0,this._options.remoteMessenger.postRequestMessage(s,e,"set",[t]),null,this._debugId.concat("setHostProperty")).createPublicObject():r.parameters.result[e]=t})).then((()=>l.resolve(t)))}_then(e,t){return this._responsePromise.then((r=>{r.parameters&&r.parameters.result&&r.parameters.result.hasOwnProperty(this._options.objectSerializer._serializationOptionsPropertyName)&&(r.parameters.result.callId=r.callId);let s=e(this._options.objectSerializer.deserialize(!1,r.parameters.has_object,this._debugId.concat("then"),r.parameters.result));return this._options.objectSerializer._paramTracker.removeParams(r.callId),e=t=function(){},r=null,s}),(r=>{let s=null;return r instanceof Error?s=t(r):(s=t(new Error(this._options.objectSerializer.deserialize(!1,r.parameters.has_object,this._debugId.concat("then"),r.parameters.error))),this._options.objectSerializer._paramTracker.removeParams(r.callId)),e=t=function(){},r=null,s}))}_catch(e){this._then(void 0,e)}}class KnownAsyncRemoteProxy extends RemoteProxy{constructor(e,t,r,s,o){super(e,t,s,o),this.getLocalProperty=this.getLocalProperty,this.setLocalProperty=this.setLocalProperty,this._response=r;const a=this._options.objectSerializer;a.updateSequenceNumberFromSerializedObjectMessage(this._response),this._remoteObjectId=a.getObjectIdBySerializedObjectMessage(this._response),h.assert(null!==this._remoteObjectId)}sync(){return l.resolve(new SyncRemoteProxy(this._options,this._response,this._debugId,this._hostKeyNames).createPublicObject())}applyHostFunction(e){return new AsyncRemoteProxy(this._options,!0,this._options.remoteMessenger.postRequestMessage(this._remoteObjectId,"","apply",e),null,this._debugId.concat("()")).createPublicObject()}getHostProperty(e){return new AsyncRemoteProxy(this._options,!0,this._options.remoteMessenger.postRequestMessage(this._remoteObjectId,e,"get",[]).then((t=>(this._tryCacheResult(!1,e,t),t))),null,this._debugId.concat(e)).createPublicObject()}getForceRemoteProperty(e){return this.getHostProperty(e).then((e=>e),(t=>{if(this._isLocalProperty(e))return this.getLocalProperty(e);throw t}))}setForceRemoteProperty(e,t){return this.setHostProperty(e,t).then((e=>e),(r=>{if(this._isLocalProperty(e))return this.setLocalProperty(e,t);throw r}))}setHostProperty(e,t){return new AsyncRemoteProxy(this._options,!0,this._options.remoteMessenger.postRequestMessage(this._remoteObjectId,e,"set",[t]),null,this._debugId.concat("setHostProperty")).createPublicObject()}_then(e,t){if(this._response.parameters.error){let e=l.reject(t(new Error(this._options.objectSerializer.deserialize(!1,this._response.parameters.has_object,this._debugId.concat("then"),this._response.parameters.error))));return this._options.objectSerializer._paramTracker.removeParams(this._response.callId),e}{this._response.parameters&&this._response.parameters.result&&this._response.parameters.result.hasOwnProperty(this._options.objectSerializer._serializationOptionsPropertyName)&&(this._response.parameters.result.callId=this._response.callId);let t=l.resolve(e(this._options.objectSerializer.deserialize(!1,this._response.parameters.has_object,this._debugId.concat("then"),this._response.parameters.result)));return this._options.objectSerializer._paramTracker.removeParams(this._response.callId),t}}_catch(e){this._then(void 0,e)}createPublicObject(e){e=e||function CallableTarget(){};const t=super.createPublicObject(e);return e._options.remoteRefTracker.addReference(e._remoteObjectId),e._options.localRefTracker.watchForRelease(e,e._options.remoteRefTracker.removeReference.bind(e._options.remoteRefTracker,e._remoteObjectId)),t}}class SyncRemoteProxy extends RemoteProxy{constructor(e,t,r,s){super(e,!1,r,s),this._response=t,this.getLocalProperty=this.getLocalProperty,this.setLocalProperty=this.setLocalProperty,this._resultObjectId=this._options.objectSerializer.getObjectIdBySerializedObjectMessage(this._response),null!==this._resultObjectId&&(this._options.remoteRefTracker.addReference(this._resultObjectId),this._options.localRefTracker.watchForRelease(this,this._options.remoteRefTracker.removeReference.bind(this._options.remoteRefTracker,this._resultObjectId)))}async(){return new AsyncRemoteProxy(this._options,!0,l.resolve(this._response),null,this._debugId,this._hostKeyNames).createPublicObject()}applyHostFunction(e){if(null!==this._resultObjectId){const t=this._debugId?.slice(-1)[0];if(t&&chrome.webview.hostObjects.getLocalProperty("options")?.forceAsyncMethodMatches?.filter((e=>t.match(e)))?.length>0){let t=this.async().applyHostFunction(e),r=t.sync();return r._cancelablePromise=t,r}return this._options.remoteMessenger.postSyncRequestMessage(this._resultObjectId,"","apply",e,this._debugId.concat("()")).value}throw new Error("Unable to call method on non-function.")}getHostProperty(e){if(null!==this._resultObjectId){let t=this._options.remoteMessenger.postSyncRequestMessage(this._resultObjectId,e,"get",[],this._debugId.concat(e));return t.cache_able&&this.setLocalProperty(e,t.value),t.value}return this._response.parameters.result[e]}getForceRemoteProperty(e){try{return this.getHostProperty(e)}catch(t){if(this._isLocalProperty(e))return this.getLocalProperty(e);throw t}}setForceRemoteProperty(e,t){try{return this.setHostProperty(e,t)}catch(r){if(this._isLocalProperty(e))return this.setLocalProperty(e,t);throw r}}setHostProperty(e,t){if(null!==this._resultObjectId)return this._options.remoteMessenger.postSyncRequestMessage(this._resultObjectId,e,"set",[t],this._debugId.concat(e)).value;return this._response.parameters.result[e]=t}createPublicObject(e){e=e||function CallableTarget(){};const t=super.createPublicObject(e);return null!==e._resultObjectId&&(e._options.remoteRefTracker.addReference(e._resultObjectId),e._options.localRefTracker.watchForRelease(e,e._options.remoteRefTracker.removeReference.bind(e._options.remoteRefTracker,e._resultObjectId))),t}}class RemoteProxyGroup{constructor(e,t,s,o,a){window.debugChromeWebViewRemoteObjects&&!a&&(a=h.log.bind(h)),this._groupId=o||"28C1DF41-5C2A-4AA9-84B6-D5172F346B26",this._options={log:a,shouldSerializeDates:!1,forceLocalProperties:["then","toJSON"],shouldPassTypedArraysAsArrays:!1},this._proxyOptions={localRefTracker:null,remoteRefTracker:null,idGenerator:null,forceLocalProperties:this._options.forceLocalProperties,objectSerializer:null,remoteMessenger:null},this._proxyOptions.localRefTracker=new LocalRefTracker(this._log.bind(this)),this._proxyOptions.remoteRefTracker=new RemoteRefTracker(s,this._log.bind(this)),this._proxyOptions.idGenerator=new IdGenerator,this._proxyOptions.objectSerializer=new ObjectSerializer(this._proxyOptions.idGenerator,this._groupId,this._proxyOptions,this._options),this._proxyOptions.remoteMessenger=new RemoteMessenger(e,t,this._log.bind(this),this._proxyOptions.idGenerator,this._proxyOptions.objectSerializer),this.hostObjects=this._proxyOptions.objectSerializer.createKnownRemoteProxy(0,!1,!1,["asyncRoot"],void 0,[]),delayPropertyCreation(this.hostObjects,"sync",(()=>this._proxyOptions.objectSerializer.createKnownRemoteProxy(0,!1,!0,["syncRoot"],void 0,[]))),this.hostObjects.setLocalProperty("options",this._options),this.hostObjects.setLocalProperty("cleanupSome",this._proxyOptions.localRefTracker.cleanupSome.bind(this._proxyOptions.localRefTracker)),r&&(this.remoteObjects=this.hostObjects),this.localObjects={},this.hostObjects.setLocalProperty("cancelPromise",this.cancelPromise.bind(this)),this._proxyOptions.objectSerializer.setObjectByWellKnownObjectId(this.localObjects,0)}_setNativeRemoteObjectEventTarget(e){this._proxyOptions.remoteMessenger._setNativeRemoteObjectEventTarget(e)}_log(e,t){this._options.log&&this._options.log(e,t)}cancelPromise(e){e.hasOwnProperty("_cancel")?e._cancel():e.hasOwnProperty("_cancelablePromise")&&e._cancelablePromise._cancel()}}const s=new e,y={};[{object:s,names:["postMessage","releaseBuffer"]},{object:new d,names:["addEventListener","removeEventListener","dispatchEvent"]}].forEach((e=>e.names.forEach((t=>y[t]=e.object[t].bind(e.object))))),i&&(y.getTextureStream=s.getTextureStream.bind(s),y.registerTextureStream=s.registerTextureStream.bind(s),y.unregisterTextureStream=s.unregisterTextureStream.bind(s)),n&&(y.postMessageWithAdditionalObjects=s.postMessageWithAdditionalObjects.bind(s));const b=new RemoteProxyGroup(s.postRemoteObjectCall.bind(s),o?null:y,s.releaseObjectsCallback.bind(s));return y.hostObjects=b.hostObjects,r&&(y.remoteObjects=y.hostObjects),y.RemoteProxyGroup=RemoteProxyGroup,o&&(b._setNativeRemoteObjectEventTarget(s),s.addEventListener("message",(e=>{a&&h.log("native event:",e);let t=new Event("message");c.defineProperty(t,"data",{value:p.parse(e.data)}),c.defineProperty(t,"source",{value:y}),c.defineProperty(t,"additionalObjects",{value:e.additionalObjects}),y.dispatchEvent(t)})),s.addEventListener("sharedbufferreceived",(e=>{a&&h.log("native event:",e);let t=!1,r=new Event("sharedbufferreceived");e.data&&c.defineProperty(r,"additionalData",{value:p.parse(e.data)}),c.defineProperty(r,"getBuffer",{value:function(){return t=!0,e.sharedBuffer}}),c.defineProperty(r,"sharedBuffer",{value:e.sharedBuffer}),c.defineProperty(r,"source",{value:y}),y.dispatchEvent(r),t||chrome.webview.releaseBuffer(e.sharedBuffer)}))),y}))}}})();; delete globalParams;mreturnByValue" (Indicator: "postmessage"; Source: "00000000-00005148.00000000.189261.00660000.00000004.mdmp, 00000000-00005148.00000000.189261.00684000.00000004.mdmp") Found reference to API "globalParams = {'sdkVersion': 7,'useNativeEvent': true,'usePostMessageWithAdditionalObjects': true};(()=>{if(window.EmbeddedBrowserWebView){window.chrome||(window.chrome={});const e=window.EmbeddedBrowserWebView,t=window.gc,r=globalParams.sdkVersion<=2,s=globalParams.sdkVersion>=7,o=globalParams.useNativeEvent,a=globalParams.logNativeEvent,i=globalParams.useTextureStream,n=globalParams.usePostMessageWithAdditionalObjects;if(delete window.EmbeddedBrowserWebView,delete window.gc,delete globalParams,window.top===window||s){function copyObject(e){let t=function copiedObject(...t){return new e(...t)};return window.Object.getOwnPropertyNames(e).concat(window.Object.getOwnPropertySymbols(e)).forEach((r=>{let s=e[r];"function"==typeof s&&(s=s.bind(e)),t[r]=s})),t}const c=copyObject(window.Object),l=copyObject(window.Promise),p=copyObject(window.JSON),h=copyObject(window.console),d=copyObject(window.EventTarget),u=copyObject(window.Proxy),_=copyObject(window.FinalizationRegistry),m=copyObject(window.Set);function delayPropertyCreation(e,t,r){c.defineProperty(e,t,{configurable:!0,enumerable:!0,get:()=>{const s=r();return c.defineProperty(e,t,{configurable:!0,enumerable:!0,writable:!0,value:s}),s}})}delayPropertyCreation(chrome,"webview",(function createChromeWebView(){class LocalRefTracker{constructor(e){this._idToCallback={},this._nextId=1,this._log=e,this._group=null,_&&(this._group=new _(this._cleanup.bind(this)))}_cleanup(e){e&&this._idToCallback[e]&&(this._log("cleanup for "+e),this._idToCallback[e](),delete this._idToCallback[e])}watchForRelease(e,t){if(this._group){const r=this._nextId++,s=e._debugId?.join(" ")||e._debugId;this._log("watching for cleanup of "+r+" ("+s+")"),this._idToCallback[r]=t,this._group.register(e,r)}}cleanupSome(){return t&&(async()=>{await t({type:"full",heap:"all",flags:["force"],execution:"async"})})(),!0}}class ParamTracker{constructor(){this._paramTracker={},this._cleanupRegistry=null,_&&(this._cleanupRegistry=new _((e=>{this.removeParams(e)})))}setParams(e,t){t&&t.length&&(this._paramTracker[e]=t)}getParams(e){return this._paramTracker[e]}hasParams(e){return void 0!==this._paramTracker[e]}removeParams(e){delete this._paramTracker[e]}bindParamsToObjectLifetime(e,t){this._cleanupRegistry&&t&&this._cleanupRegistry.register(e,t)}updateArrayParams(e,t,r){if(t&&r&&this.hasParams(e)){const s=this.getParams(e);for(let e=0;ethis._maxRemoteSequenceId&&(this._maxRemoteSequenceId=e)}addReference(e){null!=e?this._mapRemoteIdToRefCount.hasOwnProperty(e)?++this._mapRemoteIdToRefCount[e]:this._mapRemoteIdToRefCount[e]=1:h.assert(!1,"invalid remoteId in addReference:"+e)}removeReference(e){if(null==e)return void h.assert(!1,"invalid remoteId in removeReference:"+e);h.assert(this._mapRemoteIdToRefCount.hasOwnProperty(e));0===--this._mapRemoteIdToRefCount[e]&&(delete this._mapRemoteIdToRefCount[e],this._releaseObjectsCallback&&(this._releaseObjectsCallback(this._maxRemoteSequenceId,p.stringify([e])),this._log("Sending remote release message "+e)))}}class IdGenerator{constructor(){this._nextId=1}getNextId(){return this._nextId++}}class Deferral{constructor(){let e=this.controls={clear:function(){e.resolve=e.reject=e.clear=function(){},e=null}};this.promise=new l(((t,r)=>{this.controls.resolve=function deferralResolve(...r){const s=t.apply(null,r);return e.clear(),s},this.controls.reject=function deferralReject(...t){const s=r.apply(null,t);return e.clear(),s}}))}}class ObjectSerializer{constructor(e,t,r,s){this._idGenerator=e,this._groupId=t,this._proxyOptions=r,this._proxyOptionsSymbol=Symbol("EmbeddedBrowserWebView.proxyOptions"),this._options=s,this._serializationOptionsPropertyName="1B9FCAB5-FB86-4D78-91DE-7BC2B4077E5B",this._objectIdToObject={},this._paramTracker=new ParamTracker,this._skipPropertyNames=["name","length","arguments","caller"]}_getProxyOptions(e){return e&&e.hasOwnProperty(this._proxyOptionsSymbol)?e[this._proxyOptionsSymbol]:null}_hasProxyOptions(e){return null!==this._getProxyOptions(e)}_setProxyOptions(e,t){c.defineProperty(e,this._proxyOptionsSymbol,{value:t,configurable:!0})}_getOrCreateProxyOptions(e){let t=this._getProxyOptions(e);if(!t){const r=this._idGenerator.getNextId();t={remoteObjectId:r,groupId:this._groupId,type:"proxy",remoteSequenceId:0},this._setProxyOptions(e,t),this._objectIdToObject[r]=e}return t}_updateSequenceNumberForProxyOptions(e,t){h.assert(e),e.groupId===this._groupId&&(h.assert(e.remoteSequenceId<=t),e.remoteSequenceId=t)}getObjectByObjectId(e){return this._objectIdToObject[e]}setObjectProxyOptionsFromResponse(e,t){this._setProxyOptions(e,t.parameters.result[this._serializationOptionsPropertyName])}setObjectByWellKnownObjectId(e,t){h.assert(t<1),this._objectIdToObject[t]=e}getObjectIdBySerializedObjectMessage(e){let t=null;return e&&e.parameters&&e.parameters.result&&e.parameters.result.hasOwnProperty(this._serializationOptionsPropertyName)&&(t=e.parameters.result[this._serializationOptionsPropertyName].remoteObjectId,void 0===t&&(t=null)),t}getHostKeyNamesBySerializedObjectMessage(e){let t=[];return e&&e.parameters&&e.parameters.result&&e.parameters.result.hasOwnProperty(this._serializationOptionsPropertyName)&&(t=e.parameters.result[this._serializationOptionsPropertyName].hostKeyNames||[]),t}updateSequenceNumberFromSerializedObjectMessage(e){if(e&&e.parameters&&e.parameters.result&&e.parameters.result.hasOwnProperty(this._serializationOptionsPropertyName)){const t=e.parameters.result[this._serializationOptionsPropertyName];t.seq_no&&this._proxyOptions.remoteRefTracker.addSequenceId(t.seq_no)}}releaseObjects(e,t){for(const r of t){const t=this.getObjectByObjectId(r);if(t){const s=this._getProxyOptions(t);s&&s.remoteSequenceId<=e&&(delete t[this._proxyOptionsSymbol],delete this._objectIdToObject[r])}}}getAndClearIsCacheableBySerializedObjectMessage(e){let t=!1;return e&&e.parameters&&(t=e.parameters.cache_able,delete e.parameters.cache_able,!t&&e.parameters.result&&e.parameters.result.hasOwnProperty(this._serializationOptionsPropertyName)&&(t=e.parameters.result[this._serializationOptionsPropertyName].cache_able,delete e.parameters.result[this._serializationOptionsPropertyName].cache_able)),t}serialize(e,t){try{const r=this;return p.stringify(e,(function(e,s){let o=s;if("function"==typeof s||r._hasProxyOptions(s)){let a=r._getOrCreateProxyOptions(s);if(r._updateSequenceNumberForProxyOptions(a,t),o={},o[r._serializationOptionsPropertyName]=a,"toString"===e)try{o.value=s()}catch(e){}}else r._options.shouldSerializeDates&&this[e]instanceof Date?o={[r._serializationOptionsPropertyName]:{type:"date"},value:this[e].getTime()}:void 0===s&&(o=null);return o}))}catch(e){throw e}}deserialize(e,t,r,s){let o=s?s[this._serializationOptionsPropertyName]:null;return o&&o.type&&"date"==o.type?this._options.shouldSerializeDates?new Date(s.value.jsTime):s.value.date:t?p.parse(p.stringify(s),((s,o)=>{let a=o,i=o&&o[this._serializationOptionsPropertyName];if(i)if(i.remoteObjectId&&i.groupId!==this._groupId){let n,l,p,d,u;if(i.seq_no&&this._proxyOptions.remoteRefTracker.addSequenceId(i.seq_no),i.scriptBehavior)switch(i.scriptBehavior){case 1:n={},c.getOwnPropertyNames(Array.prototype).concat(c.getOwnPropertySymbols(Array.prototype)).filter((e=>"length"!=e)).forEach((e=>{n[e]=Array.prototype[e]})),n[Symbol.isConcatSpreadable]=!0,l=function(){const e=this.getHostProperty("length");if(void 0===this._arrayPropertyNames&&(this._arrayPropertyNames=[]),this._arrayPropertyNames.length>e)this._arrayPropertyNames.length=e;else if(this._arrayPropertyNames.length"length"!=e)).forEach((t=>{n[t]=e[t]})),n[Symbol.isConcatSpreadable]=!0}else{switch(typeof n){case"string":n=new String(n),s=["toString","valueOf"];break;case"boolean":n=new Boolean(n),s=["toString","valueOf"];break;case"number":n=new Number(n),s=["toExponential","toFixed","toLocaleString","toPrecision","toString","valueOf"]}s.forEach((e=>n[e]=n[e].bind(n))),n[Symbol.isConcatSpreadable]=!1}}l||(l=i.hostKeyNames?this.deserialize(e,t,r,i.hostKeyNames):[]),p||(p=i.hostPrecacheProperties?this.deserialize(e,t,r,i.hostPrecacheProperties):[]),d||i.outArrayResult&&(d=this.deserialize(e,t,r,i.outArrayResult)),u||i.outArrayIndex&&(u=i.outArrayIndex);const _=!!s;if(a=this.createKnownRemoteProxy(i.remoteObjectId,_,e,r,n,l),this._setProxyOptions(a,i),p)for(const[e,t]of c.entries(p))this._proxyOptions.objectSerializer._skipPropertyNames.includes(e)||a.setLocalProperty(e,t);d&&u&&this._proxyOptions.objectSerializer._paramTracker.updateArrayParams(o.callId,d,u)}else i.remoteObjectId?(h.assert(i.groupId===this._groupId),h.assert(this._objectIdToObject.hasOwnProperty(i.remoteObjectId)),a=this._objectIdToObject[i.remoteObjectId]):"undefined"===i.type&&(a=void 0);return a})):s}deserializeArray(e,t,r,s){return s.map(this.deserialize.bind(this,e,t,r))}createKnownRemoteProxy(e,t,r,s,o,a){const i={};i[this._serializationOptionsPropertyName]={remoteObjectId:e};const n={remoteObjectId:e,parameters:{result:i}};let c=null;return c=r?new SyncRemoteProxy(this._proxyOptions,n,s,a):new KnownAsyncRemoteProxy(this._proxyOptions,t,n,s,a),c.createPublicObject(o)}}class RemoteMessenger{constructor(e,t,r,s,o){this._postRemoteObjectCall=e,this._log=r,this._idGenerator=s,this._objectSerializer=o,this._callIdToDetails={},t&&(t.addEventListener("remoteproxycall",(e=>{this._handleRemoteProxyCallEvent(e.data)})),t.addEventListener("remoteproxyrelease",(e=>{this._handleRemoteProxyReleaseEvent(e.data)})))}_setNativeRemoteObjectEventTarget(e){e.addEventListener("remoteproxycall",(e=>{this._handleRemoteProxyCallEvent(p.parse(e.data))})),e.addEventListener("remoteproxyrelease",(e=>{this._handleRemoteProxyReleaseEvent(p.parse(e.data))}))}_handleRemoteProxyCallEvent(e){this._log("remoteproxycall event",e),"request"===e.parameters.kind?this._handleRequest(e):(h.assert("response"===e.parameters.kind),this._handleResponse(e))}_handleRemoteProxyReleaseEvent(e){this._log("remoteproxyrelease event",e),this._handleReleaseObjects(e)}_postRemoteProxyMessage(e,t,r,s,o){this._log("post remote message",{remoteObjectId:e,methodName:t,parameters:r,callId:s,sync:o});const a=this._postRemoteObjectCall(e,t,this._objectSerializer.serialize(r,s),s,o?1:0);return o&&a&&this._log("sync remote message response",a),a}postSyncRequestMessage(e,t,r,s,o){const a=this._idGenerator.getNextId(),i=this.GetTypedArrayParametersIndices(s),n=this._postRemoteProxyMessage(e,t,{kind:"request",options:{operation:r,typedArrayIndices:i},parameters:s},a,!0);if(!n.parameters)throw new Error("No parameters in result: "+p.stringify(n,null,1));if(n.parameters.error){const e=this._objectSerializer.deserialize(!0,!1,o,n.parameters.error);if(!!chrome.webview.hostObjects.getLocalProperty("options")?.ignoreMemberNotFoundError&&(e.includes("0x80020003")||e.includes("0x80020006")))return{value:void 0,cache_able:!1};throw new Error(e)}{const e=this._objectSerializer.getAndClearIsCacheableBySerializedObjectMessage(n);s&&s.length&&n.parameters&&n.parameters.result&&n.parameters.result.hasOwnProperty(this._objectSerializer._serializationOptionsPropertyName)&&(this._objectSerializer._paramTracker.setParams(a,s),n.parameters.result.callId=a);const t={value:this._objectSerializer.deserialize(!0,n.parameters.has_object,o,n.parameters.result),cache_able:e};return this._objectSerializer._paramTracker.removeParams(a),t}}postRequestMessage(e,t,r,s){const o=this._idGenerator.getNextId(),a=this._callIdToDetails[o]={},i=new Deferral;a.deferral=i.controls,s&&s.length&&this._objectSerializer._paramTracker.setParams(o,s);const n=this.GetTypedArrayParametersIndices(s);return this._postRemoteProxyMessage(e,t,{kind:"request",options:{operation:r,typedArrayIndices:n},parameters:s},o),i.promise._callId=o,i.promise}_postResponseMessage(e,t,r){if(0!=e.callId){const s={kind:"response"};t?s.result=r:s.error=r,this._postRemoteProxyMessage(0,"",s,e.callId)}}_handleRequest(e){h.assert("request"===e.parameters.kind);const t=!!chrome.webview.hostObjects.getLocalProperty("options")?.defaultSyncProxy,r=this._objectSerializer.deserializeArray(t,e.parameters.has_object,"request",e.parameters.parameters),s=this._objectSerializer.getObjectByObjectId(e.remoteObjectId);try{let t;switch(e.parameters.options.operation){case"get":t=s[e.methodName];break;case"set":t=s[e.methodName]=r[0];break;case"apply":t=(e.methodName?s[e.methodName]:s).apply(null,r)}t&&t.then?t.then((t=>this._postResponseMessage(e,!0,t)),(t=>this._postResponseMessage(e,!1,t))):this._postResponseMessage(e,!0,t)}catch(t){this._postResponseMessage(e,!1,t)}}_handleResponse(e){h.assert("response"===e.parameters.kind),h.assert(void 0!==e.parameters.error||void 0!==e.parameters.result,"response data should have either error or result");const t=this._callIdToDetails[e.callId];delete this._callIdToDetails[e.callId],h.assert(t,"no call detail for "+e.callId),void 0!==t&&(e.parameters.error?t.deferral.reject(e):t.deferral.resolve(e))}_handleReleaseObjects(e){h.assert(e.sequence_number),h.assert(e.object_ids_array),this._objectSerializer.releaseObjects(e.sequence_number,e.object_ids_array)}GetTypedArrayParametersIndices(e){let t=[];if(this._objectSerializer._options.shouldPassTypedArraysAsArrays)for(let r=0;rt.add(e)));return t.add("_callId"),t.add("_shouldCancel"),t}_isLocalProperty(e){return"symbol"==typeof e||this._innerPropertyNames.has(e)||this._forceLocalProperties.has(e)}getLocalProperty(e){return this[e]}setLocalProperty(e,t){return this._innerPropertyNames.add(e),this[e]=t}_getAmbiguous(e){return this._forceRemoteProperties.has(e)?this.getForceRemoteProperty(e):this._isLocalProperty(e)?this.getLocalProperty(e):this.getHostProperty(e)}_setAmbiguous(e,t){return this._forceRemoteProperties.has(e)?this.setForceRemoteProperty(e,t):this._isLocalProperty(e)?this.setLocalProperty(e,t):this.setHostProperty(e,t)}_ownKeys(){let e=("function"==typeof this._hostKeyNames?this._hostKeyNames():this._hostKeyNames)||[],t=c.getOwnPropertyDescriptors(this),r=c.keys(t).filter((e=>!t[e].configurable));return e=e.concat(r),e}_getOwnPropertyDescriptor(e){return("function"==typeof this._hostKeyNames?this._hostKeyNames():this._hostKeyNames)?.includes(e)?{writable:!0,configurable:!0,enumerable:!0}:Reflect.getOwnPropertyDescriptor(this,e)}_cancel(){const e=this._callId;e?(this._options.remoteMessenger.postRequestMessage(this._remoteObjectId,""+e,"cancel",[]),e in this._options.remoteMessenger._callIdToDetails&&this._options.remoteMessenger._callIdToDetails[e].deferral.reject(new Error("Promise canceled"))):this._shouldCancel=!0}overwriteTargetObject(e){const t=["_then","_catch","_isLocalProperty","_tryCacheResult","_ownKeys","_getOwnPropertyDescriptor","async","sync","_getAmbiguous","_setAmbiguous","getLocalProperty","setLocalProperty","getHostProperty","setHostProperty","getForceRemoteProperty","setForceRemoteProperty","applyHostFunction","overwriteTargetObject","createPublicObject","_callId","_shouldCancel","_cancel"].concat(c.keys(this)),s={getLocalProperty:"getLocal",setLocalProperty:"setLocal",getHostProperty:"getRemote",setHostProperty:"setRemote",applyHostFunction:"applyRemote"};t.forEach((t=>{const o=this[t];if(void 0===o?delete e[t]:"function"==typeof o?e[t]=this[t].bind(e):void 0!==o&&(e[t]=this[t]),r&&o){const r=s[t];r&&(e[r]=e[t])}})),e._thenable&&(e.then=e._then,e.catch=e._catch),e._innerPropertyNames=RemoteProxy._getPropertyNames(e),this._redirectedThis=e}createPublicObject(e){e=e||function CallableTarget(){},this.overwriteTargetObject(e);const t=new u(e,{apply:(e,t,r)=>e.applyHostFunction(r),get:(e,t,r)=>e._getAmbiguous(t),set:(e,t,r)=>(e._setAmbiguous(t,r),!0),defineProperty:(e,t,r)=>(e._innerPropertyNames.add(t),c.defineProperty(e,t,r)),construct:(e,t)=>e.applyHostFunction(t),ownKeys:e=>e._ownKeys(),getOwnPropertyDescriptor:(e,t)=>e._getOwnPropertyDescriptor(t),has:(e,t)=>void 0!==e._getOwnPropertyDescriptor(t)});return t}_tryCacheResult(e,t,r){if(this._options.objectSerializer.getAndClearIsCacheableBySerializedObjectMessage(r)){const s=this._options.objectSerializer.deserialize(e,r.parameters.has_object,this._debugId.concat(t),r.parameters.result);this._options.objectSerializer._skipPropertyNames.includes(t)||this.setLocalProperty(t,s),this._options.objectSerializer._paramTracker.removeParams(r.callId)}}}class AsyncRemoteProxy extends RemoteProxy{constructor(e,t,r,s,o,a){super(e,t,o,a||[]),this.getLocalProperty=this.getLocalProperty,this.setLocalProperty=this.setLocalProperty,this._responsePromise=s?r.then((e=>{if(null==this._redirectedThis._shouldCancel||0==this._redirectedThis._shouldCancel){const t=s(e);return this._callId=t._callId,this.overwriteTargetObject(this._redirectedThis),t.workPromise}return l.reject(new Error("Promise canceled"))})):r}createPublicObject(e){e=e||function CallableTarget(){};const t=super.createPublicObject(e);return null!=this._responsePromise._callId&&(e._callId=this._responsePromise._callId),e._responsePromise.then((function(r){const s=e._options.objectSerializer.getObjectIdBySerializedObjectMessage(r);r.callId&&e._options.objectSerializer._paramTracker.bindParamsToObjectLifetime(t,r.callId),null!==s&&(e._options.remoteRefTracker.addReference(s),e._options.localRefTracker.watchForRelease(e,e._options.remoteRefTracker.removeReference.bind(e._options.remoteRefTracker,s)))})).catch((e=>{window.debugChromeWebViewRemoteObjects&&h.log("caught without rethrowing '"+e.parameters.error+"'")})),e._responsePromise=e._responsePromise.then((function(r){const s=e._options.objectSerializer,o=s.getObjectIdBySerializedObjectMessage(r);if(null!==o){let a=s.getHostKeyNamesBySerializedObjectMessage(r);"function"!=typeof a&&0==a.length&&(a=e._hostKeyNames);new KnownAsyncRemoteProxy(e._options,e._thenable,r,e._debugId,a).overwriteTargetObject(e),0!=o&&s.setObjectProxyOptionsFromResponse(t,r)}return r})),t}sync(){return this._responsePromise.then((e=>this._options.objectSerializer.deserialize(!0,e.parameters.has_object,this._debugId.concat("sync"),e.parameters.result)),(e=>{let t=e;throw e instanceof Error||(t=new Error(this._options.objectSerializer.deserialize(!0,e.parameters.has_object,this._debugId.concat("sync"),e.parameters.error))),t}))}applyHostFunction(e){return new AsyncRemoteProxy(this._options,!0,this._responsePromise,(t=>{const r=this._options.objectSerializer.getObjectIdBySerializedObjectMessage(t);if(null!==r){let t=this._options.remoteMessenger.postRequestMessage(r,"","apply",e);return{workPromise:t,_callId:t._callId}}throw new Error("Unable to call method on non-function.")}),this._debugId.concat("()")).createPublicObject()}getHostProperty(e){return new AsyncRemoteProxy(this._options,!0,this._responsePromise.then((t=>{const r=this._options.objectSerializer.getObjectIdBySerializedObjectMessage(t);return null!==r?this._options.remoteMessenger.postRequestMessage(r,e,"get",[]).then((t=>(this._tryCacheResult(!1,e,t),t))):l.resolve({remoteObjectId:-1,parameters:{result:t.parameters.result[e]}})})),null,this._debugId.concat(e)).createPublicObject()}getForceRemoteProperty(e){return this.getHostProperty(e).then((e=>e),(t=>{if(this._isLocalProperty(e))return this.getLocalProperty(e);throw t}))}setForceRemoteProperty(e,t){return this.setHostProperty(e,t).then((e=>e),(r=>{if(this._isLocalProperty(e))return this.setLocalProperty(e,t);throw r}))}setHostProperty(e,t){return this._responsePromise.then((r=>{const s=this._options.objectSerializer.getObjectIdBySerializedObjectMessage(r);return null!==s?new AsyncRemoteProxy(this._options,!0,this._options.remoteMessenger.postRequestMessage(s,e,"set",[t]),null,this._debugId.concat("setHostProperty")).createPublicObject():r.parameters.result[e]=t})).then((()=>l.resolve(t)))}_then(e,t){return this._responsePromise.then((r=>{r.parameters&&r.parameters.result&&r.parameters.result.hasOwnProperty(this._options.objectSerializer._serializationOptionsPropertyName)&&(r.parameters.result.callId=r.callId);let s=e(this._options.objectSerializer.deserialize(!1,r.parameters.has_object,this._debugId.concat("then"),r.parameters.result));return this._options.objectSerializer._paramTracker.removeParams(r.callId),e=t=function(){},r=null,s}),(r=>{let s=null;return r instanceof Error?s=t(r):(s=t(new Error(this._options.objectSerializer.deserialize(!1,r.parameters.has_object,this._debugId.concat("then"),r.parameters.error))),this._options.objectSerializer._paramTracker.removeParams(r.callId)),e=t=function(){},r=null,s}))}_catch(e){this._then(void 0,e)}}class KnownAsyncRemoteProxy extends RemoteProxy{constructor(e,t,r,s,o){super(e,t,s,o),this.getLocalProperty=this.getLocalProperty,this.setLocalProperty=this.setLocalProperty,this._response=r;const a=this._options.objectSerializer;a.updateSequenceNumberFromSerializedObjectMessage(this._response),this._remoteObjectId=a.getObjectIdBySerializedObjectMessage(this._response),h.assert(null!==this._remoteObjectId)}sync(){return l.resolve(new SyncRemoteProxy(this._options,this._response,this._debugId,this._hostKeyNames).createPublicObject())}applyHostFunction(e){return new AsyncRemoteProxy(this._options,!0,this._options.remoteMessenger.postRequestMessage(this._remoteObjectId,"","apply",e),null,this._debugId.concat("()")).createPublicObject()}getHostProperty(e){return new AsyncRemoteProxy(this._options,!0,this._options.remoteMessenger.postRequestMessage(this._remoteObjectId,e,"get",[]).then((t=>(this._tryCacheResult(!1,e,t),t))),null,this._debugId.concat(e)).createPublicObject()}getForceRemoteProperty(e){return this.getHostProperty(e).then((e=>e),(t=>{if(this._isLocalProperty(e))return this.getLocalProperty(e);throw t}))}setForceRemoteProperty(e,t){return this.setHostProperty(e,t).then((e=>e),(r=>{if(this._isLocalProperty(e))return this.setLocalProperty(e,t);throw r}))}setHostProperty(e,t){return new AsyncRemoteProxy(this._options,!0,this._options.remoteMessenger.postRequestMessage(this._remoteObjectId,e,"set",[t]),null,this._debugId.concat("setHostProperty")).createPublicObject()}_then(e,t){if(this._response.parameters.error){let e=l.reject(t(new Error(this._options.objectSerializer.deserialize(!1,this._response.parameters.has_object,this._debugId.concat("then"),this._response.parameters.error))));return this._options.objectSerializer._paramTracker.removeParams(this._response.callId),e}{this._response.parameters&&this._response.parameters.result&&this._response.parameters.result.hasOwnProperty(this._options.objectSerializer._serializationOptionsPropertyName)&&(this._response.parameters.result.callId=this._response.callId);let t=l.resolve(e(this._options.objectSerializer.deserialize(!1,this._response.parameters.has_object,this._debugId.concat("then"),this._response.parameters.result)));return this._options.objectSerializer._paramTracker.removeParams(this._response.callId),t}}_catch(e){this._then(void 0,e)}createPublicObject(e){e=e||function CallableTarget(){};const t=super.createPublicObject(e);return e._options.remoteRefTracker.addReference(e._remoteObjectId),e._options.localRefTracker.watchForRelease(e,e._options.remoteRefTracker.removeReference.bind(e._options.remoteRefTracker,e._remoteObjectId)),t}}class SyncRemoteProxy extends RemoteProxy{constructor(e,t,r,s){super(e,!1,r,s),this._response=t,this.getLocalProperty=this.getLocalProperty,this.setLocalProperty=this.setLocalProperty,this._resultObjectId=this._options.objectSerializer.getObjectIdBySerializedObjectMessage(this._response),null!==this._resultObjectId&&(this._options.remoteRefTracker.addReference(this._resultObjectId),this._options.localRefTracker.watchForRelease(this,this._options.remoteRefTracker.removeReference.bind(this._options.remoteRefTracker,this._resultObjectId)))}async(){return new AsyncRemoteProxy(this._options,!0,l.resolve(this._response),null,this._debugId,this._hostKeyNames).createPublicObject()}applyHostFunction(e){if(null!==this._resultObjectId){const t=this._debugId?.slice(-1)[0];if(t&&chrome.webview.hostObjects.getLocalProperty("options")?.forceAsyncMethodMatches?.filter((e=>t.match(e)))?.length>0){let t=this.async().applyHostFunction(e),r=t.sync();return r._cancelablePromise=t,r}return this._options.remoteMessenger.postSyncRequestMessage(this._resultObjectId,"","apply",e,this._debugId.concat("()")).value}throw new Error("Unable to call method on non-function.")}getHostProperty(e){if(null!==this._resultObjectId){let t=this._options.remoteMessenger.postSyncRequestMessage(this._resultObjectId,e,"get",[],this._debugId.concat(e));return t.cache_able&&this.setLocalProperty(e,t.value),t.value}return this._response.parameters.result[e]}getForceRemoteProperty(e){try{return this.getHostProperty(e)}catch(t){if(this._isLocalProperty(e))return this.getLocalProperty(e);throw t}}setForceRemoteProperty(e,t){try{return this.setHostProperty(e,t)}catch(r){if(this._isLocalProperty(e))return this.setLocalProperty(e,t);throw r}}setHostProperty(e,t){if(null!==this._resultObjectId)return this._options.remoteMessenger.postSyncRequestMessage(this._resultObjectId,e,"set",[t],this._debugId.concat(e)).value;return this._response.parameters.result[e]=t}createPublicObject(e){e=e||function CallableTarget(){};const t=super.createPublicObject(e);return null!==e._resultObjectId&&(e._options.remoteRefTracker.addReference(e._resultObjectId),e._options.localRefTracker.watchForRelease(e,e._options.remoteRefTracker.removeReference.bind(e._options.remoteRefTracker,e._resultObjectId))),t}}class RemoteProxyGroup{constructor(e,t,s,o,a){window.debugChromeWebViewRemoteObjects&&!a&&(a=h.log.bind(h)),this._groupId=o||"28C1DF41-5C2A-4AA9-84B6-D5172F346B26",this._options={log:a,shouldSerializeDates:!1,forceLocalProperties:["then","toJSON"],shouldPassTypedArraysAsArrays:!1},this._proxyOptions={localRefTracker:null,remoteRefTracker:null,idGenerator:null,forceLocalProperties:this._options.forceLocalProperties,objectSerializer:null,remoteMessenger:null},this._proxyOptions.localRefTracker=new LocalRefTracker(this._log.bind(this)),this._proxyOptions.remoteRefTracker=new RemoteRefTracker(s,this._log.bind(this)),this._proxyOptions.idGenerator=new IdGenerator,this._proxyOptions.objectSerializer=new ObjectSerializer(this._proxyOptions.idGenerator,this._groupId,this._proxyOptions,this._options),this._proxyOptions.remoteMessenger=new RemoteMessenger(e,t,this._log.bind(this),this._proxyOptions.idGenerator,this._proxyOptions.objectSerializer),this.hostObjects=this._proxyOptions.objectSerializer.createKnownRemoteProxy(0,!1,!1,["asyncRoot"],void 0,[]),delayPropertyCreation(this.hostObjects,"sync",(()=>this._proxyOptions.objectSerializer.createKnownRemoteProxy(0,!1,!0,["syncRoot"],void 0,[]))),this.hostObjects.setLocalProperty("options",this._options),this.hostObjects.setLocalProperty("cleanupSome",this._proxyOptions.localRefTracker.cleanupSome.bind(this._proxyOptions.localRefTracker)),r&&(this.remoteObjects=this.hostObjects),this.localObjects={},this.hostObjects.setLocalProperty("cancelPromise",this.cancelPromise.bind(this)),this._proxyOptions.objectSerializer.setObjectByWellKnownObjectId(this.localObjects,0)}_setNativeRemoteObjectEventTarget(e){this._proxyOptions.remoteMessenger._setNativeRemoteObjectEventTarget(e)}_log(e,t){this._options.log&&this._options.log(e,t)}cancelPromise(e){e.hasOwnProperty("_cancel")?e._cancel():e.hasOwnProperty("_cancelablePromise")&&e._cancelablePromise._cancel()}}const s=new e,y={};[{object:s,names:["postMessage","releaseBuffer"]},{object:new d,names:["addEventListener","removeEventListener","dispatchEvent"]}].forEach((e=>e.names.forEach((t=>y[t]=e.object[t].bind(e.object))))),i&&(y.getTextureStream=s.getTextureStream.bind(s),y.registerTextureStream=s.registerTextureStream.bind(s),y.unregisterTextureStream=s.unregisterTextureStream.bind(s)),n&&(y.postMessageWithAdditionalObjects=s.postMessageWithAdditionalObjects.bind(s));const b=new RemoteProxyGroup(s.postRemoteObjectCall.bind(s),o?null:y,s.releaseObjectsCallback.bind(s));return y.hostObjects=b.hostObjects,r&&(y.remoteObjects=y.hostObjects),y.RemoteProxyGroup=RemoteProxyGroup,o&&(b._setNativeRemoteObjectEventTarget(s),s.addEventListener("message",(e=>{a&&h.log("native event:",e);let t=new Event("message");c.defineProperty(t,"data",{value:p.parse(e.data)}),c.defineProperty(t,"source",{value:y}),c.defineProperty(t,"additionalObjects",{value:e.additionalObjects}),y.dispatchEvent(t)})),s.addEventListener("sharedbufferreceived",(e=>{a&&h.log("native event:",e);let t=!1,r=new Event("sharedbufferreceived");e.data&&c.defineProperty(r,"additionalData",{value:p.parse(e.data)}),c.defineProperty(r,"getBuffer",{value:function(){return t=!0,e.sharedBuffer}}),c.defineProperty(r,"sharedBuffer",{value:e.sharedBuffer}),c.defineProperty(r,"source",{value:y}),y.dispatchEvent(r),t||chrome.webview.releaseBuffer(e.sharedBuffer)}))),y}))}}})();; delete globalParams;" (Indicator: "postmessage"; Source: "00000000-00005148.00000000.189261.00660000.00000004.mdmp")3c:T2afe,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000000417cfe7f0000800b93000000000078ed8f00000000000600000000000000c1dac4a4fe7f00000000000000000000000000000000000060eb8f00000000000000000000000000b0ea8f000000000070d3d2a4fe7f00000000000000000000f0d2d2a4fe7f0000080000000000000078eb8f00000000000000000000000000090000000000000000000001fe7f0000d0ea8f00000000000000000069002d00f800bd000000000069006e002d0063006f00720065002d0000000000000000008029c4a4fe7f00000100000065006100640073002d006c0031002d0031002d009399c2a4fe7f00000000c1a4fe7f00000846c8a4fe7f0000409e9200 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000000000000000000f0559d00000000001019c6a4fe7f0000000000000000000000003e1b000000000000000000000000ee26afa2fe7f0000070000000000000090bf8f000000000090bf8f0000000000400ebda2fe7f000000003e1b000000007b636da2fe7f0000030000000000000000000000000000009200000000000000a004ae1b0000000080bf8f0000000000bb5fafa2fe7f00000d00000000000000a004ae1b0000000092000000000000000000000000000000a004ae1b000000001c5bafa2fe7f0000000000000000000092000000000000000d000000000000000d00000000000000aa00000000000000d2454f1b00000000a03a541b (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000a428c4a4fe7f0000802d940000000000000000000000000000000000000000000965e9a2fe7f00000100000002000000f8005076fe7f0000903c9e00000000002000000000000000802d940000000000302ee9a2fe7f0000a0f79200000000005441e9a2fe7f0000ed03000000000000484a5976fe7f000000000000fe7f0000f8005076fe7f000000a2e9a2fe7f000000005076fe7f00000000000000000000ee5bc4a4fe7f00000100000000000000000000000000000090029e000000000088e18f00000000000500000000000000c1dac4a4fe7f00000100000000000000f8005076fe7f000038e68f0000000000e9fe5776fe7f0000d0e18f00 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000a15bc3a4fe7f00000000000000000000000000000000000000a58a1c00000000f01d8f1c00000000000000000000000001000000000000001d08000000000000401d8f1c000000000000000000000000f665c3a4fe7f00000000a602000000000000a6020000000028080000000000000008000000000000ff030000000000001d080000000000000000000000000000000000000000000001010000000000000000000000000000280800000000000001000000000000007bb0db0125880000b147c3a4fe7f00000000000001000000cde06ba2fe7f00007b0000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000760c0000000000000101000000000000100f341b000000000300000000000000feffff7f000000000400000000000000b1036ca2fe7f000090b1c31b0000000001000080ffffffff90ab8f000000000080a28f000000000030abc31b000000000a00000000000000000000000000000088ab8f000000000043003a005c0055007300650072007300000000000000000038aeb61b00000000000000000000000031adf4a3fe7f000070a38f00000000000bb9c3a4fe7f00005600780000000000330000000000000070b3c11b0000000000190000000000000400000000000000000000000000000000000000000000004011af000000000060cebd1b (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000a8aac41b0000000030b4c11b000000003e0000000000000001000000be37000018a18f0000000000d833eaa3fe7f00000000000000000000a046c41b0000000070a9c41b0000000060e18ca0fe7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000050bcc21b0000000064bcc21b0000000050bcc21b0000000092bcc21b00000000000000000000000000000000000000000000000000000000000000000000000050bcc21b0000000064bcc21b0000000050bcc21b00000000000000000000000000000000 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000303796a0fe7f0000f0a48f0000000000df2e45a0fe7f000070a9c41b00000000767436a0fe7f0000b09e8f0000000000020000000000000000000000000000000000000200000000709b8f000000000092a96ba2fe7f00000000000000000000000000000000000000000002000000000000000000000000a09a8f0000000000209b8f000000000000008f0000000000000000000000000018a18f0000000000000000000000000030000000000000006bb8c3a4fe7f000017001b0000000000830000000000000040099f00000000000000000000000000b200d80100000000009c8f000000000072bbc21b00000000515a3ea0fe7f000045006a00 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000b80fc71b00000000305dc41b000000006bb81b00fe7f000001000000be37000048818f0000000000d833eaa3fe7f0000000000000000000000e59f0000000000800ec71b0000000060e18ca0fe7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000d6dfc11b00000000ecdfc11b00000000d6dfc11b000000001ae0c11b000000000000000000000000000000000000000000000000000000000000000000000000d6dfc11b00000000ecdfc11b00000000d6dfc11b00000000000000000000000000000000 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a000002000000000000005816c71b00000000305dc41b000000006bb81b00fe7f000001000000be37000048818f0000000000d833eaa3fe7f00000000000000000000d036c71b000000002015c71b0000000060e18ca0fe7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000026e5c11b000000003ee5c11b0000000026e5c11b000000006ce5c11b00000000000000000000000000000000000000000000000000000000000000000000000026e5c11b000000003ee5c11b0000000026e5c11b00000000000000000000000000000000 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a000002000000000000005816c71b00000000305dc41b000000006bb81b00fe7f000001000000be37000048818f0000000000d833eaa3fe7f00000000000000000000403ac71b000000002015c71b0000000060e18ca0fe7f000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000005607c41b000000006a07c41b000000005607c41b000000009807c41b0000000000000000000000000000000000000000000000000000000000000000000000005607c41b000000006a07c41b000000005607c41b00000000000000000000000000000000 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a000002000000000000005816c71b00000000305dc41b000000006bb81b00fe7f000001000000be37000048818f0000000000d833eaa3fe7f00000000000000000000803bc71b000000002015c71b0000000060e18ca0fe7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000016e4c11b000000002ee4c11b0000000016e4c11b000000005ce4c11b00000000000000000000000000000000000000000000000000000000000000000000000016e4c11b000000002ee4c11b0000000016e4c11b00000000000000000000000000000000 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a000002000000000000005816c71b00000000305dc41b000000006bb81b00fe7f000001000000be37000048818f0000000000d833eaa3fe7f00000000000000000000203cc71b000000002015c71b0000000060e18ca0fe7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000e6cfc11b00000000fccfc11b00000000e6cfc11b000000002ad0c11b000000000000000000000000000000000000000000000000000000000000000000000000e6cfc11b00000000fccfc11b00000000e6cfc11b00000000000000000000000000000000 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a000002000000000000005816c71b00000000305dc41b000000006bb81b00fe7f000001000000be37000048818f0000000000d833eaa3fe7f000000000000000000008036c71b000000002015c71b0000000060e18ca0fe7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000046e7c11b000000005ee7c11b0000000046e7c11b000000008ce7c11b00000000000000000000000000000000000000000000000000000000000000000000000046e7c11b000000005ee7c11b0000000046e7c11b00000000000000000000000000000000 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a000002000000000000005816c71b00000000305dc41b000000006bb81b00fe7f000001000000be37000048818f0000000000d833eaa3fe7f000000000000000000003031c71b000000002015c71b0000000060e18ca0fe7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000016e4c11b000000002ee4c11b0000000016e4c11b000000005ce4c11b00000000000000000000000000000000000000000000000000000000000000000000000016e4c11b000000002ee4c11b0000000016e4c11b00000000000000000000000000000000 (UID: 00000000-00007288)3d:T45d,Found reference to API "IsWow64Process" (Indicator: "IsWow64Process"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "IsWow64Process2" (Indicator: "IsWow64Process"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "IsWow64Process2" (Indicator: "IsWow64Process"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "::IsWow64Process" (Indicator: "IsWow64Process"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "IsWow64Process" (Indicator: "IsWow64Process"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "IsWow64Process2" (Indicator: "IsWow64Process"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "::IsWow64Process" (Indicator: "IsWow64Process"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "IsWow64Process" (Indicator: "IsWow64Process"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")3e:T66d,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")3f:T6a0,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")40:Ta30,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" queries volume information of "C:\ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" at 00000000-00007288-00000C17-1067069358 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" queries volume information of "C:\Windows\Fonts\msyh.ttc" at 00000000-00007288-00000C17-1068166065 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" queries volume information of "C:\Windows\Fonts\msyhbd.ttc" at 00000000-00007288-00000C17-1068176624 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007288-00000C17-1069129074 "YuDun.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\YuDun.exe" at 00000000-00003388-00000C17-1071083532 "YuDun.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\Microsoft.Web.WebView2.WinForms.dll" at 00000000-00003388-00000C17-1071904925 "YuDun.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\Microsoft.Web.WebView2.Core.dll" at 00000000-00003388-00000C17-1071933023 "msedgewebview2.exe" queries volume information of "C:\Windows\System32\drivers\etc\hosts" at 00000000-00007228-00000C17-1128252786 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\segoeui.ttf" at 00000000-00007228-00000C17-1132490811 "msedgewebview2.exe" queries volume information of "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.71\Trust Protection Lists\manifest.json" at 00000000-00007228-00000C17-1132650687 "msedgewebview2.exe" queries volume information of "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.71\WidevineCdm\manifest.json" at 00000000-00007228-00000C17-1132701180 "msedgewebview2.exe" queries volume information of "C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm" at 00000000-00007228-00000C17-1132716881 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\segoeuib.ttf" at 00000000-00007228-00000C17-1133550562 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\seguisb.ttf" at 00000000-00007228-00000C17-1133559996 "msedgewebview2.exe" queries volume information of "C:\Windows\System32\drivers\etc\hosts" at 00000000-00008036-00000C17-1132916299 "msedgewebview2.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports" at 00000000-00008036-00000C17-113854931541:T5ef,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtOpenProcess" (Indicator: "NtOpenProcess"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetProcessHeaps" (Indicator: "GetProcessHeaps"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "NtOpenProcess" (Indicator: "NtOpenProcess"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "GetProcessHeaps" (Indicator: "GetProcessHeaps"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")42:T529,"msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0119E81BE9A14CD8E22F40AC118C687ECBA3F4D8"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\06F1AA330B927B753A40E68CDF22E34BCBEF3352"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0E9612411A0A4ABD15B84FFACBA6DB3166916E75"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\31F9FC8BA3805986B721EA7295C65B3A44534274"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25"; Key: "BLOB")43:Tf8c,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\app (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\app\css (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\app\js (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\app\vendor (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\sigs (UID: 00000000-00007288) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2 (UID: 00000000-00007228) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView (UID: 00000000-00007228) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Crashpad (UID: 00000000-00007228) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Crashpad\reports (UID: 00000000-00007228) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Crashpad\attachments (UID: 00000000-00007228) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\BrowserMetrics (UID: 00000000-00007228) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\component_crx_cache (UID: 00000000-00007228) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\ShaderCache (UID: 00000000-00007228) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default (UID: 00000000-00007228) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Cache (UID: 00000000-00007228) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Site Characteristics Database (UID: 00000000-00007228) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Cache\Cache_Data (UID: 00000000-00007228) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\ClientCertificates (UID: 00000000-00007228) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Cache\No_Vary_Search (UID: 00000000-00007228) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Shared Dictionary (UID: 00000000-00007228) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Code Cache (UID: 00000000-00007228) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Code Cache\js (UID: 00000000-00007228) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Sync Data (UID: 00000000-00007228) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Sync Data\LevelDB (UID: 00000000-00007228)44:Tba6,"YuDun.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.3388.2140.3844785736939200741" - (UID: 00000000-00003388) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\crashpad_7228_VDSAQUKBTGPZKENI" - (UID: 00000000-00007228) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7228.3472.14405135135550942727" - (UID: 00000000-00007228) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7228.3472.6374665854889323723" - (UID: 00000000-00007228) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7228.3472.14066191490151524179" - (UID: 00000000-00007228) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7228.3472.5454464863564828738" - (UID: 00000000-00007228) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7228.3472.2322544622144224368" - (UID: 00000000-00007228) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7228.8996.13028417983517402807" - (UID: 00000000-00007228) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7228.3472.13010283346001546530" - (UID: 00000000-00007228) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7228.3472.13927404265834048926" - (UID: 00000000-00007228) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7228.3472.192139367318945765" - (UID: 00000000-00007228) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7228.3472.4039787540199896208" - (UID: 00000000-00007228) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7228.3472.6688152125458670086" - (UID: 00000000-00007228) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7228.3472.9783263576280383562" - (UID: 00000000-00007228) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7228.3472.13083436995698846823" - (UID: 00000000-00007228) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7228.3472.10032652321188049355" - (UID: 00000000-00007228) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7228.3472.10504510178851595211" - (UID: 00000000-00007228) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7228.3472.10806434328778007506" - (UID: 00000000-00007228) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7228.3472.10085397572935717235" - (UID: 00000000-00007228) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7228.3472.11212740987548767006" - (UID: 00000000-00007228) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\crashpad_7228_VDSAQUKBTGPZKENI" - (UID: 00000000-00004252)45:T6647,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\908b5c1debcfb784bc25157a8ebcdfbe\System.Drawing.ni.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\061200dcb8937e1b9eb2641f2ce9d2ec\System.Windows.Forms.ni.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter sxs.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007288) "YuDun.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\908b5c1debcfb784bc25157a8ebcdfbe\System.Drawing.ni.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\061200dcb8937e1b9eb2641f2ce9d2ec\System.Windows.Forms.ni.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\YuDunPCManager\runtimes\win-x64\native\WebView2Loader.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter WebView2Loader.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\YuDunPCManager\WebView2Loader.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\141.0.3537.71\EBWebView\x64\EmbeddedBrowserWebView.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\edputil.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003388) "YuDun.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dbghelp.dll (UID: 00000000-00003388) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ntmarta.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\141.0.3537.71\msedge.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter MDMRegistration.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter DWrite.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter dnsapi.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-shcore-scaling-l1-1-1.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\141.0.3537.71\telclient.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\141.0.3537.71\oneds.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter Iphlpapi.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter aadWamExtension.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter MicrosoftAccountWAMExtension.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l1-1-0.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shcore.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernelbase.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter atlthunk.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter OLEACC.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007228) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004252) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004252) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00004252) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00004252) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004252) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004252) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004252) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004252) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004252) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00004252) "msedgewebview2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004252) "msedgewebview2.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004252) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004252) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008036) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008036) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00008036) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00008036) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008036) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008036) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00008036) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00008036) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00008036) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00008036) "msedgewebview2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008036) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\141.0.3537.71\msedge.dll (UID: 00000000-00008036) "msedgewebview2.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008036) "msedgewebview2.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008036) "msedgewebview2.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008036) "msedgewebview2.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00008036) "msedgewebview2.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00008036) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00008036) "msedgewebview2.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008036) "msedgewebview2.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00008036) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00008036)46:T15f8,"msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\BrowserMetrics-spare.pma & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\BrowserMetrics\BrowserMetrics-6ADCA3BD-1C3C.pma (UID: 00000000-00007228) "msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\a5f4f9fc-9383-4ac2-bff4-2657ea5d9f18.tmp & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Local State (UID: 00000000-00007228) "msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Site Characteristics Database/000001.dbtmp & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Site Characteristics Database/CURRENT (UID: 00000000-00007228) "msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Sync Data\LevelDB/000001.dbtmp & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Sync Data\LevelDB/CURRENT (UID: 00000000-00007228) "msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Code Cache\js\index-dir\todelete_b88b427fbc85c9b2 (UID: 00000000-00007228) "msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension Rules/000001.dbtmp & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension Rules/CURRENT (UID: 00000000-00007228) "msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Code Cache\wasm\index-dir\todelete_6457db137c3e07ee (UID: 00000000-00007228) "msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Code Cache\js\index-dir\temp-index & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index (UID: 00000000-00007228) "msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Code Cache\wasm\index-dir\temp-index & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index (UID: 00000000-00007228) "msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\shared_proto_db\metadata/000001.dbtmp & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\shared_proto_db\metadata/CURRENT (UID: 00000000-00007228) "msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\shared_proto_db/000001.dbtmp & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\shared_proto_db/CURRENT (UID: 00000000-00007228) "msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension Scripts/000001.dbtmp & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension Scripts/CURRENT (UID: 00000000-00007228) "msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension State/000001.dbtmp & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension State/CURRENT (UID: 00000000-00007228) "msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\component_crx_cache\5ab03da0-c3b0-4b33-9778-3aabd9bb1325.tmp & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\component_crx_cache\metadata.json (UID: 00000000-00007228) "msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\ec7517c9-5299-49e8-8897-54c6396d2518.tmp & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Secure Preferences (UID: 00000000-00007228) "msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\1d49a363-8f97-441d-a125-fa622b45d613.tmp & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Preferences (UID: 00000000-00007228) "msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Shared Dictionary\cache\index-dir\todelete_465c85669373fd (UID: 00000000-00008036) "msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Shared Dictionary\cache\index-dir\temp-index & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index (UID: 00000000-00008036) "msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\72d93f09-4375-463b-9bff-d9fc6421055c.tmp & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports (UID: 00000000-00008036) "msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\b80781d5-cc21-4429-b220-b58cdb1953fe.tmp & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\Sdch Dictionaries (UID: 00000000-00008036) "msedgewebview2.exe" called "MoveFileW" with parameter %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\68868594-38c5-4ea0-8639-b69a52eba378.tmp & %LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\Network Persistent State (UID: 00000000-00008036)47:T6a0,Found reference to API "CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CreateProcessWithTokenW" (Indicator: "CreateProcess"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CreateProcessWithTokenW" (Indicator: "CreateProcess"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "CreateProcessWithTokenW" (Indicator: "CreateProcess"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")48:T5a5,Found reference to API "CreateDirectoryAndGetError" (Indicator: "CreateDirectory"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CreateDirectory" (Indicator: "CreateDirectory"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "CreateDirectoryAndGetError" (Indicator: "CreateDirectory"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CreateDirectory" (Indicator: "CreateDirectory"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CreateDirectoryAndGetError" (Indicator: "CreateDirectory"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "CreateDirectory" (Indicator: "CreateDirectory"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")49:Tdc4,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "CreateFileFromAppW" (Indicator: "CreateFile"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CreateFileVersionInfoWin" (Indicator: "CreateFile"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "CreateFileFromAppW" (Indicator: "CreateFile"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CreateFileVersionInfoWin" (Indicator: "CreateFile"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CreateFileFromAppW" (Indicator: "CreateFile"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "CreateFileVersionInfoWin" (Indicator: "CreateFile"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")4a:T440,Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")4b:T628,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")4c:Td96,Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "__crtCreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "__crtCreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")4d:T566,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "?_XGetLastError@std@@YAXXZ" (Indicator: "GetLastError"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")4e:Tb98,Process ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7288:304:WilStaging_02" Process ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7288:304:WilStaging_02" Process ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7288:120:WilError_03" Process ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7288:120:WilError_03" Process ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe created mutex with name "Local\SM0:7288:304:WilStaging_02" Process ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe created mutex with name "Local\SM0:7288:120:WilError_03" Process ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe created mutex with name "Local\ZonesCacheCounterMutex" Process ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe created mutex with name "SM0:7288:304:WilStaging_02" Process ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe created mutex with name "SM0:7288:120:WilError_03" Process YuDun.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3388:304:WilStaging_02" Process YuDun.exe created mutex with name "\Sessions\1\BaseNamedObjects\YuDunPCManager_SingleInstance" Process YuDun.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3388:304:WilStaging_02" Process YuDun.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3388:120:WilError_03" Process YuDun.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3388:120:WilError_03" Process YuDun.exe created mutex with name "Local\SM0:3388:304:WilStaging_02" Process YuDun.exe created mutex with name "SM0:3388:304:WilStaging_02" Process YuDun.exe created mutex with name "Local\SM0:3388:120:WilError_03" Process YuDun.exe created mutex with name "SM0:3388:120:WilError_03" Process YuDun.exe created mutex with name "YuDunPCManager_SingleInstance" Process msedgewebview2.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7228:304:WilStaging_02" Process msedgewebview2.exe created mutex with name "SM0:7228:304:WilStaging_02" Process msedgewebview2.exe created mutex with name "SM0:7228:120:WilError_03"4f:Tfa1,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll" - [base:0; Status:c0000135] "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "YuDun.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "YuDun.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "YuDun.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "YuDun.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "YuDun.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "YuDun.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "YuDun.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll" - [base:0; Status:c0000135] "YuDun.exe" failed to load missing module "%LOCALAPPDATA%\YuDunPCManager\runtimes\win-x64\native\WebView2Loader.dll" - [base:0; Status:c0000135] "YuDun.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "YuDun.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "YuDun.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "YuDun.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "msedgewebview2.exe" failed to load missing module "MDMRegistration.dll" - [base:0; Status:c000000d] "msedgewebview2.exe" failed to load missing module "netapi32.dll" - [base:0; Status:c000000d] "msedgewebview2.exe" failed to load missing module "aadWamExtension.dll" - [base:0; Status:c000000d] "msedgewebview2.exe" failed to load missing module "MicrosoftAccountWAMExtension.dll" - [base:0; Status:c000000d]50:T45a,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Microsoft.Web.WebView2.Core.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "WebView2Loader.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "YuDun.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Microsoft.Web.WebView2.WinForms.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE51:T443,Observed unmanaged function "CreateCoreWebView2EnvironmentWithOptions" in "Microsoft.Web.WebView2.Core.dll" Observed unmanaged function "GetAvailableCoreWebView2BrowserVersionString" in "Microsoft.Web.WebView2.Core.dll" Observed unmanaged function "CompareBrowserVersions" in "Microsoft.Web.WebView2.Core.dll" Observed unmanaged function "GetAvailableCoreWebView2BrowserVersionStringWithOptions" in "Microsoft.Web.WebView2.Core.dll" Observed unmanaged function "GetSystemInfo" in "Microsoft.Web.WebView2.Core.dll" Observed unmanaged function "LoadLibrary" in "Microsoft.Web.WebView2.Core.dll" Observed unmanaged function "GetModuleHandle" in "Microsoft.Web.WebView2.Core.dll" Observed unmanaged function "GetModuleFileName" in "Microsoft.Web.WebView2.Core.dll" Observed unmanaged function "VariantClear" in "Microsoft.Web.WebView2.Core.dll" Observed unmanaged function "CertAddCertificateContextToStore" in "YuDun.exe" Observed unmanaged function "BeginPaint" in "Microsoft.Web.WebView2.WinForms.dll" Observed unmanaged function "EndPaint" in "Microsoft.Web.WebView2.WinForms.dll"52:T5d4,Found string - \\.\pipe\LOCAL\mojo.3388.2140.3844785736939200741 Found string - \\.\pipe\crashpad_7228_VDSAQUKBTGPZKENI Found string - \\.\pipe\LOCAL\mojo.7228.3472.14405135135550942727 Found string - \\.\pipe\LOCAL\mojo.7228.3472.6374665854889323723 Found string - \\.\pipe\LOCAL\mojo.7228.3472.14066191490151524179 Found string - \\.\pipe\LOCAL\mojo.7228.3472.5454464863564828738 Found string - \\.\pipe\LOCAL\mojo.7228.3472.2322544622144224368 Found string - \\.\pipe\LOCAL\mojo.7228.8996.13028417983517402807 Found string - \\.\pipe\LOCAL\mojo.7228.3472.13010283346001546530 Found string - \\.\pipe\LOCAL\mojo.7228.3472.13927404265834048926 Found string - \\.\pipe\LOCAL\mojo.7228.3472.192139367318945765 Found string - \\.\pipe\LOCAL\mojo.7228.3472.4039787540199896208 Found string - \\.\pipe\LOCAL\mojo.7228.3472.6688152125458670086 Found string - \\.\pipe\LOCAL\mojo.7228.3472.9783263576280383562 Found string - \\.\pipe\LOCAL\mojo.7228.3472.13083436995698846823 Found string - \\.\pipe\LOCAL\mojo.7228.3472.10032652321188049355 Found string - \\.\pipe\LOCAL\mojo.7228.3472.10504510178851595211 Found string - \\.\pipe\LOCAL\mojo.7228.3472.10806434328778007506 Found string - \\.\pipe\LOCAL\mojo.7228.3472.10085397572935717235 Found string - \\.\pipe\LOCAL\mojo.7228.3472.11212740987548767006 Found string - \\.\pipe\LOCAL\mojo. Found string - \\.\pipe\mojo. Found string - \\.\pipe\ Found string - EDGE_CRASHPAD_PIPE_NAME=\\.\pipe\crashpad_7228_VDSAQUKBTGPZKENI53:T45ad,"SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00000456.00000000.190611.779C2000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00000456.00000000.190611.779C2000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00000456.00000000.190611.779C2000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00000456.00000000.190611.779C2000.00000002.mdmp "Software\" in Source: 00000000-00000456.00000000.190611.779C2000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00000456.00000000.190611.779C2000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00000456.00000000.190611.779C2000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00000456.00000000.190611.779C2000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000456.00000000.190611.779C2000.00000002.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp "SOFTWARE\Policies\Microsoft\SQMClient" in Source: 00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp "Hardware\Description\System\CentralProcessor\0" in Source: 00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Flighting\Build" in Source: 00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient\Windows\CommonDatapoints" in Source: 00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp "Software\" in Source: 00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp "SOFTWARE\Policies\Microsoft\SQMClient" in Source: 00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp "Hardware\Description\System\CentralProcessor\0" in Source: 00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Flighting\Build" in Source: 00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient\Windows\CommonDatapoints" in Source: 00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp "Software\" in Source: 00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge\WebView2" in Source: 00000000-00007228.00000000.188567.00174000.00000004.mdmp "Software\Microsoft\EdgeWebView\StabilityMetrics" in Source: 00000000-00007228.00000000.188567.00174000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00007228.00000000.188567.6F677000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00007228.00000000.188567.6F677000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}" in Source: 00000000-00007228.00000000.188567.6F677000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007228.00000000.188567.6F677000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Edge\WebView2" in Source: 00000000-00007228.00000001.190489.00174000.00000004.mdmp "Software\Microsoft\EdgeWebView\StabilityMetrics" in Source: 00000000-00007228.00000001.190489.00174000.00000004.mdmp "Software\Microsoft\EdgeWebView\PreferenceMACs\Default" in Source: 00000000-00007228.00000001.190489.02218000.00000004.mdmp "SOFTWARE\Tencent\QQBrowser" in Source: 00000000-00007228.00000001.190489.02AB0000.00000004.mdmp "SOFTWARE\360\360se6" in Source: 00000000-00007228.00000001.190489.02AB0000.00000004.mdmp "SOFTWARE\Lenovo\SLBrowser" in Source: 00000000-00007228.00000001.190489.02AB0000.00000004.mdmp "SOFTWARE\360Chrome" in Source: 00000000-00007228.00000001.190489.02AB0000.00000004.mdmp "SOFTWARE\360ChromeX" in Source: 00000000-00007228.00000001.190489.02AB0000.00000004.mdmp "SOFTWARE\SogouExplorer" in Source: 00000000-00007228.00000001.190489.02AB0000.00000004.mdmp "1001\Software\Microsoft\EdgeWebView\" in Source: 00000000-00007228.00000001.190489.02C68000.00000004.mdmp "1001\Software\Microsoft\EdgeWebView\" in Source: 00000000-00007228.00000001.190489.02F04000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{DAA52B27-8897-50AF-ADA5-C6C71BB64E17}" in Source: 00000000-00007228.00000001.190489.04A00000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00007228.00000001.190489.04A00000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}" in Source: 00000000-00007228.00000001.190489.04A00000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{0000034B-0000-0000-C000-000000000046}" in Source: 00000000-00007228.00000001.190489.04A00000.00000004.mdmp "Software\Microsoft\IdentityCRL\Immersive\production\Token\" in Source: 00000000-00007228.00000001.190489.6F677000.00000004.mdmp "Software\Microsoft\IdentityCRL\Immersive\production\Property" in Source: 00000000-00007228.00000001.190489.6F677000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\ROOT" in Source: 00000000-00007228.00000001.190489.6F677000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\CA" in Source: 00000000-00007228.00000001.190489.6F677000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{DAA52B27-8897-50AF-ADA5-C6C71BB64E17}" in Source: 00000000-00007228.00000001.190489.6F677000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007228.00000001.190489.6F6CE000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007228.00000001.190489.744AC000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00007228.00000001.190489.744AC000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00007228.00000001.190489.744AC000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00007228.00000001.190489.744AC000.00000002.mdmp " 'reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" /v svc /d evil.exe'," in Source: 00000000-00007288.00000000.184862.00332000.00000002.mdmp "', pattern: /(currentversion\\run|reg\s+add\s+.*\\run|hkcu\\software\\microsoft\\windows\\currentversion\\run)/i }," in Source: 00000000-00007288.00000000.184862.00332000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00007288.00000000.184862.00332000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007288.00000000.184862.00332000.00000002.mdmp "Software\Policies\Microsoft\Edge\WebView2\" in Source: 00000000-00007288.00000000.184862.00332000.00000002.mdmp "Software\Policies\Microsoft\Edge\WebView2\DowngradeVersion" in Source: 00000000-00007288.00000000.184862.00332000.00000002.mdmp "SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00007288.00000000.184862.00332000.00000002.mdmp "eg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v svc /d evil.exe" in Source: 00000000-00007288.00000000.184862.00332000.00000002.mdmp "KCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007288.00000000.184862.00332000.00000002.mdmp "KCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007288.00000000.184862.00332000.00000002.mdmp "KLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007288.00000000.184862.00332000.00000002.mdmp "KLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007288.00000000.184862.00332000.00000002.mdmp "KLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007288.00000000.184862.00332000.00000002.mdmp " 'reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" /v svc /d evil.exe'," in Source: 00000000-00007288.00000000.184862.02A70000.00000004.mdmp "', pattern: /(currentversion\\run|reg\s+add\s+.*\\run|hkcu\\software\\microsoft\\windows\\currentversion\\run)/i }," in Source: 00000000-00007288.00000000.184862.02A70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00007288.00000000.184862.02A70000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00007288.00000000.184862.02A70000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00007288.00000000.184862.02A70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00007288.00000000.184862.02A70000.00000004.mdmp "Software\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00007288.00000000.184862.02A70000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007288.00000000.184862.02A70000.00000004.mdmp "Software\Policies\Microsoft\Edge\WebView2\" in Source: 00000000-00007288.00000000.184862.02A70000.00000004.mdmp "Software\Policies\Microsoft\Edge\WebView2\DowngradeVersion" in Source: 00000000-00007288.00000000.184862.02A70000.00000004.mdmp "SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00007288.00000000.184862.02A70000.00000004.mdmp "eg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v svc /d evil.exe" in Source: 00000000-00007288.00000000.184862.02A70000.00000004.mdmp "KCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007288.00000000.184862.02A70000.00000004.mdmp "KCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007288.00000000.184862.02A70000.00000004.mdmp "KLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007288.00000000.184862.02A70000.00000004.mdmp "KLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007288.00000000.184862.02A70000.00000004.mdmp "KLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007288.00000000.184862.02A70000.00000004.mdmp "\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-4" in Source: 00000000-00007288.00000000.184862.1BC00000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007288.00000000.184862.1BC3D000.00000004.mdmp "e\Software\C" in Source: 00000000-00007288.00000000.184862.1BC3D000.00000004.mdmp "21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007288.00000000.184862.1BC3D000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007288.00000000.184862.1BC3D000.00000004.mdmp "STRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00007288.00000000.184862.1BC3D000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}" in Source: 00000000-00007288.00000000.184862.1BC3D000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00007288.00000000.184862.1BC3D000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6B" in Source: 00000000-00007288.00000000.184862.1BC3D000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007288.00000000.184862.1BC3D000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007288.00000000.184862.1BC3D000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00007288.00000000.184862.1BC3D000.00000004.mdmp "1-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{C2F03" in Source: 00000000-00007288.00000000.184862.1BC3D000.00000004.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00008572.00000000.189626.E6A0A000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00008572.00000000.189626.E6A0A000.00000002.mdmp "SOFTWARE\Policies\Microsoft\SQMClient" in Source: 00000000-00008572.00000000.189626.E6A0A000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00008572.00000000.189626.E6A0A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00008572.00000000.189626.E6A0A000.00000002.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00008572.00000000.189626.E6A0A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00008572.00000000.189626.E6A0A000.00000002.mdmp "Hardware\Description\System\CentralProcessor\0" in Source: 00000000-00008572.00000000.189626.E6A0A000.00000002.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00008572.00000000.189626.E6A0A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Flighting\Build" in Source: 00000000-00008572.00000000.189626.E6A0A000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient\Windows\CommonDatapoints" in Source: 00000000-00008572.00000000.189626.E6A0A000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008572.00000000.189626.E6A0A000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00008572.00000000.189626.E6A0A000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00008572.00000000.189626.E6A0A000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00008572.00000000.189626.E6A0A000.00000002.mdmp "Software\" in Source: 00000000-00008572.00000000.189626.E6A0A000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00008572.00000000.189626.E6A0A000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00008572.00000000.189626.E6A0A000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00008976.00000000.189149.779C2000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00008976.00000000.189149.779C2000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00008976.00000000.189149.779C2000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00008976.00000000.189149.779C2000.00000002.mdmp "Software\" in Source: 00000000-00008976.00000000.189149.779C2000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00008976.00000000.189149.779C2000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00008976.00000000.189149.779C2000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00008976.00000000.189149.779C2000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008976.00000000.189149.779C2000.00000002.mdmp54:T5939,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe7c410000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "ADVAPI32.DLL" at base 7ffea3370000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffea2690000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffea2690000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffea2690000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffe7c360000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "SHLWAPI.DLL" at base bd0000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffea0130000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "VERSION.DLL" at base 7ffe98f10000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffe79ac0000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "USER32.DLL" at base 7ffea2df0000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffea2690000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "MSCOREE.DLL" at base 7ffe85470000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "NTDLL" at base 7ffea4c10000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffea3ba0000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "PSAPI.DLL" at base 7ffea2c30000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "RPCRT4.DLL" at base 7ffea4ab0000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "KERNEL32.DLL" at base 7ffea3220000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\6078762B90671C2FF9BA39318E2176D8\MSCORLIB.NI.DLL" at base 7ffe78460000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "OLE32.DLL" at base 7ffea4190000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe9fc40000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffea3ba0000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffea2690000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffe7bb30000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\FE3C9CF707273488C6C658D52D624640\SYSTEM.NI.DLL" at base 7ffe75880000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\908B5C1DEBCFB784BC25157A8EBCDFBE\SYSTEM.DRAWING.NI.DLL" at base 7ffe78260000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\061200DCB8937E1B9EB2641F2CE9D2EC\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ffe71040000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "UXTHEME.DLL" at base 7ffe9fc40000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\21FF4BA4607B18A9B179AB90FD3B0BC1\SYSTEM.CORE.NI.DLL" at base 7ffe74e00000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\24206316825BB75EBFBDD31895DF2F1F\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffe78120000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\76FF225C5A523F0BE2364B0FC02BF7F9\SYSTEM.XML.NI.DLL" at base 7ffe72620000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "NTDLL.DLL" at base 7ffea4c10000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "SHELL32.DLL" at base 1b3e0000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "BCRYPT.DLL" at base 7ffea22d0000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffea1270000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "IMM32.DLL" at base 7ffea4a70000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "COMCTL32.DLL" at base 7ffe76500000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "GDI32.DLL" at base 7ffea3030000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "GDIPLUS.DLL" at base 7ffe7fa60000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.19041.6456_NONE_91A399B0CC88BC24\GDIPLUS.DLL" at base 7ffe7fa60000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffea2690000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "COMCTL32.DLL" at base 7ffe8d6c0000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffea2df0000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffea2df0000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffea3ba0000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffea4190000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffea4830000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "SXS.DLL" at base 7ffea1fc0000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ffe89100000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "OLEAUT32.DLL" at base 7ffea40c0000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffea0330000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffe9ce60000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "CSCAPI.DLL" at base 7ffe931e0000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffe909f0000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffe95b10000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "SSPICLI.DLL" at base 7ffea2180000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffea2690000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "VIRTDISK.DLL" at base 7ffe9f870000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ffe9dd20000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ffe89470000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\SYSTEM32\ONECORECOMMONPROXYSTUB.DLL" at base 7ffe8ea70000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffe9b9a0000 "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffe9f7d0000 "YuDun.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe7c410000 "YuDun.exe" loaded module "ADVAPI32.DLL" at base 7ffea3370000 "YuDun.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffea2690000 "YuDun.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffea2690000 "YuDun.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffea2690000 "YuDun.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffe7c360000 "YuDun.exe" loaded module "SHLWAPI.DLL" at base d00000 "YuDun.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffea0130000 "YuDun.exe" loaded module "VERSION.DLL" at base 7ffe98f10000 "YuDun.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffe79ac0000 "YuDun.exe" loaded module "USER32.DLL" at base 7ffea2df0000 "YuDun.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffea2690000 "YuDun.exe" loaded module "MSCOREE.DLL" at base 7ffe85470000 "YuDun.exe" loaded module "NTDLL" at base 7ffea4c10000 "YuDun.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffea3ba0000 "YuDun.exe" loaded module "PSAPI.DLL" at base 7ffea2c30000 "YuDun.exe" loaded module "RPCRT4.DLL" at base 7ffea4ab0000 "YuDun.exe" loaded module "KERNEL32.DLL" at base 7ffea3220000 "YuDun.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\6078762B90671C2FF9BA39318E2176D8\MSCORLIB.NI.DLL" at base 7ffe78460000 "YuDun.exe" loaded module "OLE32.DLL" at base 7ffea4190000 "YuDun.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe9fc40000 "YuDun.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffea3ba0000 "YuDun.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffea2690000 "YuDun.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffe7bb30000 "YuDun.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\FE3C9CF707273488C6C658D52D624640\SYSTEM.NI.DLL" at base 7ffe75880000 "YuDun.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\908B5C1DEBCFB784BC25157A8EBCDFBE\SYSTEM.DRAWING.NI.DLL" at base 7ffe78260000 "YuDun.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\061200DCB8937E1B9EB2641F2CE9D2EC\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ffe71040000 "YuDun.exe" loaded module "UXTHEME.DLL" at base 7ffe9fc40000 "YuDun.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\21FF4BA4607B18A9B179AB90FD3B0BC1\SYSTEM.CORE.NI.DLL" at base 7ffe74e00000 "YuDun.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffea1270000 "YuDun.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffea24a0000 "YuDun.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\24206316825BB75EBFBDD31895DF2F1F\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffe78120000 "YuDun.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\76FF225C5A523F0BE2364B0FC02BF7F9\SYSTEM.XML.NI.DLL" at base 7ffe72620000 "YuDun.exe" loaded module "NTDLL.DLL" at base 7ffea4c10000 "YuDun.exe" loaded module "SHELL32.DLL" at base 1bd80000 "YuDun.exe" loaded module "BCRYPT.DLL" at base 7ffea22d0000 "YuDun.exe" loaded module "COMCTL32.DLL" at base 7ffe8d6c0000 "YuDun.exe" loaded module "GDI32.DLL" at base 7ffea3030000 "YuDun.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 7ffe93090000 "YuDun.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffea2df0000 "YuDun.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffea2df0000 "YuDun.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffea3ba0000 "YuDun.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffea4190000 "YuDun.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffea4830000 "YuDun.exe" loaded module "GDIPLUS.DLL" at base 7ffe7fa60000 "YuDun.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.19041.6456_NONE_91A399B0CC88BC24\GDIPLUS.DLL" at base 7ffe7fa60000 "YuDun.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffea2690000 "YuDun.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffea2690000 "YuDun.exe" loaded module "KERNEL32" at base 7ffea3220000 "YuDun.exe" loaded module "WEBVIEW2LOADER.DLL" at base 7ffe98d30000 "YuDun.exe" loaded module "%LOCALAPPDATA%\YUDUNPCMANAGER\WEBVIEW2LOADER.DLL" at base 7ffe98d30000 "YuDun.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffea24a0000 "YuDun.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffea2690000 "YuDun.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffea2690000 "YuDun.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffea2690000 "YuDun.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 2d20000 "YuDun.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\141.0.3537.71\EBWEBVIEW\X64\EMBEDDEDBROWSERWEBVIEW.DLL" at base 7ffe74860000 "YuDun.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffe9ce60000 "YuDun.exe" loaded module "%WINDIR%\SYSTEM32\EDPUTIL.DLL" at base 7ffe8e640000 "YuDun.exe" loaded module "COMBASE.DLL" at base 7ffea3ba0000 "YuDun.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffea3ba0000 "YuDun.exe" loaded module "API-MS-WIN-CORE-FILE-L1-2-1.DLL" at base 7ffea2690000 "YuDun.exe" loaded module "%WINDIR%\SYSTEM32\DBGHELP.DLL" at base 7ffe96e70000 "YuDun.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.DLL" at base 7ffe895f0000 "msedgewebview2.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe7c410000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffea2690000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffea2690000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffea2690000 "msedgewebview2.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffea24a0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffea2690000 "msedgewebview2.exe" loaded module "KERNEL32" at base 7ffea3220000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffea2690000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffea2690000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffea2690000 "msedgewebview2.exe" loaded module "VERSION.DLL" at base 7ffe98f10000 "msedgewebview2.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 197712e0000 "msedgewebview2.exe" loaded module "KERNEL32.DLL" at base 7ffea3220000 "msedgewebview2.exe" loaded module "ADVAPI32.DLL" at base 7ffea3370000 "msedgewebview2.exe" loaded module "RPCRT4.DLL" at base 7ffea4ab0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 7ffea14c0000 "msedgewebview2.exe" loaded module "NTMARTA.DLL" at base 7ffea14c0000 "msedgewebview2.exe" loaded module "USER32.DLL" at base 7ffea2df0000 "msedgewebview2.exe" loaded module "NTDLL.DLL" at base 7ffea4c10000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\141.0.3537.71\MSEDGE.DLL" at base 7ffe55c40000 "msedgewebview2.exe" loaded module "KBDUS.DLL" at base 7ffe8a6c0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe9fc40000 "msedgewebview2.exe" loaded module "OLE32.DLL" at base 7ffea4190000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffea3ba0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffea3ba0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.PROFILE.PLATFORMDIAGNOSTICSANDUSAGEDATASETTINGS.DLL" at base 7ffe89110000 "msedgewebview2.exe" loaded module "POLICYMANAGER.DLL" at base 7ffe9b8f0000 "msedgewebview2.exe" loaded module "USERENV.DLL" at base 7ffea2100000 "msedgewebview2.exe" loaded module "SHLWAPI.DLL" at base 19771280000 "msedgewebview2.exe" loaded module "MDMREGISTRATION.DLL" at base 7ffe85520000 "msedgewebview2.exe" loaded module "NETAPI32.DLL" at base 7ffe97b10000 "msedgewebview2.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 19700d00000 "msedgewebview2.exe" loaded module "DWRITE.DLL" at base 7ffe90560000 "msedgewebview2.exe" loaded module "WS2_32.DLL" at base 7ffea4a00000 "msedgewebview2.exe" loaded module "SHELL32.DLL" at base 197035e0000 "msedgewebview2.exe" loaded module "COMCTL32.DLL" at base 7ffe8d6c0000 "msedgewebview2.exe" loaded module "CRYPT32.DLL" at base 7ffea2530000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 7ffe9d010000 "msedgewebview2.exe" loaded module "IPHLPAPI.DLL" at base 7ffea1630000 "msedgewebview2.exe" loaded module "GDI32.DLL" at base 7ffea3030000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffea4830000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffea4190000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.APPCORE.DLL" at base 7ffe9c730000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.DLL" at base 7ffe895f0000 "msedgewebview2.exe" loaded module "DNSAPI.DLL" at base 7ffea1670000 "msedgewebview2.exe" loaded module "API-MS-WIN-SHCORE-SCALING-L1-1-1.DLL" at base 19700d00000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.DLL" at base 7ffe92230000 "msedgewebview2.exe" loaded module "WTSAPI32.DLL" at base 7ffe9d0a0000 "msedgewebview2.exe" loaded module "CFGMGR32.DLL" at base 7ffea2be0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ffe9dd20000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-FILE-L1-2-1.DLL" at base 7ffea2690000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\141.0.3537.71\TELCLIENT.DLL" at base 7ffe77e80000 "msedgewebview2.exe" loaded module "MSCMS.DLL" at base 7ffe9c440000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\141.0.3537.71\ONEDS.DLL" at base 7ffe74280000 "msedgewebview2.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffea0130000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.DIAGNOSTICS.TELEMETRY.PLATFORMTELEMETRYCLIENT.DLL" at base 7ffe890b0000 "msedgewebview2.exe" loaded module "WINHTTP.DLL" at base 7ffe9c310000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SECURITY.AUTHENTICATION.WEB.CORE.DLL" at base 7ffe8b7f0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffea3ba0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\IERTUTIL.DLL" at base 7ffe95830000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\ONECORECOMMONPROXYSTUB.DLL" at base 7ffe8ea70000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffea24a0000 "msedgewebview2.exe" loaded module "AADWAMEXTENSION.DLL" at base 7ffe7fe90000 "msedgewebview2.exe" loaded module "IMM32.DLL" at base 7ffea4a70000 "msedgewebview2.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 7ffea2690000 "msedgewebview2.exe" loaded module "BCRYPTPRIMITIVES" at base 7ffea24a0000 "msedgewebview2.exe" loaded module "MICROSOFTACCOUNTWAMEXTENSION.DLL" at base 7ffe7ba90000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\SHCORE.DLL" at base 19700d00000 "msedgewebview2.exe" loaded module "SETUPAPI.DLL" at base 7ffea4320000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffea1270000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\INPUTHOST.DLL" at base 7ffe920a0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ffe88ee0000 "msedgewebview2.exe" loaded module "COMBASE.DLL" at base 7ffea3ba0000 "msedgewebview2.exe" loaded module "KERNELBASE.DLL" at base 7ffea2690000 "msedgewebview2.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ffea3370000 "msedgewebview2.exe" loaded module "ATLTHUNK.DLL" at base 7ffe7f250000 "msedgewebview2.exe" loaded module "OLEACC.DLL" at base 7ffe8bcd0000 "msedgewebview2.exe" loaded module "OLEAUT32.DLL" at base 7ffea40c0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\DIRECTMANIPULATION.DLL" at base 7ffe8f4f0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SECURITY.AUTHENTICATION.ONLINEID.DLL" at base 7ffe89370000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffe9b9a0000 "msedgewebview2.exe" loaded module "WLDP.DLL" at base 7ffea1bf0000 "msedgewebview2.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 19185300000 "msedgewebview2.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 1cf7ff10000 "msedgewebview2.exe" loaded module "SHELL32.DLL" at base 1cf833a0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffea1950000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffe98ef0000 "msedgewebview2.exe" loaded module "DHCPCSVC.DLL" at base 7ffe9ade0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffe99f90000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 7ffea2690000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 7ffe9dba0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 7ffe98a3000055:Taa6,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "YuDun.exe" touched "Window Property Store" (Path: "HKCU\CLSID\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\INSTANCE") "YuDun.exe" touched "UIHostNoLaunch Class" (Path: "HKCU\CLSID\{4CE576FA-83DC-4F88-951C-9D0782B4E376}\TREATAS") "msedgewebview2.exe" touched "TF_InputProcessorProfiles" (Path: "HKCU\CLSID\{33C53A50-F456-4884-B049-85FD643ECFED}") "msedgewebview2.exe" touched "TF_ThreadMgr" (Path: "HKCU\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\TREATAS") "msedgewebview2.exe" touched "TF_CategoryMgr" (Path: "HKCU\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\TREATAS") "msedgewebview2.exe" touched "TF_DisplayAttributeMgr" (Path: "HKCU\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\TREATAS") "msedgewebview2.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\TREATAS") "msedgewebview2.exe" touched "Ptype_PSFactory" (Path: "HKCU\CLSID\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}\TREATAS") "msedgewebview2.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "msedgewebview2.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS")56:T14ac,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "Microsoft.Web.WebView2.Core.dll" file has an entrypoint instructions - "jmp dword ptr [0x10002000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "WebView2Loader.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800057e1,call 0x18000601c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180005690,int3 ,int3 ,int3 ,mov qword ptr [rsp + 8], rbx,push rdi,sub rsp, 0x20,mov rax, qword ptr [rip + 0x1e40f],mov edi, 1,cmp rax, rdi,je 0x180005891,test rax, rax,jne 0x18000588c," "YuDun.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "Microsoft.Web.WebView2.WinForms.dll" file has an entrypoint instructions - "jmp dword ptr [0x10002000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"57:Td30,Process "YuDun.exe" (UID: 00000000-00003388) was launched with new environment variables: "USERDNSDOMAIN="kpEglFJy8tTlRPL"" Process "YuDun.exe" (UID: 00000000-00003388) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "msedgewebview2.exe" (UID: 00000000-00007228) was launched with new environment variables: "WEBVIEW2_DEFAULT_BACKGROUND_COLOR="ff0a0e13"" Process "msedgewebview2.exe" (UID: 00000000-00004252) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_7228_VDSAQUKBTGPZKENI", IS_EDGE_WEBVIEW="1", EDGE_BROWSER_PID="7228"" Process "msedgewebview2.exe" (UID: 00000000-00008424) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="0", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView", EDGE_METRICS_CLIENT_ID_HASH="7731833051293686081"" Process "msedgewebview2.exe" (UID: 00000000-00008976) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CURL_CA_BUNDLE, PATHEXT, DriverData, IS_EDGE_WEBVIEW, ProgramData, ProgramW6432, HOMEPATH, PROCESSOR_IDENTIFIER, ProgramFiles, PUBLIC, windir, USERDOMAIN, LOGONSERVER, OneDrive, APPDATA, NODE_PATH, CommonProgramFiles, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, HOMEDRIVE, USERPROFILE, CommonProgramFiles(x86), NUMBER_OF_PROCESSORS, EDGE_METRICS_CLIENT_ID_HASH, WEBVIEW2_DEFAULT_BACKGROUND_COLOR" Process "msedgewebview2.exe" (UID: 00000000-00002144) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="0", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView", USERNAME="WBUQqC4", USERDNSDOMAIN="kpEglFJy8tTlRPL", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", IS_EDGE_WEBVIEW="1", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\WBUQqC4", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", windir="C:\WINDOWS", USERDOMAIN="kpEglFJy8tTlRPL", LOGONSERVER="\\DESKTOP-FVVF82A", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", NODE_PATH="%PROGRAMFILES%\nodejs\node_modules", CommonProgramFiles="%PROGRAMFILES%\Common Files", OS="Windows_NT", COMPUTERNAME="kpEglFJy8tTlRPL", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", HOMEDRIVE="C:", USERPROFILE="C:\Users\WBUQqC4", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", NUMBER_OF_PROCESSORS="8", EDGE_METRICS_CLIENT_ID_HASH="7731833051293686081", WEBVIEW2_DEFAULT_BACKGROUND_COLOR="ff0a0e13""58:Taa3,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NATION") "YuDun.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "YuDun.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "YuDun.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "YuDun.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "YuDun.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "YuDun.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "YuDun.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "YuDun.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "YuDun.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "YuDun.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "YuDun.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH")59:T1051,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00007288-00000C2B-1066327597] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00007288-00000C2B-1066605438] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00007288-00000C2B-1066701191] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007288-00000C2B-1066775776] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll" [Source: 00000000-00007288-00000C2B-1067042157] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00007288-00000C2B-1067070322] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007288-00000C2B-1067134117] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00007288-00000C2B-1067212320] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll" [Source: 00000000-00007288-00000C2B-1067269249] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\908b5c1debcfb784bc25157a8ebcdfbe\System.Drawing.ni.dll" [Source: 00000000-00007288-00000C2B-1067299273] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\061200dcb8937e1b9eb2641f2ce9d2ec\System.Windows.Forms.ni.dll" [Source: 00000000-00007288-00000C2B-1067344205] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00007288-00000C2B-1067449177] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll" [Source: 00000000-00007288-00000C2B-1067570986] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll" [Source: 00000000-00007288-00000C2B-1067594199] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll" [Source: 00000000-00007288-00000C2B-1067638541] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00007288-00000C2B-1067880516] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll" [Source: 00000000-00007288-00000C2B-1068283606] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007288-00000C2B-1068395361] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007288-00000C2B-1068850484] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00003388-00000C2B-1073207351] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00003388-00000C2B-1123085340] Observed system executable string:"%WINDIR%\system32\edputil.dll" [Source: 00000000-00003388-00000C2B-1123087148] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00003388-00000C2B-1123183597] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00003388-00000C2B-1123692708] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00003388-00000C2B-1123754957]5a:Td2e,Spawned process "YuDun.exe" (UID: 00000000-00003388) Spawned process "msedgewebview2.exe" with commandline "--embedded-browser-webview=1 --webview-exe-name=YuDun.exe --webv ..." (UID: 00000000-00007228) Spawned process "msedgewebview2.exe" with commandline "--type=crashpad-handler --user-data-dir=%LOCALAPPDATA%\\YuDunPCM ..." (UID: 00000000-00004252) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="C:\\Users\\WB ..." (UID: 00000000-00008424), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00008036), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00008976), Spawned process "msedgewebview2.exe" with commandline "--type=renderer --noerrdialogs --user-data-dir="C:\\Users\\WBUQq ..." (UID: 00000000-00005148) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="C:\\Users\\WB ..." (UID: 00000000-00002144), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00000444), Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="C:\\Users\\WB ..." (UID: 00000000-00008572) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00002260) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="C:\\Users\\WB ..." (UID: 00000000-00002368), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00006740), Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="C:\\Users\\WB ..." (UID: 00000000-00008060) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00001840) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="C:\\Users\\WB ..." (UID: 00000000-00000456), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00002740), Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="C:\\Users\\WB ..." (UID: 00000000-00004560) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00002420) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="C:\\Users\\WB ..." (UID: 00000000-00008136), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007232), Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="C:\\Users\\WB ..." (UID: 00000000-00004996) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00008844)5b:Td2e,Spawned process "YuDun.exe" (UID: 00000000-00003388) Spawned process "msedgewebview2.exe" with commandline "--embedded-browser-webview=1 --webview-exe-name=YuDun.exe --webv ..." (UID: 00000000-00007228) Spawned process "msedgewebview2.exe" with commandline "--type=crashpad-handler --user-data-dir=%LOCALAPPDATA%\\YuDunPCM ..." (UID: 00000000-00004252) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="C:\\Users\\WB ..." (UID: 00000000-00008424), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00008036), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00008976), Spawned process "msedgewebview2.exe" with commandline "--type=renderer --noerrdialogs --user-data-dir="C:\\Users\\WBUQq ..." (UID: 00000000-00005148) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="C:\\Users\\WB ..." (UID: 00000000-00002144), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00000444), Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="C:\\Users\\WB ..." (UID: 00000000-00008572) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00002260) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="C:\\Users\\WB ..." (UID: 00000000-00002368), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00006740), Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="C:\\Users\\WB ..." (UID: 00000000-00008060) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00001840) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="C:\\Users\\WB ..." (UID: 00000000-00000456), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00002740), Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="C:\\Users\\WB ..." (UID: 00000000-00004560) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00002420) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="C:\\Users\\WB ..." (UID: 00000000-00008136), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007232), Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="C:\\Users\\WB ..." (UID: 00000000-00004996) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00008844)5c:T52b9,"Microsoft.Web.WebView2.Core.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%LOCALAPPDATA%\YuDunPCManager\Microsoft.Web.WebView2.Core.dll]- [targetUID: 00000000-00007288] "WebView2Loader.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2Loader.dll]- [targetUID: 00000000-00007288] "YuDun.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%LOCALAPPDATA%\YuDunPCManager\YuDun.exe]- [targetUID: 00000000-00007288] "Microsoft.Web.WebView2.WinForms.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%LOCALAPPDATA%\YuDunPCManager\Microsoft.Web.WebView2.WinForms.dll]- [targetUID: 00000000-00007288] "275839c1-5baa-4a4d-91e2-51ac87e179d5.dmp" has type "Mini DuMP crash report 16 streams Sat Oct 24 12:35:11 2026 0x61965 type"- [targetUID: N/A] "topTraffic_170540185939602997400506234197983529371" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371]- [targetUID: 00000000-00007228] "topTraffic_638004170464094982" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\SmartScreen\RemoteData\topTraffic_638004170464094982]- [targetUID: 00000000-00007228] "lucide.min.js" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\app\vendor\lucide.min.js]- [targetUID: 00000000-00007288] "data_1" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\GPUCache\data_1]- [targetUID: 00000000-00007228] "index" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\GPUCache\index]- [targetUID: 00000000-00007228] "index" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\ShaderCache\index]- [targetUID: 00000000-00007228] "index" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\DawnWebGPUCache\index]- [targetUID: 00000000-00007228] "index" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\DawnGraphiteCache\index]- [targetUID: 00000000-00007228] "Web Data" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 3 database pages 105 cookie 0x3f schema 4 UTF-8 version-valid-for 3"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Web Data]- [targetUID: 00000000-00007228] "History" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 1 database pages 50 cookie 0x2a schema 4 UTF-8 version-valid-for 1"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\History]- [targetUID: 00000000-00007228] "app.js" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\app\js\app.js]- [targetUID: 00000000-00007288] "edgeSettings_2.0-a82cb2897a8bf9445d68dcc2be05af89ad4b2fda1fddb2952693be7cd5353ad3" has type "JSON text data"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\SmartScreen\RemoteData\edgeSettings_2.0-a82cb2897a8bf9445d68dcc2be05af89ad4b2fda1fddb2952693be7cd5353ad3]- [targetUID: 00000000-00007228] "db.json" has type "JSON text data"- Location: [%LOCALAPPDATA%\YuDunPCManager\sigs\db.json]- [targetUID: 00000000-00007288] "pay-qr.png" has type "PNG image data 628 x 628 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\YuDunPCManager\app\pay-qr.png]- [targetUID: 00000000-00007288] "styles.css" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\app\css\styles.css]- [targetUID: 00000000-00007288] "db" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 2 database pages 11 cookie 0x8 schema 4 UTF-8 version-valid-for 2"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Shared Dictionary\db]- [targetUID: 00000000-00008036] "Login Data" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 21 cookie 0xc schema 4 UTF-8 version-valid-for 1"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Login Data]- [targetUID: 00000000-00007228] "Reporting and NEL" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 4 database pages 9 cookie 0x4 schema 4 UTF-8 version-valid-for 4"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\Reporting and NEL]- [targetUID: 00000000-00007228] "Trust Tokens" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 2 database pages 9 cookie 0x5 schema 4 UTF-8 version-valid-for 2"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\Trust Tokens]- [targetUID: 00000000-00007228] "Vpn Tokens" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 2 database pages 7 cookie 0x4 schema 4 UTF-8 version-valid-for 2"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Vpn Tokens]- [targetUID: 00000000-00007228] "engine.js" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\app\js\engine.js]- [targetUID: 00000000-00007288] "sslkey.txt" has type "Unknown"- Location: [%TEMP%\sslkey.txt]- [targetUID: 00000000-00007228] "signatures.js" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\app\js\signatures.js]- [targetUID: 00000000-00007288] "ServerCertificate" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 1 database pages 5 cookie 0x2 schema 4 UTF-8 version-valid-for 1"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\ServerCertificate]- [targetUID: 00000000-00007228] "Cookies" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 7 database pages 5 cookie 0x5 schema 4 UTF-8 version-valid-for 7"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\Cookies]- [targetUID: 00000000-00007228] "Favicons" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 10 cookie 0x8 schema 4 UTF-8 version-valid-for 1"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Favicons]- [targetUID: 00000000-00007228] "data_3" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\ShaderCache\data_3]- [targetUID: 00000000-00007228] "data_2" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\GPUCache\data_2]- [targetUID: 00000000-00007228] "data_0" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\ShaderCache\data_0]- [targetUID: 00000000-00007228] "ec7517c9-5299-49e8-8897-54c6396d2518.tmp" has type "JSON text data"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\ec7517c9-5299-49e8-8897-54c6396d2518.tmp]- [targetUID: 00000000-00007228] "4ad1f0ac-a246-4d2d-b101-9cc296d0f565.tmp" has type "JSON text data"- [targetUID: N/A] "0292e61e-2882-424d-98c5-a8a8dc51c155.tmp" has type "JSON text data"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\0292e61e-2882-424d-98c5-a8a8dc51c155.tmp]- [targetUID: 00000000-00007228] "1d49a363-8f97-441d-a125-fa622b45d613.tmp" has type "JSON text data"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\1d49a363-8f97-441d-a125-fa622b45d613.tmp]- [targetUID: 00000000-00007228] "0cbc4388-6ade-45e2-9664-9d5af71d11b8.tmp" has type "JSON text data"- [targetUID: N/A] "bdca1127-9867-4993-82de-a5b373988690.tmp" has type "JSON text data"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\bdca1127-9867-4993-82de-a5b373988690.tmp]- [targetUID: 00000000-00007228] "cloud.js" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\app\js\cloud.js]- [targetUID: 00000000-00007288] "SharedStorage" has type "SQLite 3.x database last written using SQLite version 3050004 writer version 2 read version 2 file counter 1 database pages 1 cookie 0 schema 0 unknown 0 encoding version-valid-for 1"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\SharedStorage]- [targetUID: 00000000-00007228] "b3a3f8d4-0293-4514-8931-0a9263b12cdd.tmp" has type "JSON text data"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\b3a3f8d4-0293-4514-8931-0a9263b12cdd.tmp]- [targetUID: 00000000-00007228] "edgeSettings_2.0-0" has type "JSON text data"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\SmartScreen\RemoteData\edgeSettings_2.0-0]- [targetUID: 00000000-00007228] "index.html" has type "HTML document Unicode text UTF-8 text with very long lines (330)"- Location: [%LOCALAPPDATA%\YuDunPCManager\app\index.html]- [targetUID: 00000000-00007228] "e3d6ce46-28ea-4ce8-b73a-219e839e6dbf.tmp" has type "JSON text data"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\e3d6ce46-28ea-4ce8-b73a-219e839e6dbf.tmp]- [targetUID: 00000000-00007228] "a5f4f9fc-9383-4ac2-bff4-2657ea5d9f18.tmp" has type "JSON text data"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\a5f4f9fc-9383-4ac2-bff4-2657ea5d9f18.tmp]- [targetUID: 00000000-00007228] "watson_metadata" has type "Unknown"- [targetUID: N/A] "debug.log" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\debug.log]- [targetUID: 00000000-00003388] "SharedStorage-journal" has type "SQLite Rollback Journal"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\SharedStorage-journal]- [targetUID: 00000000-00007228] "000003.log" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\shared_proto_db\metadata\000003.log]- [targetUID: 00000000-00007228] "LOG" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Site Characteristics Database\LOG]- [targetUID: 00000000-00007228] "LOG" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\shared_proto_db\metadata\LOG]- [targetUID: 00000000-00007228] "LOG" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension Scripts\LOG]- [targetUID: 00000000-00007228] "LOG" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Sync Data\LevelDB\LOG]- [targetUID: 00000000-00007228] "LOG" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension State\LOG]- [targetUID: 00000000-00007228] "LOG" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\shared_proto_db\LOG]- [targetUID: 00000000-00007228] "LOG" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension Rules\LOG]- [targetUID: 00000000-00007228] "settings.dat" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Crashpad\settings.dat]- [targetUID: 00000000-00007228] "README" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\README]- [targetUID: 00000000-00007228] "metadata" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Crashpad\metadata]- [targetUID: 00000000-00007228] "000003.log" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension State\000003.log]- [targetUID: 00000000-00007228] "337ef49e-975b-45cf-a5ff-96fec292d013.tmp" has type "JSON text data"- [targetUID: N/A] "Variations" has type "JSON text data"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Variations]- [targetUID: 00000000-00007228] "edgeSettings" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\SmartScreen\RemoteData\edgeSettings]- [targetUID: 00000000-00007228] "68868594-38c5-4ea0-8639-b69a52eba378.tmp" has type "JSON text data"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\68868594-38c5-4ea0-8639-b69a52eba378.tmp]- [targetUID: 00000000-00008036] "temp-index" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Code Cache\js\index-dir\temp-index]- [targetUID: 00000000-00007228] "temp-index" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Shared Dictionary\cache\index-dir\temp-index]- [targetUID: 00000000-00007228] "temp-index" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Code Cache\wasm\index-dir\temp-index]- [targetUID: 00000000-00007228] "customSettings" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\SmartScreen\RemoteData\customSettings]- [targetUID: 00000000-00007228] "000003.log" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Sync Data\LevelDB\000003.log]- [targetUID: 00000000-00007228] "MANIFEST-000001" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001]- [targetUID: 00000000-00007228] "000003.log" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Site Characteristics Database\000003.log]- [targetUID: 00000000-00007228] "b80781d5-cc21-4429-b220-b58cdb1953fe.tmp" has type "JSON text data"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\b80781d5-cc21-4429-b220-b58cdb1953fe.tmp]- [targetUID: 00000000-00008036] "000003.log" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension Scripts\000003.log]- [targetUID: 00000000-00007228] "customSettings_F95BA787499AB4FA9EFFF472CE383A14" has type "JSON text data"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14]- [targetUID: 00000000-00007228] "uriCache_" has type "JSON text data"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\SmartScreen\local\uriCache_]- [targetUID: 00000000-00007228] "topTraffic" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\SmartScreen\RemoteData\topTraffic]- [targetUID: 00000000-00007228] "index" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Code Cache\wasm\index]- [targetUID: 00000000-00007228] "throttle_store.dat" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Crashpad\throttle_store.dat]- [targetUID: 00000000-00007228] "000003.log" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\shared_proto_db\000003.log]- [targetUID: 00000000-00007228] "000001.dbtmp" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Site Characteristics Database\000001.dbtmp]- [targetUID: 00000000-00007228] "downloadCache" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\SmartScreen\local\downloadCache]- [targetUID: 00000000-00007228] "5ab03da0-c3b0-4b33-9778-3aabd9bb1325.tmp" has type "JSON text data"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\component_crx_cache\5ab03da0-c3b0-4b33-9778-3aabd9bb1325.tmp]- [targetUID: 00000000-00007228] "Last Version" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Last Version]- [targetUID: 00000000-00007228] "uriCache" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\SmartScreen\local\uriCache]- [targetUID: 00000000-00007228] "d0cb9327-0846-414c-929d-6e6375ac4496.tmp" has type "JSON text data"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\d0cb9327-0846-414c-929d-6e6375ac4496.tmp]- [targetUID: 00000000-00008036] "data_1" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\DawnGraphiteCache\data_1]- [targetUID: 00000000-00007228] "data_1" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\DawnWebGPUCache\data_1]- [targetUID: 00000000-00007228] "data_1" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\ShaderCache\data_1]- [targetUID: 00000000-00007228] "Login Data For Account" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 21 cookie 0xc schema 4 UTF-8 version-valid-for 1"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Login Data For Account]- [targetUID: 00000000-00007228] "Safe Browsing Cookies" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 7 database pages 5 cookie 0x5 schema 4 UTF-8 version-valid-for 7"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies]- [targetUID: 00000000-00007228] "data_3" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\DawnGraphiteCache\data_3]- [targetUID: 00000000-00007228] "data_2" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\DawnGraphiteCache\data_2]- [targetUID: 00000000-00007228] "data_2" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\DawnWebGPUCache\data_2]- [targetUID: 00000000-00007228] "data_3" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\GPUCache\data_3]- [targetUID: 00000000-00007228] "data_2" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\ShaderCache\data_2]- [targetUID: 00000000-00007228] "data_3" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\DawnWebGPUCache\data_3]- [targetUID: 00000000-00007228] "data_0" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\DawnGraphiteCache\data_0]- [targetUID: 00000000-00007228] "data_0" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\DawnWebGPUCache\data_0]- [targetUID: 00000000-00007228] "data_0" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\GPUCache\data_0]- [targetUID: 00000000-00007228] "MANIFEST-000001" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension Scripts\MANIFEST-000001]- [targetUID: 00000000-00007228] "MANIFEST-000001" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001]- [targetUID: 00000000-00007228] "MANIFEST-000001" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001]- [targetUID: 00000000-00007228] "MANIFEST-000001" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\shared_proto_db\MANIFEST-000001]- [targetUID: 00000000-00007228] "MANIFEST-000001" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension State\MANIFEST-000001]- [targetUID: 00000000-00007228] "MANIFEST-000001" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001]- [targetUID: 00000000-00007228] "000003.log" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension Rules\000003.log]- [targetUID: 00000000-00007228] "downloadCache_" has type "JSON text data"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\SmartScreen\local\downloadCache_]- [targetUID: 00000000-00007228] "index" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Code Cache\js\index]- [targetUID: 00000000-00007228] "index" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Shared Dictionary\cache\index]- [targetUID: 00000000-00007228] "000001.dbtmp" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp]- [targetUID: 00000000-00007228] "000001.dbtmp" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension Rules\000001.dbtmp]- [targetUID: 00000000-00007228] "000001.dbtmp" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp]- [targetUID: 00000000-00007228] "000001.dbtmp" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\shared_proto_db\000001.dbtmp]- [targetUID: 00000000-00007228] "000001.dbtmp" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension Scripts\000001.dbtmp]- [targetUID: 00000000-00007228] "000001.dbtmp" has type "Unknown"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Extension State\000001.dbtmp]- [targetUID: 00000000-00007228] "72d93f09-4375-463b-9bff-d9fc6421055c.tmp" has type "JSON text data"- Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\72d93f09-4375-463b-9bff-d9fc6421055c.tmp]- [targetUID: 00000000-00008036]5d:T964,"ec7517c9-5299-49e8-8897-54c6396d2518.tmp" has type "JSON text data" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\ec7517c9-5299-49e8-8897-54c6396d2518.tmp] "4ad1f0ac-a246-4d2d-b101-9cc296d0f565.tmp" has type "JSON text data" "0292e61e-2882-424d-98c5-a8a8dc51c155.tmp" has type "JSON text data" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\0292e61e-2882-424d-98c5-a8a8dc51c155.tmp] "1d49a363-8f97-441d-a125-fa622b45d613.tmp" has type "JSON text data" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\1d49a363-8f97-441d-a125-fa622b45d613.tmp] "0cbc4388-6ade-45e2-9664-9d5af71d11b8.tmp" has type "JSON text data" "bdca1127-9867-4993-82de-a5b373988690.tmp" has type "JSON text data" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\bdca1127-9867-4993-82de-a5b373988690.tmp] "b3a3f8d4-0293-4514-8931-0a9263b12cdd.tmp" has type "JSON text data" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\b3a3f8d4-0293-4514-8931-0a9263b12cdd.tmp] "e3d6ce46-28ea-4ce8-b73a-219e839e6dbf.tmp" has type "JSON text data" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\e3d6ce46-28ea-4ce8-b73a-219e839e6dbf.tmp] "a5f4f9fc-9383-4ac2-bff4-2657ea5d9f18.tmp" has type "JSON text data" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\a5f4f9fc-9383-4ac2-bff4-2657ea5d9f18.tmp] "337ef49e-975b-45cf-a5ff-96fec292d013.tmp" has type "JSON text data" "68868594-38c5-4ea0-8639-b69a52eba378.tmp" has type "JSON text data" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\68868594-38c5-4ea0-8639-b69a52eba378.tmp] "b80781d5-cc21-4429-b220-b58cdb1953fe.tmp" has type "JSON text data" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\b80781d5-cc21-4429-b220-b58cdb1953fe.tmp] "5ab03da0-c3b0-4b33-9778-3aabd9bb1325.tmp" has type "JSON text data" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\component_crx_cache\5ab03da0-c3b0-4b33-9778-3aabd9bb1325.tmp] "d0cb9327-0846-414c-929d-6e6375ac4496.tmp" has type "JSON text data" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\d0cb9327-0846-414c-929d-6e6375ac4496.tmp] "72d93f09-4375-463b-9bff-d9fc6421055c.tmp" has type "JSON text data" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\72d93f09-4375-463b-9bff-d9fc6421055c.tmp]5e:T933,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CCG"; Key: ""; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\AD6484135F0EDF919F0E145D417B2A21F08B8EE3DD8DAE2C6EB7259F36630B6C.EXE"; Key: ""; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: ""; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-50D00E000000}\"; Key: ""; Value: "")5f:T14da,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: "FINALIZERACTIVITYBYPASS"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-50D00E000000}"; Key: "DATA"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-50D00E000000}"; Key: "GENERATION"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINBROKERFORMEDIUMILCONTAINER"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEONHOSTFLAGS"; Value: "")60:T629,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll.aux" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.windows.forms\061200dcb8937e1b9eb2641f2ce9d2ec\system.windows.forms.ni.dll.aux" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\fe3c9cf707273488c6c658d52d624640\system.ni.dll.aux" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.drawing\908b5c1debcfb784bc25157a8ebcdfbe\system.drawing.ni.dll.aux" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.configuration\24206316825bb75ebfbdd31895df2f1f\system.configuration.ni.dll.aux" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\21ff4ba4607b18a9b179ab90fd3b0bc1\system.core.ni.dll.aux" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xml\76ff225c5a523f0be2364b0fc02bf7f9\system.xml.ni.dll.aux"61:T587,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to touch file "C:\Windows\System32\mscoree.dll" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to touch file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to touch file "C:\WINDOWS\SYSTEM32\apphelp.dll" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to touch file "C:\ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to touch file "C:\windows\temp\VxSSL64.dll" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to touch file "C:\FLTLIB.DLL"62:T835,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\FLTLIB.DLL" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\MSVCP140.dll" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System\808887ebadf1a37835b907c866cede3c\System.ni.dll" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\808887ebadf1a37835b907c866cede3c\System.ni.dll"63:T700,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.local" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe.config" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\DomainShieldSetup" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.INI" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PublisherPolicy.tme" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\app" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\app\css"64:T4c6,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" writes file "c:\users\%osuser%\appdata\local\yudunpcmanager\microsoft.web.webview2.core.dll" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" writes file "c:\users\%osuser%\appdata\local\yudunpcmanager\microsoft.web.webview2.winforms.dll" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" writes file "c:\users\%osuser%\appdata\local\yudunpcmanager\webview2loader.dll" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" writes file "c:\users\%osuser%\appdata\local\yudunpcmanager\yudun.exe" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" writes file "c:\users\%osuser%\appdata\local\yudunpcmanager\app\index.html" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" writes file "c:\users\%osuser%\appdata\local\yudunpcmanager\app\pay-qr.png" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" writes file "c:\users\%osuser%\appdata\local\yudunpcmanager\app\css\styles.css" "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" writes file "c:\users\%osuser%\appdata\local\yudunpcmanager\app\js\app.js"65:T4d1,"YuDun.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\debug.log" "YuDun.exe" writes a file "%LOCALAPPDATA%\YuDunPCManager\debug.log" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\Site Characteristics Database\000001.dbtmp" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\Sync Data\LevelDB\000003.log" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\Site Characteristics Database\000003.log" "msedgewebview2.exe" writes a file "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Crashpad\throttle_store.dat" "msedgewebview2.exe" writes a file "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Crashpad\settings.dat" "msedgewebview2.exe" writes a file "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Site Characteristics Database\000001.dbtmp" "msedgewebview2.exe" writes a file "%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp"66:Td03,Found reference to API "WSASendTo" (Indicator: "WSASend"; Source: "00000000-00008036-00000C2C-1137318323") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00008036-00000C2C-1137318904") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00008036-00000C2C-1137453699") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "edgeInternetConnectivityPrivate" (Indicator: "InternetConnect"; Source: "00000000-00005148.00000000.189261.0004C000.00000004.mdmp, 00000000-00005148.00000000.189261.00120000.00000004.mdmp, 00000000-00005148.00000000.189261.005EC000.00000004.mdmp") Found reference to API "permission:edgeInternetConnectivityPrivate" (Indicator: "InternetConnect"; Source: "00000000-00005148.00000000.189261.0056C000.00000004.mdmp")67:Ta39,Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetNamedPipeClientProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetNamedPipeServerProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "ImpersonateNamedPipeClient" (Indicator: "ImpersonateNamedPipeClient"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "::GetNamedPipeClientProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "ImpersonateNamedPipeClient" (Indicator: "ImpersonateNamedPipeClient"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "::GetNamedPipeClientProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")68:T5be,Observed Namespace "System.Net.Mail.MailMessage" and MemberReference ".ctor" in "YuDun.exe" Observed Namespace "System.Net.Mail.MailAddress" and MemberReference ".ctor" in "YuDun.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_From" in "YuDun.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "get_To" in "YuDun.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_Subject" in "YuDun.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_SubjectEncoding" in "YuDun.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_Body" in "YuDun.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_IsBodyHtml" in "YuDun.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_BodyEncoding" in "YuDun.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference ".ctor" in "YuDun.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_EnableSsl" in "YuDun.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_Timeout" in "YuDun.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_DeliveryMethod" in "YuDun.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_Credentials" in "YuDun.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "Send" in "YuDun.exe"69:Tebe,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")6a:T3eb9,"DomainShield KNOWN_HASHES EICAR * HEURISTIC_RULES / MULTI_RULES * (function (global) { 'use strict'; // EICAR var EICAR_STRING = 'X5O!P%@AP[4\\PZX54(P^)7CC)7}' + '$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*'; // SHA-256SIG-0001 EICAR var KNOWN_HASHES = [ { id: 'SIG-0001', sha256: '275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f', name: 'EICAR-Test-File', family: '', severity: 'malicious' }, { id: 'SIG-0002', sha256: '3395856ce81f2b7382dee72602f798b642f14140d1e1b0a1d7e8f0b5c9a2d4e7', name: 'Trojan.Win32.Generic.a', family: '', severity: 'malicious' }, { id: 'SIG-0003', sha256: '9f2c1e4b8a7d6f0c3b5e9a1d7c4f2b8e6a0d3c5f7b9e1a4d2c6f8b0e3a5d7c9f', name: 'Worm.Win32.AutoRun.b', family: '', severity: 'malicious' }, { id: 'SIG-0004', sha256: 'a1b2c3d4e5f60718293a4b5c6d7e8f9012a3b4c5d6e7f8091a2b3c4d5e6f7081', name: 'Ransom.Win32.Locky.c', family: '', severity: 'malicious' }, { id: 'SIG-0005', sha256: 'd4c3b2a1f0e9d8c7b6a5948372615049382716f5e4d3c2b1a09f8e7d6c5b4a39', name: 'Backdoor.Win32.Agent.d', family: '', severity: 'malicious' }, { id: 'SIG-0006', sha256: '0e1d2c3b4a59687776859403122130fedcba9876543210fedcba9876543210ff', name: 'Spyware.Win32.KeyLogger.e', family: '', severity: 'malicious' }, { id: 'SIG-0007', sha256: '7c6b5a4938271605f4e3d2c1b0a998877665544332211000ffeeddccbbaa9988', name: 'Trojan-Downloader.JS.Nemucod.f', family: '', severity: 'malicious' }, { id: 'SIG-0008', sha256: 'f1e2d3c4b5a69788796a5b4c3d2e1f00112233445566778899aabbccddeeff01', name: 'HackTool.Win32.Mimikatz.g', family: '', severity: 'malicious' }, { id: 'SIG-0009', sha256: '2b3c4d5e6f7081920a1b2c3d4e5f60718293a4b5c6d7e8f9012a3b4c5d6e7f89', name: 'Trojan.MSIL.Injector.h', family: '', severity: 'malicious' }, { id: 'SIG-0010', sha256: '5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f8091a2b3c4d', name: 'Rootkit.Win32.TDSS.i', family: 'Rootkit', severity: 'malicious' }, { id: 'SIG-0011', sha256: '8091a2b3c4d5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f', name: 'Adware.Win32.MultiPlug.j', family: '', severity: 'suspicious' }, { id: 'SIG-0012', sha256: 'c4d5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f8091a2b3', name: 'RiskWare.Win32.CoinMiner.k', family: '', severity: 'suspicious' } ]; // var TRUST_HASHES = [ { id: 'TRUST-0001', sha256: 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff', name: 'Microsoft-Signed-Demo' } ]; // magic bytes var MAGIC_SIGNATURES = [ { type: 'PE ', kind: 'exe', offset: 0, bytes: [0x4D, 0x5A], exts: ['exe', 'dll', 'sys', 'scr', 'com'] }, { type: 'ELF ', kind: 'elf', offset: 0, bytes: [0x7F, 0x45, 0x4C, 0x46], exts: ['', 'so', 'elf', 'bin'] }, { type: 'ZIP/Office ', kind: 'zip', offset: 0, bytes: [0x50, 0x4B, 0x03, 0x04], exts: ['zip', 'jar', 'apk', 'docx', 'xlsx', 'pptx'] }, { type: 'RAR ', kind: 'rar', offset: 0, bytes: [0x52, 0x61, 0x72, 0x21], exts: ['rar'] }, { type: 'PDF ', kind: 'pdf', offset: 0, bytes: [0x25, 0x50, 0x44, 0x46], exts: ['pdf'] }, { type: 'GIF ', kind: 'image', offset: 0, bytes: [0x47, 0x49, 0x46, 0x38], exts: ['gif'] }, { type: 'PNG ', kind: 'image', offset: 0, bytes: [0x89, 0x50, 0x4E, 0x47], exts: ['png'] }, { type: 'JPEG ', kind: 'image', offset: 0, bytes: [0xFF, 0xD8, 0xFF], exts: ['jpg', 'jpeg'] }, { type: 'GZIP ', kind: 'gz', offset: 0, bytes: [0x1F, 0x8B], exts: ['gz', 'tgz'] }, { type: '7z ', kind: '7z', offset: 0, bytes: [0x37, 0x7A, 0xBC, 0xAF], exts: ['7z'] }, { type: 'MS-DOS/OLE ', kind: 'ole', offset: 0, bytes: [0xD0, 0xCF, 0x11, 0xE0], exts: ['doc', 'xls', 'ppt', 'msi'] } ]; // severity: low/medium/highweight var HEURISTIC_RULES = [ { id: 'H-01', name: 'PowerShell ', category: '', severity: 'high', weight: 55, desc: ' + Base64 PowerShell', pattern: /powershell(\.exe)?[^\n]*(-enc\b|-encodedcommand|-nop\b|-w\s+hidden|-windowstyle\s+hidden)/i }, { id: 'H-02', name: '', category: '', severity: 'high', weight: 55, desc: 'IEX/Invoke-Expression ', pattern: /(iex|invoke-expression)\s*$?\s*(new-object\s+net\.webclient|downloadstring|invoke-webrequest|iwr)/i }, { id: 'H-03', name: ' API', category: 'PE', severity: 'high', weight: 50, desc: 'VirtualAlloc/WriteProcessMemory/CreateRemoteThread ', pattern: /(virtualalloc(ex)?|writeprocessmemory|createremotethread|ntunmapviewofsection|queueuserapc)/i }, { id: 'H-04', name: '', category: '', severity: 'high', weight: 60, desc: '', pattern: /(your files (have been|are) encrypted||pay .{0,20}bitcoin|.{0,10}()|\.locked\b|decrypt.{0,10}key)/i }, { id: 'H-05', name: 'WScript.Shell ', category: '', severity: 'medium', weight: 35, desc: ' WScript.Shell ', pattern: /createobject\(\s*["']wscript\.shell["']\s*$|new\s+activexobject\(\s*["']wscript\.shell["']/i }, { id: 'H-06', name: '', category: '', severity: 'medium', weight: 30, desc: 'eval/Function/exec ', pattern: /\beval\s*\(|new\s+function\s*\(|\bexec\s*\(|setattr.{0,10}exec/i }, { id: 'H-07', name: 'Base64 ', category: '', severity: 'medium', weight: 30, desc: 'atob/FromBase64String ', pattern: /(atob\s*\(|frombase64string\s*\(|base64_decode\s*\(|::frombase64string)/i } { id: 'H-08' name: '' category: '' severity: 'medium' weight: 35 desc: 'URLDownloadToFile/certutil/bitsadmin ' pattern: /(urldownloadtofile|certutil\s+.*-urlcache|bitsadmin\s+\/transfer|curl\s+-o\s|wget\s+http|start-bitstransfer)/i } { id: 'H-09' name: '' category: '' severity: 'medium' weight: 32 desc: ' Run ' pattern: /(currentversion\\run|reg\s+add\s+.*\\run|hkcu\\software\\microsoft\\windows\\currentversion\\run)/i } { id: 'H-10' name: 'Office ' category: '' severity: 'medium' weight: 35 desc: 'AutoOpen/Document_Open ' pattern: /(auto_?open|autoexec|document_open|workbook_open)\b/i } { id: 'H-11' name: 'cmd ' category: '' severity: 'low' weight: 18 desc: ' cmd /c ' pattern: /cmd(\.exe)?\s+\/c\s+/i } { id: 'H-12' name: 'Shellcode ' category: 'PE' severity: 'high' weight: 45 desc: ' NOP / shellcode ' pattern: /(\\x90){4 }|(0x90,\s*){4 }|\\xfc\\xe8|%u9090%u9090/i } { id: 'H-13' name: '' category: '' severity: 'low' weight: 20 desc: '' pattern: /\.(exe|scr|com|pif|bat|cmd|vbs|vbe|js|jse|wsf|hta|ps1|jar|msi)$/i useName: true } { id: 'H-14' name: '' category: '' severity: 'high' weight: 50 desc: ' photo.jpg.exe' pattern: /\.(jpe?g|png|gif|bmp|pdf|docx?|xlsx?|pptx?|txt|mp[34]|zip|rar)\.(exe|scr|com|pif|bat|cmd|vbs|js|jar|msi|hta)$/i useName: true } { id: 'H-15' name: '' category: '' severity: 'high' weight: 45 desc: ' Defender//UAC' pattern: /(set-mppreference\s+-disablerealtimemonitoring|netsh\s+advfirewall\s+set\s+.*off|disableantispyware|reg\s+add.*\\system.*enablelua.*\/d\s+0)/i } { id: 'H-16' name: '' category: '' severity: 'high' weight: 55 desc: '' pattern: /(vssadmin\s+delete\s+shadows|wmic\s+shadowcopy\s+delete|bcdedit\s+.*recoveryenabled\s+no|wbadmin\s+delete\s+catalog)/i } { id: 'H-17' name: '' category: '' severity: 'medium' weight: 30 desc: ' schtasks ' pattern: /schtasks\s+\/create\b|new-scheduledtask\b/i } { id: 'H-18' name: '' category: '' severity: 'high' weight: 48 desc: 'Mimikatz/LSASS ' pattern: /(sekurlsa::logonpasswords|mimikatz|lsass\.dmp|comsvcs\.dll,\s*minidump|invoke-mimikatz)/i } { id: 'H-19' name: '' category: 'PE' severity: 'high' weight: 42 desc: '.NET ' pattern: /\[reflection\.assembly\]::load|system\.reflection\.assembly.*::load|loadlibrary\s*$|getprocaddress\s*\(/i }, { id: 'H-20', name: '', category: '', severity: 'medium', weight: 28, desc: '', pattern: /(\[char\]\d+\s*\+\s*){4 }|(chr\(\d+$\s*[&+]\s*){4 }|-join\s*$/i }, { id: 'H-21', name: '', category: '', severity: 'low', weight: 16, desc: 'attrib +h +s ', pattern: /attrib\s+\+[hs]\s*\+?[hs]?/i }, { id: 'H-22', name: '', category: '', severity: 'low', weight: 14, desc: ' IP: URL', pattern: /https?:\/\/(\d{1,3}\.){3}\d{1 3}(:\d{2,5})?|(\d{1,3}\.){3}\d{1 3}:\d{2 5}/i } { id: 'H-23' name: 'UPX ' category: 'PE' severity: 'medium' weight: 26 desc: ' UPX ' pattern: /UPX[0-9!]|\.aspack|\.themida|MPRESS[0-9]/ } { id: 'H-24' name: '' category: '' severity: 'medium' weight: 30 desc: '' pattern: /copy\s+.*%~?f?0.*(startup|removable|\\\\\?\$|autorun\.inf/i } { id: 'H-33' name: '' category: '' severity: 'medium' weight: 35 desc: '' pattern: /\.(locked|encrypted|crypt|cerber|locky|wallet|onion|komodo|aura)$/i useName: true } { id: 'H-34' name: '' category: '' severity: 'medium' weight: 32 desc: ' dropper ' pattern: /(%appdata%|%temp%|%programdata%|appdata\\roaming|programdata\\)[^\n]{0 60}\.(exe|scr|vbs|vbe|js|bat|cmd|ps1)\b/i } { id: 'H-35' name: '' category: '' severity: 'high' weight: 40 desc: ' Shell/' pattern: /(auto_?open|document_open|workbook_open)[\s\S]{0 600}(shell\s*\(|wscript\.shell|https?:\/\/|urldownload|xmlhttp)/i } { id: 'H-36' name: '' category: 'PE' severity: 'high' weight: 42 desc: 'NT API ' pattern: /(\bntcreate\w*|\bzw\w{3,}|queueuserapc|setwindowshookex|ntmapviewofsection|ntunmapviewofsection)/i } ]; // YARA minHits var MULTI_RULES = [ { id: 'M-01' name: '' category: '' severity: 'high' weight: 70 desc: '' minHits: 2 patterns: [/aes|rijndael|cryptencrypt|rsa\.create/i /vssadmin\s+delete|shadowcopy\s+delete/i /ransom||bitcoin|decrypt/i /\.(locked|encrypted|crypt)\b/i] } { id: 'M-02' name: '' category: '' severity: 'high' weight: 65 desc: '' minHits: 2 patterns: [/downloadstring|invoke-webrequest|net\.webclient/i /iex|invoke-expression|::load/i /-w\s+hidden|-windowstyle\s+hidden|-nop/i] } { id: 'M-03' name: '' category: '' severity: 'high' weight: 60 desc: '' minHits: 2 patterns: [/setwindowshookex|getasynckeystate|getkeyboardstate/i /gethostbyname|send\s*\(|smtp|ftp\.upload/i, /(clipboard|keylog|logfile)/i] } { id: 'M-04' name: '' category: '' severity: 'high' weight: 58 desc: 'Office + Shell ' minHits: 2 patterns: [/(auto_?open|document_open|workbook_open)/i /shell\s*\(|wscript\.shell|createobject/i, /http[s]?:\/\/|urldownload|xmlhttp/i] }, { id: 'M-08', name: '', category: '', severity: 'high', weight: 55, desc: ' API ', minHits: 2, patterns: [/UPX[0-9!]|\.aspack|\.themida|\.vmp\d?|MPRESS[0-9]|PECompact2|\.enigma[12]?|\.nsp[0-9]|FSG!/i, /(virtualalloc|writeprocessmemory|createremotethread|winexec|shellexecute\w*|internetopen\w*|urlntdownloadtofile|loadlibrary|getprocaddress)/i] } { id: 'M-09' name: '' category: '' severity: 'high' weight: 50 desc: 'autorun ' minHits: 2 patterns: [/autorun\.inf/i /(wscript|cscript|mshta)[^\n]{0 50}\.(exe|vbs|vbe|js|jse|wsf|url)/i /(copy|xcopy|copy-item|robocopy)[^\n]*(startup|removable|appdata|%temp%)/i] } ]; // ASCII >= 4 var PACK_SIGNATURES = [ { name: 'UPX' sig: 'UPX!' } { name: 'UPX' sig: 'UPX0' } { name: 'UPX' sig: 'UPX1' } { name: 'ASPack' sig: '.aspack' } { name: 'ASPack' sig: '.adata' } { name: 'Themida' sig: '.themida' } { name: 'MPRESS' sig: 'MPRESS1' } { name: 'MPRESS' sig: 'MPRESS2' } { name: 'VMProtect' sig: '.vmp0' } { name: 'VMProtect' sig: '.vmp1' } { name: 'PECompact' sig: 'PECompact2' } { name: 'Enigma' sig: '.enigma1' } { name: 'Enigma' sig: '.enigma2' } { name: 'NSPack' sig: '.nsp0' } { name: 'FSG' sig: 'FSG!' } ]; // Shannon 0-8 var ENTROPY = { threshold: 7.2 // weight: 26 // severity: 'medium' execBoost: 14 // }; // var INDICATORS = { manyUrls: { min: 8 weight: 12 severity: 'low' desc: '' } extMismatchExec: { weight: 55 severity: 'high' desc: '' } extMismatchOther: { weight: 22 severity: 'medium' desc: '' } packed: { weight: 30 severity: 'medium' desc: '' } packedHighEntropy: { weight: 40 severity: 'high' desc: ' }; // ---------------- ---------------- // SHA-256 // id function mergeHashList(base, cloud) { var map = {}, order = [], added = 0; (base || []).forEach(function (h) { if (h && h.sha256 && !(h.sha256 in map)) { map[h.sha256] = h; order.push(h.sha256); } }); (cloud || []).forEach(function (h) { if (!h || typeof h.sha256 !== 'string' || !/^[0-9a-f]{64}$/i.test(h.sha256)) return; var k = h.sha256.toLowerCase(); var rec = { id: String(h.id || ('CLOUD-' + k.slice(0, 8))), sha256: k, name: String(h.name || 'Unknown.Threat'), family: String(h.family || ' severity: h.severity === 'suspicious' ? 'suspicious' : 'malicious' cloud: true }; if (k in map) { map[k] = rec; } else { map[k] = rec; order.push(k); added++; } }); return { list: order.map(function (k) { return map[k]; }) added: added }; function safeFlags(f) { var out = ''; String(f || 'i').split('').forEach(function (c) { if ('imsuy'.indexOf(c) >= 0 && out.indexOf(c) < 0) out += c; // lastIndex }); return out || 'i'; function compileRules(arr) { var out = [] bad = 0; (arr || []).forEach(function (r) { try { if (!r || !r.id || !r.name || !r.pattern) return; var src = String(r.pattern); // 512KB if (src.length > 500) { bad++; return; } var w = parseInt(r.weight, 10); out.push({ id: String(r.id) name: String(r.name) category: String(r.category || ' severity: ['low', 'medium', 'high'].indexOf(r.severity) >= 0 ? r.severity : 'medium' weight: isNaN(w) ? 30 : Math.max(1, Math.min(100, w)) desc: String(r.desc || r.name) pattern: new RegExp(src, safeFlags(r.flags)) useName: !!r.useName cloud: true }); } catch (e) { bad++; } }); return { list: out bad: bad }; function compileMulti(arr) { var out = [] bad = 0; (arr || []).forEach(function (r) { try { if (!r || !r.id || !r.name || !Array.isArray(r.patterns) || r.patterns.length < 2) return; var pats = [] w = parseInt(r.weight, 10); r.patterns.forEach(function (p) { var src = typeof p === 'string' ? p : p && p.pattern; if (!src || String(src).length > 500) return; pats.push(new RegExp(String(src) safeFlags(typeof p === 'string' ? 'i' : p.flags))); }); if (pats.length < 2) { bad++; return; } var mh = parseInt(r.minHits, 10); out.push({ id: String(r.id) name: String(r.name) category: String(r.category || ' severity: ['low', 'medium', 'high'].indexOf(r.severity) >= 0 ? r.severity : 'high' weight: isNaN(w) ? 60 : Math.max(1, Math.min(100, w)) desc: String(r.desc || r.name) minHits: Math.max(1, Math.min(pats.length, isNaN(mh) ? 2 : mh)) patterns: pats cloud: true }); } catch (e) { bad++; } }); return { list: out bad: bad }; function appendUnique(base, extra) { var have = {}; base.forEach(function (r) { have[r.id] = true; }); var added = 0; extra.forEach(function (r) { if (have[r.id]) return; have[r.id] = true; base.push(r); added++; }); return added; function applyCloudDb(db) { if (!db || typeof db !== 'object') throw new Error(' if (typeof db.version !== 'string' || !/^\d{4}\.\d{2}\.\d{2}\.\d{3}$/.test(db.version)) throw new Error(' if (!Array.isArray(db.hashes) || db.hashes.length < KNOWN_HASHES.length) throw new Error(' var hm = mergeHashList(KNOWN_HASHES, db.hashes); KNOWN_HASHES = hm.list; // trust // CDN/ // var cr = compileRules(db.addRules || []); var addedRules = appendUnique(HEURISTIC_RULES, cr.list); var cm = compileMulti(db.addMultiRules || []); var addedMulti = appendUnique(MULTI_RULES, cm.list); DB_VERSION_OBJ.version = db.version; DB_VERSION_OBJ.updatedAt = db.releasedAt || db.version; return { version: db.version releas" (Source: signatures.js, Indicator: "eicar-standard-antivirus-test-file")6b:T669,Found registry query API: "RegGetValueW" in file "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" Found registry query API: "RegOpenKeyExW" in file "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" Found registry query API: "RegQueryValueExW" in file "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" Found registry query API: "RegEnumKeyExW" in "00000000-00000456.00000000.190611.779C2000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00000456.00000000.190611.779C2000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00000456.00000000.190611.779C2000.00000002.mdmp" Found registry query API: "NtQueryValueKey" in "00000000-00000456.00000000.190611.779C2000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp"6c:Tf40,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "::GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "::WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "NtQueryObject-type_info_length" (Indicator: "NtQueryObject"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "::GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "::WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtQueryInformationProcess incorrect size" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "::NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "::NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "::GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "::WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")6d:Td16,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "FindNextFileW" with parameter 6078762b90671c2ff9ba39318e2176d8 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\DomainShieldSetup\* (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\* (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "FindNextFileW" with parameter 061200dcb8937e1b9eb2641f2ce9d2ec (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "FindNextFileW" with parameter 808887ebadf1a37835b907c866cede3c (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "FindNextFileW" with parameter fe3c9cf707273488c6c658d52d624640 (UID: 00000000-00007288) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\* (UID: 00000000-00007288)6e:T964,Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "FindFirstFileExFromAppW" (Indicator: "FindFirstFile"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "FindFirstFileEx" (Indicator: "FindFirstFile"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "FindFirstFileExFromAppW" (Indicator: "FindFirstFile"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "FindFirstFileEx" (Indicator: "FindFirstFile"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "FindFirstFileExFromAppW" (Indicator: "FindFirstFile"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "FindFirstFileEx" (Indicator: "FindFirstFile"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")6f:T10b6,Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "GetFileAttributes" (Indicator: "GetFileAttributes"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetFileAttributesExFromAppW" (Indicator: "GetFileAttributes"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "__crtGetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "GetFileAttributes" (Indicator: "GetFileAttributes"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetFileAttributesExFromAppW" (Indicator: "GetFileAttributes"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "AttemptToNotifyRunningChrome:GetCurrentDirectory failed" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSize:" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSize:" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "GetFileVersionInfo:" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp")70:Tc8a,Found string "passwords" (Indicator: "password"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found string "password_manager" (Indicator: "password"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found string "passwords/manual_filling_controller/0x?" (Indicator: "password"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found string "passwords" (Indicator: "password"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found string "password_manager" (Indicator: "password"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found string "passwords" (Indicator: "password"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found string "password_manager" (Indicator: "password"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found string "passwordsPrivate" (Indicator: "password"; Source: "00000000-00005148.00000000.189261.0004C000.00000004.mdmp, 00000000-00005148.00000000.189261.00090000.00000004.mdmp, 00000000-00005148.00000000.189261.005C8000.00000004.mdmp, 00000000-00005148.00000000.189261.005E0000.00000004.mdmp, 00000000-00005148.00000000.189261.0062C000.00000004.mdmp, 00000000-00005148.00000000.189261.00684000.00000004.mdmp") Found string "edge://password-change/*" (Indicator: "password"; Source: "00000000-00005148.00000000.189261.00120000.00000004.mdmp, 00000000-00005148.00000000.189261.005EC000.00000004.mdmp") Found string "edge://password-manager/*" (Indicator: "password"; Source: "00000000-00005148.00000000.189261.00120000.00000004.mdmp, 00000000-00005148.00000000.189261.005EC000.00000004.mdmp") Found string "permission:passwordsPrivate" (Indicator: "password"; Source: "00000000-00005148.00000000.189261.00120000.00000004.mdmp") Found string "passwords" (Indicator: "password"; Source: "00000000-00005148.00000000.189261.001C8000.00000004.mdmp, 00000000-00005148.00000000.189261.001D0000.00000004.mdmp, 00000000-00005148.00000000.189261.00544000.00000004.mdmp") Found string "password_manager" (Indicator: "password"; Source: "00000000-00005148.00000000.189261.001C8000.00000004.mdmp, 00000000-00005148.00000000.189261.001D0000.00000004.mdmp, 00000000-00005148.00000000.189261.00544000.00000004.mdmp") Found string "-internal-password-container" (Indicator: "password"; Source: "00000000-00005148.00000000.189261.00258000.00000004.mdmp") Found string "4password" (Indicator: "password"; Source: "00000000-00005148.00000000.189261.002DC000.00000004.mdmp") Found string "password-reveal" (Indicator: "password"; Source: "00000000-00005148.00000000.189261.002DC000.00000004.mdmp") Found string "reveal-password" (Indicator: "password"; Source: "00000000-00005148.00000000.189261.002DC000.00000004.mdmp") Found string "password-change" (Indicator: "password"; Source: "00000000-00005148.00000000.189261.00598000.00000004.mdmp, 00000000-00005148.00000000.189261.00604000.00000004.mdmp, 00000000-00005148.00000000.189261.0063C000.00000004.mdmp") Found string "password-manager" (Indicator: "password"; Source: "00000000-00005148.00000000.189261.005C8000.00000004.mdmp, 00000000-00005148.00000000.189261.00604000.00000004.mdmp")71:T9a6,Found reference to API "DeleteFileWithDispositionFlags" (Indicator: "DeleteFile"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "DoDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "RemoveDirectory" (Indicator: "RemoveDirectory"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "DeleteFileAfterReboot" (Indicator: "DeleteFile"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "DoDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "RemoveDirectory" (Indicator: "RemoveDirectory"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "DeleteFileAfterReboot" (Indicator: "DeleteFile"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "DoDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "RemoveDirectory" (Indicator: "RemoveDirectory"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")72:T425,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")73:T5ca,Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")74:Tff1,Found reference to API "::InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "::UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size) succeeded, expected failure" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicy" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "::InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "::UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size) succeeded, expected failure" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicy failed with Policy:" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicy" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "::InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "::UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size) succeeded, expected failure" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicy failed with Policy:" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicy" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp")75:T1011,Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "BuildExplicitAccessWithNameW" (Indicator: "BuildExplicitAccessWithName"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "CheckTokenCapability" (Indicator: "CheckTokenCapability"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "AccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "AddMandatoryAce" (Indicator: "AddMandatoryAce"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "BuildExplicitAccessWithNameW" (Indicator: "BuildExplicitAccessWithName"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CreateRestrictedToken" (Indicator: "CreateRestrictedToken"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp")76:T7a3,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000456.00000000.190611.779C2000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002368.00000000.189954.7C845000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005148.00000000.189261.70EC4000.00000002.mdmp")77:Td13,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FONTCACHE\PARAMETERS"; Key: "CLIENTCACHESIZE"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\YUDUNPCMANAGER\YUDUN.EXE"; Value: "") "YuDun.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\141.0.3537.71\MSEDGEWEBVIEW2.EXE"; Value: ""), "YuDun.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FONTCACHE\PARAMETERS"; Key: "CLIENTCACHESIZE"; Value: ""), "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: ""), "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: ""), "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FONTCACHE\PARAMETERS"; Key: "CLIENTCACHESIZE"; Value: ""), "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: ""), "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: ""), "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: ""), "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: ""), "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: ""), "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: ""), "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: ""), "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: ""), "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: ""), "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "")78:T5c96,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "EE01000000000000040004000102100000000000140000000D787900020000002A0AE302020000002F92E302020000005990030302000000648C0303010000006B507E00020000008509E3020500000087DE83000100000090A6A101020000009170030334000000A19F5E0002000000D66F030301000000DBB4EF0002000000EC8C030301000000EEAAD50202000000FED37A0005000100000001000000187DC7005300000056737D00080000006B507E00010000009829B70008000000E6C53100070004000000370000001A9CB20002000000370AE3020100000092D7B8020100000099D7B80202000000AF90030301000000BC44AA0202000000EFBA8302010005000000010000009FC8CA0002006400000001000000421D0B0102000000461D0B0103006500000001000000779B9300AA100000E6C531000B000000F0E0B60001006600000001000000779B930001007D0000000100000065A69E0001007F0000000100000065A69E0000") "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "6B040000000000000400040001000400010100000212F80072ED8101A5ADCF00C777D70024020200000000695303007F450101BF1E0101CF2A010212F80002388F020238F2020292300302E6380103123103032D3A0303AA2B010474580304931A01057A050306596C0107AB1703086A6703088D420108C557030921B500095AA9020992F8000996600309A3360109CA760309EF7D000A7A05030B9292010B9F75030CBB5A030CE9C2000D3045030D37C6000D7879000DA181000DAF63030DBE82010DC461030DD3F9000DDB80010E013E010E963D010EBACD000F05DE001142C200118AE60211DCE4021202050312E5F8001312310313BC940113BED00213E978001564630315B6250115CEEB00173F5E011793380117D9D40217FADD02189AC7021920610319C0E2001A0A2B031A912C031B4278001BF60B001C955C001CA721011CB949031D4912011E1B35031E25A8021F4EA8001FD80E032018F20020DA160320DB370321013E0121777A002311AF02231F520323A8200323CC4F012429FE02246B460124ACC700253AD50025BE1701262CC202268B0A03269F2D032704AE022717B60227406A032769120127DB21012812EA0228A11B012919410129203B012945010129B160032A024A032A0E39012A68A9002AB722012AC7DE002AE768032B2499002B9F5B022BE9CA022C3D81002CC9EE022CD842012D2152032D5838012DD8F4002E29F3022F9546012FB6F6023050250130E98E03311160033115E70231484F003193040331CF4402322916033257A4003263C30233DF5D01352C5D0235B3300335CC470336B85E0136F81D01373938033789BF02380E670139DF94023A0A9E023A5460033BCE34013BF4DD023C2E3A023CB352003D73EB023E3383003EA5FA003ED9CC013F239F023F7B6F034056F10040B02A014188A60241A87600421D0B0142264A00427A5D0342B3AE00447AE602458D6D03461D0B01463F17034648B6004679D10046C221014732EE0247B1490347E44C03485B750348C24F0048D7700348F9A60049EAB7004AAA81004BF4C2014C37FA004C41B4004CA770004CC84B014DCB6C034E1224014E8D22034E9FF0004EE7C1004F14C2004F34280150406A0350614E0350EA43015232300252A7AA00547A520054B7DC00552D200355358303555F2A0157AD120157BB4402580BD00058AB1703590F1C01595394005A5EB5005BE834035C7465015C926B035CF431025F997A0360622E0360BA32026113240161CA2A0162226803625AC6016396770063BE7A0364D419016530540165C9760365D36800664D6003671C8A02673B5B0167F16A036830F00268CF72036978EB02698DB9026AC562026B1060036B1DA8026BED71036C2885026D3E43016E5E63036E7820036F00BC026F9777036FB3110170DB6D0370FD2903710528017140A3007179730371965803723C1200726E4A00729B370172A2420172ED81017355FD0273866E037477AD0074C7A40275A37E0075AB0A017679E90276BC210177A66D0377EE6E037808EC027815960079856103799C390079D46D037A8B88037AE393017B45D5007B62CE027B863D027B9FEB007BA8D1007BEE63037D45BE027E1044017F88CA007FC1A802804A710281069500822773008258680183061B0183F16000844D26018450EB0084E6830085124A008550AE00867B0601876A49018792170187B14D0187D7210187DE830087F025018893A002892F83028997F5008A8093008AD300028AFAE3008B4E1D018B5188008B9DA1018BEEF2008C1360038CE6F5028E78A2008ED6DC018F88A20290194F0390A6A10190EE37019123D3009158A40291C47B039386610093CE8C0194BB5A03950BFE00959F330195CAD00295E1DB00965DD200971C6103976AB60097748D0097F6C40098724601987F5C03992D720399FEF7019A18D7029B2BDB009B4D87009C1F4D039C4741019C623A019C7E6A039CA4EB009CC37E039CE0A8009D9D92009E98BB029F47B5029F9192019FEBD402A08F4E03A0E70F03A10E3603A189C700A1D07B02A2050600A221C802A2589C02A2BB1A03A3568803A37ABA02A39B8703A3B24E03A3D40803A3E71501A4580200A4BA3701A5ADCF00A61CA802A644A600A736A800A754A102A7B8AD00A841F102A8680903A8C81503A9170602A95E1E03AC54F900AC9A6C03AD73BF00ADD4EC00AEC78F02B054A102B0A05403B0F62E03B1B39F02B291DD00B2AA2101B3008103B392FB00B3BF2D01B4526303B47E5803B4F76703B4F9EA00B554A102B5610D01B5F67303B7F00202B8343801B854A102B8673B01B8947603B91AF300B99EC901BAEA5A03BAF9E900BB6A8502BB8E8B00BC54A102BC6EB400BCD22A01BCFA8D00BD388F00BD447403BD539800BE0CAC00BE7E4501BE827203BF516003BF8ECE00BFAB1703C046AD00C054A102C0DB4901C1B2AA02C20C5B02C2610B01C33EA300C36D8100C399F300C3AEF102C4274E03C535C900C561EA01C6BE4201C75DD700C777D700C8464E00C92FB902C9384F01C9389700C953F100CA99CE00CB74DA00CBB9E902CC495600CDAA1703CDAD0501CF676901CF74AA00CFF42B02D0175600D19A7B00D1D2A700D2A92B01D3826100D3C7AF00D3E88D00D45AC702D4D17A03D6ECC602D6F6DE00D73DEB02D9072401D9286803D9A28003D9F95503DA163E02DA38C801DAC97603DAFF0E00DB19EC02DB26D801DB677F03DB724701DBB2CC02DD1B1901DF1F8001DF416303DFA8C601DFDA3703E03EE701E061C302E0943802E0F56603E1790503E17E8C00E183AC02E1D9F502E21B5600E2907C03E2A25403E3E25B03E4402701E469C900E5CE9A02E5D95903E63E2B0DE66C8100E6FB3903E71BEC02E8803F02E89EFA00E8E09501E91BB302E98C0A01EA94CC02EAC66A03ED3EDC02EDCE8403EE051703EF264D03EF798B00F01C3F03F0E0B600F15CD402F17D5F00F1FC6000F2B4FA00F308DB00F3282101F36E7603F4CC3E01F548B100F5500D01F5572A01F6DD3C03F7125E00F7D36F00F7DAAD01F7E89101F7ED6A00F7EE4501F9778C00F9BB9401F9EA9E02FA408503FB080601FB365B03FC3A4701FD676403FDDFE501FF340002FF5C5E01FFAB4503EC00060000000047F10000EB9E02021C410102354F0102A4150102BD7E0004921E010537C600059D3D0305A43C01068653030A29D8000BFF5C000C771A010D9A03010E4D7E000E9D19010FBA9E00110FAA00117C450112B95D0313198300132FD30014AAFD0015402801159ADB0015BCB701181F1B0119C398001A59F7021AFA99001B07F5021E513D03227A4C0322D38900246F160024798902279BCE0027A2A200288BB4002900D800295563032C21D7002DB1A3002E534C012F28F00232551E013256AE0032D45F013307F50236D841013706F4023722C70037F81D013AE8CC023D5E35013F1CEA0042315F00427F7A004293800042C46A0048C6F5004ACD84034BC836014BDE41014CAF71004D863E034F0B45014F6B680352221301528C490153D88F0054202B0154C6FB025677E80256B722015787490159E5D30059EA60015C24C7025CC005015D4F44015DB340015E42C4005F6C4A015F6CDC0060AA560160B9410161FC390162295101628E7403633E99006363810064C92601657A4C036768A7006843CE026B0110016E7B8C00702C480370BF190170E8250172D8360173D3A70076418E0077BB2B01792D4F017A2226017C22B8007C78A4008009EF02821ABA0082E6F40084680B018571190387279C028B52CB008BA36B038C3BD3008CAB17038D0547018E08C4028F0643018F3CF30091508A009167C80091962201922F9302928271009283510192C41401930547019369C70096390B01994664019AC657019B56A4009C4027019CA553039D9FA0009F60C3009F8F6E009FC8CA00A0B50A01A19D2A01A1D7B300A3B06D03A3C4E200A3F76A00A428F302A5022703A5040301A522A400A58F6000A638DA00A7C23301A9B2DB00AA9FCE02AAA82503AB783D01AC840E01ADEFD302AF686403AFEFC900B0755E00B1414503B4892201B57A4801B6515D00B6D7E602B7E2BF00B9E36D03BA146500BA6CD402BEDF4403BFC82603BFF1A900C221D100C2278403C3812101C3DC2403C6064E03C82BFC00C9D7CA00CAC5FB02CCC10101CCE11703CE8A8003D0402701D0D32201D0FE6200D12A5201D1589600D3301C01D3834B01D3FE2103D68EFB00D6B79A00D8793D01D9054C03D9114401DA19D700DAD87E00DC30D100DC63F402DDEB2601DE016D03DFD52201DFD83601E3192F01E42C4C01E6199B00E6B92B01E7163001E79B3B01E8A4C601E9D1F500EAB94F00ED3FDC02F00E4E01F19F4301F21B3203F3791E03F3894001F4062801F4793D01F4AD7A00F4C82F01F629F302F65FE401F6D9EC00F7D45F01F8719A00FA67CB00FCA53B03FF506003010007000000E42C4C010800400100000212F8002DD8F4004B11B4007BA8D1008AFAE3009F27FF00A5ADCF00C777D70005004101000006596C012AB72201C9384F01CDAD0501CFF42B0203004201000027691201380E670172ED8101010043010000C0EC7C0000") "YuDun.exe" (Access type: "SETVAL"; Path: "HKCU\YUDUN"; Key: "(DEFAULT)"; Value: "URL:YuDun Activation"), "YuDun.exe" (Access type: "SETVAL"; Path: "HKCU\YUDUN"; Key: "URL PROTOCOL"; Value: "000000"), "YuDun.exe" (Access type: "SETVAL"; Path: "HKCU\YUDUN\DEFAULTICON"; Key: "(DEFAULT)"; Value: ""%LOCALAPPDATA%\YuDunPCManager\YuDun.exe" 1"), "YuDun.exe" (Access type: "SETVAL"; Path: "HKCU\YUDUN\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""%LOCALAPPDATA%\YuDunPCManager\YuDun.exe" "%1""), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\BLBEACON"; Key: "FAILED_COUNT"; Value: "0000000000"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\BLBEACON"; Key: "STATE"; Value: "0200000000"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\THIRDPARTY"; Key: "STATUSCODES"; Value: ""), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\THIRDPARTY"; Key: "STATUSCODES"; Value: "0100000000"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\BLBEACON"; Key: "STATE"; Value: "0100000000"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEUPDATE\CLIENTSTATE\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"; Key: "DR"; Value: "3100000000"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\STABILITYMETRICS"; Key: "USER_EXPERIENCE_METRICS.STABILITY.EXITED_CLEANLY"; Value: "0000000000"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW"; Key: "USAGESTATSINSAMPLE"; Value: "0100000000"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "SCHEDULE_TO_FLUSH_TO_DISK"; Value: "19FB986B973152C03BFF5F22AC1E26FBAD9888A03291563479627F544CA94F74"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "EXTENSIONS.UI.DEVELOPER_MODE"; Value: "26893109DE21A352A2B4E8F7F1AC798988E6AE9C756329FDC8A4BF5387261AC1"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "GOOGLE.SERVICES.LAST_SIGNED_IN_USERNAME"; Value: "69079CF297AC7955D4075F18F35AFFABEAED866DEB1D7092E81D850BF7FBF8AE"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "MEDIA.CDM.ORIGIN_DATA"; Value: "81046E921B34925EF9312C9A62CC5AFFB0D63E7CA2C13AC486278B291F7C08F2"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "MEDIA.STORAGE_ID_SALT"; Value: "18C0B52B135CAAFE1A26692ACA1C9982741B19572B524EDC4374A776E1410749"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "EDGE.SERVICES.ACCOUNT_ID"; Value: "FD5FDCB0CAABEDAB8ADBFB8CAE49EFEB86D67C19905F86EA40BE155EA4CF95C3"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "EDGE.SERVICES.LAST_USERNAME"; Value: "F1D14C0303D45F3F1897EDC54641E381DCFCC0F4DA8AB5729CB2BD090C7E5D29"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "DEFAULT_SEARCH_PROVIDER_DATA.TEMPLATE_URL_DATA"; Value: "8BAF22244C810B6D25BE595D1F42EC353FF7C8FBD9C37513B47A2FFA8AF4E0E3"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "SAFEBROWSING.INCIDENTS_SENT"; Value: "EA671475338AD6FE402471D7D8D4EF1281F73757AA24A90655F4D914CBE849AC"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "PINNED_TABS"; Value: "B2BF049BBA813039124A63BB29E947E9C847BE52658FFCA0481EC03DBAD455C4"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "EXTENSIONS.INSTALL.INITIALLIST"; Value: "9976A8B7F0309E616ABED4BA16F0E305D4324370D500493B99E7DA1D16063C66"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "SEARCH_PROVIDER_OVERRIDES"; Value: "05F935AA9AD5A85C92799FF621F7A2A3F3AFB85EE0BCC32E215F5BB74CDE2DAA"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "SESSION.STARTUP_URLS"; Value: "24745F213395D77E2CAF29CDF5FFD8E20FB835E8842E67462CBEFD3BE1BE8914"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "SESSION.RESTORE_ON_STARTUP"; Value: "0C2485E85D9BD72F0A0CCF33FF52FF3E53A61AE2C7EEEE5A836EFF40285E79ED"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "PREFS.PREFERENCE_RESET_TIME"; Value: "D1453E7B6E0C205D73D8D87653914AE80D4D581F6C41F1B183F4EF42C70BDAA7"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "BROWSER.SHOW_HOME_BUTTON"; Value: "47B54312B5CB65CE9F9BAB1285F556066FC209F95976E493E414072167406768"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "HOMEPAGE"; Value: "6224108CC3CA531C5AB214984B64A07566F31FED35B7EA78AF79506FE24C70D9"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "ENTERPRISE_SIGNIN.POLICY_RECOVERY_TOKEN"; Value: "FD7BB82476D6D2E921206452A4D3B4CC01C76FB24B3AA76B8CDCBDC74FA69206"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "HOMEPAGE_IS_NEWTABPAGE"; Value: "3E57B3E255EA4EEEF742240A3B2D03B8E9FB8F118D889079A164E0EA23345F59"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEUPDATE\CLIENTSTATE\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"; Key: "LASTRUN"; Value: "13437318376389945"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\PROPERTY"; Key: "001880196B955B54"; Value: "0100000001000000D08C9DDF0115D1118C7A00C04FC297EB010000005048E29E69951843BA39B5CD35225CFB000000000200000000001066000000010000200000007F77698CC677991FB258B08EB921DAE89165CA9A94125F297A57EE387924543F000000000E80000000020000200000000FACECF122DA92FFBBEB9F9AAD8CD06FA0AC52BF04ED58EBDECC663BC47B0ED980000000FD9F8F1EC1C60C53027715D02A02D381458186487DF4A532A112895B858812826B5981D5EFC4F8F645D4DD2062CF67266A63BA72CD1A8F8C248A58CB0CF62A3A22283FF358B116F954E5D67B73A904A0C8A98F57851B3A2B21E734BE792C49831110A60D423BFA55ACCFF9D454DB8F2EF9601A0D239CBD1881687B1AC1677D4C4000000017B620363BC20B34FEFF504B6EDC265BC262A35CC5905AD5DF08E1B4B19779A711DB0193372938C1E7625BD2CAB0A56B0689D0B0AA7B21F630A05489C7ADBA7400"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\TOKEN\{C89E2069-AF13-46DB-9E39-216131494B87}"; Key: "DEVICETICKET"; Value: "0100000001000000D08C9DDF0115D1118C7A00C04FC297EB010000005048E29E69951843BA39B5CD35225CFB000000000200000000001066000000010000200000004A5A16B1648F1E3D0EDA217C683442DE0BA2297C9DFCECCAEF60332CDA57BDC2000000000E8000000002000020000000AE4CC5A3FDAE0DADB08759A7DB76F3AFCC273AD65E07D4514C43C952E474CF41200C0000C94F4A3AF22D1EFEE70E49F633E43A58612775CB1C47CA111AAEA242D7DF62693E3E426552D03F6E916ED79CF526FC32DDA5A9F7861740B1F09033443C8F9C094A4614F7B504F6A43F8F5688CB26E895869F92AA49F9A4B98DF0A44966B99F47844FA64E11EFC4E0FAAD2242D5CCA097C2EEE32A16237F4F5ECF211E8E13DAFD7CCE7140026B29FF2536206A382F0E4564D005AF5E2863D6B8657E0643FC72BB9D1347884119FC2C064546318FC8E1C3366B927E4A1EB63DDA9DCB27A3835EC35CD6F0D43267C9005005A401D1D24F612E88C53490815A0509F6687E88A7E8DB9F282F3FA83A7150E88F1D349ED9072A3E8BCE89304DC29975EF090EC1D3CB652680DD3BE2FD9477BC5C86D351F010019909EB4DD044786999CBCD7404D76954F2B8EBDEC8102675DA7D6C4C1B1488571175EED5B5458D91FF73265CE23D634480234F834FC18F2950FD5EAD6C6037C3F32DB981EE754EEECA44EBDA85FC405E19C0CAFCF02103C86E2D310554BC9FE9FC8F3760F3DB3CA83B5EE139C8D2D698FC677C0BC48851DDD8BC360BADE64FA2C738F26A7BE6D4941F5DBA5881DAC2AFE1A0D8DCB3BDA4A3ABF5229678C1FAFE7D1AC1EF620C319735B117E85965371C4C85999BEEC805EC3A19517B1CB39B56DC9E4117E1FDD131536E49153C879B664EBDB6614926733F4C60F588E9E15CE589469E111F52D2AA22880617B807181D2635C036D79D726597E0C70C41977E382C455B607C88C8CE6B643E072DC277BF355A9C2BC32853A8C3D5B4E05315EF3B425FFEA2BC99DC8777B9D1A434789C5F24EE54AC9A0661E76A327E4702F6A60C4274078E7979B640EF0AC4F0149A8B2650B834C776B0469AF31B150704ADFEA16973AE7312E29A32616DD0A8547EBC3D67C5760025353375A5DCB8E8FE1B3A3A4DB9EAB29541191935F623C4D85E6FE34F14EA595B51493001ADB08B67E20690F3751C6C7FD18E51A20E60027D09A4E71BBB4A8477CB4EC43CEC8521959BCCE552056941D25EE0B87B2617E73B11D827617FD8C3E841049892A29111D7C8883763593BCB7EA52AB6E2C98EA7CA4F62387BD5CD597A6D4B56754A56E19A66178452483117DA0E6E2987C8724BDFC67957D19B6236356F5F24EB8DEC1ED7718F8CB6E75DF50ADC10DDD74B1F7A5E557C5177789A3E31777A47AA174BF7770D4DA5FA3806EA9C72DCBC5433B5DEB79123B4F5642404B8572F8B6A05BA191C88F46206B2B347779BBC75853A3E31B2AEAF17DDF167777D809C876A8ADBB1AF0A4892FB74E5D9F0147F7C8919C3BC796F85E997F40AA3E68A80298D4ADDB79FEFC86454516E0BFBB44F832E99256308E4C0CD38A32E4D04E431B578F966677CB390A937A89FF274FF021CC4747D676748E0CF250A4F947BB914793323D02EEC9D56194C01CF30722BDABA3BE91177CC1107305E7FE38AA65ACECB3674A416A0769F41C25B4B1AC36177678114C829D03F2912594533DCA774C6D169339653DF4C35845BA1572FDFF7D40297F1C743F22EA1C0DB794B3AEE842C67F14814962EF80E5142F6FC408957E3F66E62EF87E55C7CA58C0BFD59EA3E5C105CCA7ADDE22A6D164BFE5104324820B64E42701370A803509DD56E88CF41C33E49DD2D7CADF81CE9C6DE1EBF3F7B9110CBCE5EBB28DA698D23F933A51F15A3D62985F1F14356B1C9E812C726939B43986DF19B004574F0874774F30F332FC1B6C45306F046AE0C2F556C4630E85C48744D0B82E6899E617796D6701150E657D1A6914DCD3AB15C4B3B2CBC720CD34C9E0E3F50E9486DE6E8403F36000053E35456DF9ED682D706A72C6176699D6C27854A96FECDAB6DD6FB8817244749C03B7A4F5CEE87DEFA085AD0E0268E8F215555E88E81994CE041B4A04B0893386BE48289945363CFB8F706DE8EFBA0D57A6BBE9699F0450F4DCBC9FAEF52F343D33FFF508588C1BF28CEA550EA2050600CDD0AAB286F42C980DFB6CC41F6CD2D2D13C32FBC1DA6047AB377B07A48A5D5D81F3E9A3E35D0869E2E5D1A9AF879219FFDE84EA57ABDF73235FCE126022AD88599F6531381130FA7772B9E209F76712DDEA682EAC822C8B870A90E1BC0AEC4899DEE48048EA8D7FD546CDC1FD404F54C3A0967616B6F10DC10DD07B490E5B2C5848B11B9C0EAFD83CD568DF0CE5616CD765F57A22545D53EF0A288C4FA28CCBA07B0E091A545F1947D2B5265DB411F0C4A8311094BDFD3997BB0F93857267A2AC78F7BD4A95EC94E0910D9074F0FBDA4A2810E865188E8EF9D88CF1478C58405DFEE90C2FA07C8F48D4CDB52C7159A3D2971594E5830799BFE2A995C6DF8E983F90C90504E7E858F77E6735016611D5F89D2601599136EF1E8F6BF74EA88262CD327AEA36190405BB81D8076EDA214169D82624973CCAF4F4B296257BA97E66CD6DF850BE3D65CD4A36E0DA58ECAD8E4C457DFCEDCE3F85D16A9DAA57F127BF1C1EE1370B650F93B74F4D0FBA58AC3CF5C21C62B015C3CACF9BE5EE6E55E514AAC347D4F2402C9827CBE59567933B55073A4A1C16D1499961B470EB58E0135227019C6735987DDCBE843A17C0E88B5AE9086B1176AEDB68D83ADEC086342B8AA7F8A9DC110D88F3C9FCB56D02E4B2A65226C3572C4790E9FA89EC71ED38D4ECAD2C3D42D755A41D24FB849D9963444205D1D4011E42B6C01551E53B825B2DE418AA3097BA803A6275CC369BFDCD0F675A2603EB5900A0AD2F0E759FA7B82C238647935B3BD2CD93E619253CE78E55612A1094D0D2C15C470DC15CB7F0A8C854A177BB8FF6843AFA994B91C9FABE43FF3AD654A768D1E614C9E6CCF8341EFDD94954B12F430B77DC4BDF2CB16541C18F6B44858AEF1638537F39F49F08D36F1F0633F9CE26EE8373ECA734733F7A426B3FCD5ECD7E8D5B92FDAFA27BED07BCABB0DFAF996C70967F20FD69833540FB9A64F3093A027223ECBCCFB5BFC0B4202E88403464E9066179DBA92883949496FAD1EF3B023A6CBF34AFBFF6CA7F13478AE64E2B1E7AAD75E47113C30C6E326FC76B0DE69093472E5DC76D6FD35E255ACD6C9FC7E95D034D1B3648A2D84B5A0D3688FCDEDE1237C9035F56BD54F1FC497694A193F64CD8BD8B0F76A147E23F2647E5440E5FB8806ADD70B9581EE08B9EFA54975D6C3831FFD1F9C61D9A199FD3C4BADC988F3E305F9BB0BE2907640170BEFD67F2D16F4F72C2C434C1378871EEDF097CF89202ACFF8D1DD77AB57285306ACE63CDDF07067CC9E95C8528BA468C907E56448C27F0AF78771986B4EB3608775F07CB02813A77D1D8FCBB5427211255FBFA98D047B874BC61B0F9E482B6698D3C734ACE2D25FD21FA5F67A0FFE2F9C7C20C553264F04B2FEB8EABCF1979F4EC151BF235BFD53E0734CDEA4294FC2BB5F0C620EE549196820D659D79A3DC2E3AB5E8012B748381773ACB3803DBC940A6748A3D6120DF98F673CE035764FFF27C9103DF61F6192EF67B7088223E31972027EEABE149D008B985BE152B77738C94D7F2DC1AD02B1801914763B0990FCE3823CCCADDF2D53C6FBD0BDC3C4BD252E1A4CD338AA036B9E2303AB6E12E39FFD6E8B7F20E374FD1E68CAF801355B27146DAA95E48215D4F6420F9559C0F5EEF5573732873A115E7D7C2C9A1BA8F7753385F966A4107D00986088F787A1338827618F48FEF2177B02D094D650687F32F1C025D86DA140A6F6A954929575F3F1809C73850CE1BAB3BAA597235F6753DF0473D4D091B63F5AC5446948D000D0AE61077ECE450FA80B1BFD8C760BD297C98B54B9FBBAC0C9736BC45B0BCFE8173717105F7C5B58D5CD31A7D1ED9DCEC9990D7C90BB6B75099AE3FCD490BCDB1FDBF42A42EDE9244DFC166F634A92D67C0C85F7B5C2E7664B48D36CDFE8A6721586F950E9AF14902744C0DAD47CC865C94EDF9AE4E4D239659AE8F84A4D3076B24B592BC66446846B7BFA38E6479E062C40B2148C49EFF5F4D352B5694466BE58F87806D876D5807D688B9BE6FB61123CEB2783BF34B44DF89727AEAB179EEAADB7731F8EDE0FACCD7763E464B871DDF915A723B27016AB6DA22F623218FC71D1117B04A2614FEFC14BBEB5A26D29DC84DDF78B7CF05FDF46E1EB7694B4BBAA27782FF07108EA07BB02DED29DFFC1716300578995D85BBBA50134A171D7EDC89CEE5DA75B4A2ECFD1812C0F582D7CFB9FF17E05D5A22EA263B45408EB9CE7870B69B505B99889FDAA74BCAC2270F85F8422D10A2538BFB454348FBEE60A17C2EFF9BD5BAEA42190B52C79E45DF3D7DC0D32CFAEB90AD68B2BD662C9348B3B1E8B37F8D441501F5E8BECF7897AFB99E6659F5BA62FAB536E5F0EB2C1B74B137E5D67D088CE3F6734260A11490C03D76BE414CD4F7326882DB230E4CBEAA040000000A7891F7D1AC3F5E4A3984404985709C35C48EC5684B46A5B83BA2C34AAAD07044A87D5EA0C56F0B000DE5917349B330147D3C4DFEEA78885004206AB543CE79C00"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\TOKEN\{C89E2069-AF13-46DB-9E39-216131494B87}"; Key: "DEVICEID"; Value: "001880196B955B54"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\TOKEN\{C89E2069-AF13-46DB-9E39-216131494B87}"; Key: "APPLICATIONFLAGS"; Value: "0100000000"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTSTATEMEDIUM\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"; Key: "USAGESTATS"; Value: "0000000000"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTSTATEMEDIUM\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"; Key: "URLSTATS"; Value: "0000000000"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT\EXTENSIONS.SETTINGS"; Key: "DGIKLKFKLLIKCANFONKCABMBDFMGLEAG"; Value: "A5533636620B0D000C5E23173640092D14028B1F0BF2F479C8BDB6D4B9A0D8D8"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT\EXTENSIONS.SETTINGS"; Key: "MHJFBMDGCFJBBPAEOJOFOHOEFGIEHJAI"; Value: "5F52C8D19D9E56C35C316F30145CF8CD18C5848694D7E36C7A8A40F25F95FFC3")79:Tec4,Dropped file: "Microsoft.Web.WebView2.Core.dll" - Location: [%LOCALAPPDATA%\YuDunPCManager\Microsoft.Web.WebView2.Core.dll]- [targetUID: 00000000-00007288] Dropped file: "WebView2Loader.dll" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2Loader.dll]- [targetUID: 00000000-00007288] Dropped file: "YuDun.exe" - Location: [%LOCALAPPDATA%\YuDunPCManager\YuDun.exe]- [targetUID: 00000000-00007288] Dropped file: "Microsoft.Web.WebView2.WinForms.dll" - Location: [%LOCALAPPDATA%\YuDunPCManager\Microsoft.Web.WebView2.WinForms.dll]- [targetUID: 00000000-00007288] Dropped file: "topTraffic_170540185939602997400506234197983529371" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371]- [targetUID: 00000000-00007228] Dropped file: "topTraffic_638004170464094982" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\SmartScreen\RemoteData\topTraffic_638004170464094982]- [targetUID: 00000000-00007228] Dropped file: "lucide.min.js" - Location: [%LOCALAPPDATA%\YuDunPCManager\app\vendor\lucide.min.js]- [targetUID: 00000000-00007288] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\GPUCache\data_1]- [targetUID: 00000000-00007228] Dropped file: "index" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\GPUCache\index]- [targetUID: 00000000-00007228] Dropped file: "index" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\ShaderCache\index]- [targetUID: 00000000-00007228] Dropped file: "index" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\DawnWebGPUCache\index]- [targetUID: 00000000-00007228] Dropped file: "index" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\DawnGraphiteCache\index]- [targetUID: 00000000-00007228] Dropped file: "Web Data" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Web Data]- [targetUID: 00000000-00007228] Dropped file: "History" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\History]- [targetUID: 00000000-00007228] Dropped file: "app.js" - Location: [%LOCALAPPDATA%\YuDunPCManager\app\js\app.js]- [targetUID: 00000000-00007288] Dropped file: "edgeSettings_2.0-a82cb2897a8bf9445d68dcc2be05af89ad4b2fda1fddb2952693be7cd5353ad3" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\SmartScreen\RemoteData\edgeSettings_2.0-a82cb2897a8bf9445d68dcc2be05af89ad4b2fda1fddb2952693be7cd5353ad3]- [targetUID: 00000000-00007228] Dropped file: "db.json" - Location: [%LOCALAPPDATA%\YuDunPCManager\sigs\db.json]- [targetUID: 00000000-00007288] Dropped file: "pay-qr.png" - Location: [%LOCALAPPDATA%\YuDunPCManager\app\pay-qr.png]- [targetUID: 00000000-00007288] Dropped file: "styles.css" - Location: [%LOCALAPPDATA%\YuDunPCManager\app\css\styles.css]- [targetUID: 00000000-00007288] Dropped file: "db" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Shared Dictionary\db]- [targetUID: 00000000-00008036] Dropped file: "Login Data" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Login Data]- [targetUID: 00000000-00007228] Dropped file: "Reporting and NEL" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\Reporting and NEL]- [targetUID: 00000000-00007228] Dropped file: "Trust Tokens" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Network\Trust Tokens]- [targetUID: 00000000-00007228] Dropped file: "Vpn Tokens" - Location: [%LOCALAPPDATA%\YuDunPCManager\WebView2\EBWebView\Default\Vpn Tokens]- [targetUID: 00000000-00007228] Dropped file: "engine.js" - Location: [%LOCALAPPDATA%\YuDunPCManager\app\js\engine.js]- [targetUID: 00000000-00007288]7a:Tecc,Found string "Rectangle" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: GDI32FULL.DLL) Found string "VariantClear" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: OLEAUT32.DLL) Found string "EndPaint" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: USER32.DLL) Found string "BeginPaint" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: USER32.DLL) Found string "CorExitProcess" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: CLR.DLL) Found string "AreFileApisANSI" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: KERNELBASE.DLL) Found string "LCMapStringEx" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: KERNELBASE.DLL) Found string "AppPolicyGetProcessTerminationMethod" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "GetFileVersionInfoSizeW" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: VERSION.DLL) Found string "GetFileVersionInfoW" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: VERSION.DLL) Found string "VerQueryValueW" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: VERSION.DLL) Found string "GetCurrentPackageInfo" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "GetCurrentApplicationUserModelId" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "GetCurrentProcessExplicitAppUserModelID" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: SHCORE.DLL) Found string "DllCanUnloadNow" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: ONECOREUAPCOMMONPROXYSTUB.DLL) Found string "GetSidSubAuthority" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: ADVAPI32.DLL) Found string "GetSidSubAuthorityCount" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: ADVAPI32.DLL) Found string "GetTokenInformation" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: ADVAPI32.DLL) Found string "OpenProcessToken" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: ADVAPI32.DLL) Found string "RegCloseKey" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: ADVAPI32.DLL) Found string "RegGetValueW" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: ADVAPI32.DLL) Found string "RegOpenKeyExW" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: ADVAPI32.DLL) Found string "RegQueryValueExW" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: ADVAPI32.DLL) Found string "CoTaskMemAlloc" (Source: ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe, API is part of module: COMBASE.DLL)7b:T74b,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\Microsoft.Web.WebView2.Core.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" wrote 38752 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\Microsoft.Web.WebView2.WinForms.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2Loader.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e2400005045000064ff0900 ... "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\YuDun.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...7c:T6cd,"msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\BrowserMetrics\BrowserMetrics-6ADCA3BD-1C3C.pma" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\BrowserMetrics-spare.pma" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Local State" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\a5f4f9fc-9383-4ac2-bff4-2657ea5d9f18.tmp" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\ShaderCache\index" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\ShaderCache\data_0" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\ShaderCache\data_1" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\ShaderCache\data_2" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\ShaderCache\data_3" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\Site Characteristics Database\CURRENT" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\Site Characteristics Database\000001.dbtmp" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT" with delete access7d:T8ae,"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" wrote 000011C0 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\YuDun.exe" (Handle: 1752) "ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\YuDunPCManager\YuDun.exe" (Handle: 1752) "YuDun.exe" wrote 000011C0 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.71\msedgewebview2.exe" (Handle: 1612) "YuDun.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.71\msedgewebview2.exe" (Handle: 1612) "msedgewebview2.exe" wrote 000011C0 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.71\msedgewebview2.exe" (Handle: 528) "msedgewebview2.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.71\msedgewebview2.exe" (Handle: 528) "msedgewebview2.exe" wrote 000011C0 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.71\msedgewebview2.exe" (Handle: 2072) "msedgewebview2.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.71\msedgewebview2.exe" (Handle: 2072) "msedgewebview2.exe" wrote 00000170 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.71\msedgewebview2.exe" (Handle: 2072) "msedgewebview2.exe" wrote 0000002C bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.71\msedgewebview2.exe" (Handle: 2072) "msedgewebview2.exe" wrote 00000010 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.71\msedgewebview2.exe" (Handle: 2072) "msedgewebview2.exe" wrote 00000020 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.71\msedgewebview2.exe" (Handle: 2072) "msedgewebview2.exe" wrote 000000E8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\141.0.3537.71\msedgewebview2.exe" (Handle: 2072)7e:T1481,--type=gpu-process --noerrdialogs --user-data-dir="C:\Users\WBUQqC4\AppData\Local\YuDunPCManager\WebView2\EBWebView" --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1668,i,5159980390163043826,3489839395260388718,262144 --field-trial-handle=1820,i,13006288228909035655,18247888668911260032,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:27f:T144b,--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\WBUQqC4\AppData\Local\YuDunPCManager\WebView2\EBWebView" --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --no-pre-read-main-dll --startup-read-main-dll --metrics-shmem-handle=2268,i,9790732574900320645,5479884323038646104,524288 --field-trial-handle=1820,i,13006288228909035655,18247888668911260032,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:380:T144e,--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\WBUQqC4\AppData\Local\YuDunPCManager\WebView2\EBWebView" --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --no-pre-read-main-dll --startup-read-main-dll --metrics-shmem-handle=2440,i,740598221054818830,12179586072822152422,524288 --field-trial-handle=1820,i,13006288228909035655,18247888668911260032,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:881:T14ff,--type=renderer --noerrdialogs --user-data-dir="C:\Users\WBUQqC4\AppData\Local\YuDunPCManager\WebView2\EBWebView" --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --dma-cps-flags=0 --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --js-flags="--expose-gc --ms-user-locale=" --time-ticks-at-unix-epoch=-1792841825848046 --launch-time-ticks=2952197578 --ram-no-pressure-read-main-dll --metrics-shmem-handle=3708,i,14866551390223702060,2937474166063603941,2097152 --field-trial-handle=1820,i,13006288228909035655,18247888668911260032,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:182:T147f,--type=gpu-process --noerrdialogs --user-data-dir="C:\Users\WBUQqC4\AppData\Local\YuDunPCManager\WebView2\EBWebView" --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --skip-read-main-dll --metrics-shmem-handle=3964,i,14901320352443815428,8864732732265931079,262144 --field-trial-handle=1820,i,13006288228909035655,18247888668911260032,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=1676 /prefetch:283:T144c,--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\WBUQqC4\AppData\Local\YuDunPCManager\WebView2\EBWebView" --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --no-pre-read-main-dll --skip-read-main-dll --metrics-shmem-handle=1424,i,4490525204529498064,14566687166773779429,524288 --field-trial-handle=1820,i,13006288228909035655,18247888668911260032,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:884:T147f,--type=gpu-process --noerrdialogs --user-data-dir="C:\Users\WBUQqC4\AppData\Local\YuDunPCManager\WebView2\EBWebView" --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --skip-read-main-dll --metrics-shmem-handle=2944,i,2386335747771890951,11326765020284941946,262144 --field-trial-handle=1820,i,13006288228909035655,18247888668911260032,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:285:T144d,--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\WBUQqC4\AppData\Local\YuDunPCManager\WebView2\EBWebView" --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --no-pre-read-main-dll --skip-read-main-dll --metrics-shmem-handle=2948,i,10844949398696206697,16732315751872543155,524288 --field-trial-handle=1820,i,13006288228909035655,18247888668911260032,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:886:T14ac,--type=gpu-process --noerrdialogs --user-data-dir="C:\Users\WBUQqC4\AppData\Local\YuDunPCManager\WebView2\EBWebView" --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --skip-read-main-dll --metrics-shmem-handle=2024,i,9982387529115238393,11954863642070787972,262144 --field-trial-handle=1820,i,13006288228909035655,18247888668911260032,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=1676 /prefetch:287:T144d,--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\WBUQqC4\AppData\Local\YuDunPCManager\WebView2\EBWebView" --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --no-pre-read-main-dll --skip-read-main-dll --metrics-shmem-handle=3044,i,11523791165548994802,10949007203460331461,524288 --field-trial-handle=1820,i,13006288228909035655,18247888668911260032,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:888:T14ab,--type=gpu-process --noerrdialogs --user-data-dir="C:\Users\WBUQqC4\AppData\Local\YuDunPCManager\WebView2\EBWebView" --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --skip-read-main-dll --metrics-shmem-handle=2960,i,1822875469111076775,5647202323046827205,262144 --field-trial-handle=1820,i,13006288228909035655,18247888668911260032,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:289:T144c,--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\WBUQqC4\AppData\Local\YuDunPCManager\WebView2\EBWebView" --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --no-pre-read-main-dll --skip-read-main-dll --metrics-shmem-handle=2948,i,5475106221752893805,17222666289444403541,524288 --field-trial-handle=1820,i,13006288228909035655,18247888668911260032,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:88a:T14ac,--type=gpu-process --noerrdialogs --user-data-dir="C:\Users\WBUQqC4\AppData\Local\YuDunPCManager\WebView2\EBWebView" --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --skip-read-main-dll --metrics-shmem-handle=1676,i,12385961806252413060,7012683243214730922,262144 --field-trial-handle=1820,i,13006288228909035655,18247888668911260032,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:28b:T144b,--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\WBUQqC4\AppData\Local\YuDunPCManager\WebView2\EBWebView" --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --no-pre-read-main-dll --skip-read-main-dll --metrics-shmem-handle=3044,i,6998576598525279718,4855357497179733781,524288 --field-trial-handle=1820,i,13006288228909035655,18247888668911260032,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:88c:T1491,--type=gpu-process --noerrdialogs --user-data-dir="C:\Users\WBUQqC4\AppData\Local\YuDunPCManager\WebView2\EBWebView" --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --skip-read-main-dll --metrics-shmem-handle=4064,i,17733577230844631066,5555399603170080582,262144 --field-trial-handle=1820,i,13006288228909035655,18247888668911260032,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:28d:T144b,--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\WBUQqC4\AppData\Local\YuDunPCManager\WebView2\EBWebView" --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --no-pre-read-main-dll --skip-read-main-dll --metrics-shmem-handle=3964,i,1523610683770010010,7521661607313754341,524288 --field-trial-handle=1820,i,13006288228909035655,18247888668911260032,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:88e:T149d,--type=gpu-process --noerrdialogs --user-data-dir="C:\Users\WBUQqC4\AppData\Local\YuDunPCManager\WebView2\EBWebView" --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --ram-no-pressure-read-main-dll --metrics-shmem-handle=2984,i,10940171661367857039,10504427700435155202,262144 --field-trial-handle=1820,i,13006288228909035655,18247888668911260032,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:28f:T144c,--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\WBUQqC4\AppData\Local\YuDunPCManager\WebView2\EBWebView" --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --no-pre-read-main-dll --skip-read-main-dll --metrics-shmem-handle=3920,i,3680564899457999723,17543004744116936652,524288 --field-trial-handle=1820,i,13006288228909035655,18247888668911260032,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:890:T1492,--type=gpu-process --noerrdialogs --user-data-dir="C:\Users\WBUQqC4\AppData\Local\YuDunPCManager\WebView2\EBWebView" --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --skip-read-main-dll --metrics-shmem-handle=4152,i,10472959050196466333,10313694985447153081,262144 --field-trial-handle=1820,i,13006288228909035655,18247888668911260032,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:291:T144d,--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\WBUQqC4\AppData\Local\YuDunPCManager\WebView2\EBWebView" --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --no-pre-read-main-dll --skip-read-main-dll --metrics-shmem-handle=3964,i,17456680650542826812,11384710496859151069,524288 --field-trial-handle=1820,i,13006288228909035655,18247888668911260032,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,LocalNetworkAccessForFencedFrameNavigationsWarningOnly,LocalNetworkAccessForNavigationsWarningOnly,LocalNetworkAccessForSubframeNavigationsWarningOnly,LocalNetworkAccessForWorkersWarningOnly,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgePasswordStrengthCheck,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:81d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792845063617,"unified_at":"2026-10-24T12:31:03.617Z","metadata":{"hashes":{"sha256":"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","sha1":"334cfc35655efcacad3ceab311e52b1181ac44a0","md5":"5a5ac9624714a1a27abac8221dabd3b3","sha512":"16a37f8d174f8e4956a6a92cee376463e9defc35e9d3deb26bd131b3a88d299c4bad95824f3b6f8110c0a61445c035f5487406831caa802cfb5622bd9aa68aab","ssdeep":"24576:jJ4dCXzRKX4EcJAD1RGQVIfSjjpE8rrn8WcyH:jJOcKjDnTc","ssdeep_chunks":["24576:jJ4dCXz","24576:J4dCXzR","24576:4dCXzRK","24576:dCXzRKX","24576:CXzRKX4","24576:XzRKX4E","24576:zRKX4Ec","24576:RKX4EcJ","24576:KX4EcJA","24576:X4EcJAD","24576:4EcJAD1","24576:EcJAD1R","24576:cJAD1RG","24576:JAD1RGQ","24576:AD1RGQV","24576:D1RGQVI","24576:1RGQVIf","24576:RGQVIfS","24576:GQVIfSj","24576:QVIfSjj","24576:VIfSjjp","24576:IfSjjpE","24576:fSjjpE8","24576:SjjpE8r","24576:jjpE8rr","24576:jpE8rrn","24576:pE8rrn8","24576:E8rrn8W","24576:8rrn8Wc","24576:rrn8Wcy","24576:rn8WcyH","49152:jJ4dCXz","49152:J4dCXzR","49152:4dCXzRK","49152:dCXzRKX","49152:CXzRKX4","49152:XzRKX4E","49152:zRKX4Ec","49152:RKX4EcJ","49152:KX4EcJA","49152:X4EcJAD","49152:4EcJAD1","49152:EcJAD1R","49152:cJAD1RG","49152:JAD1RGQ","49152:AD1RGQV","49152:D1RGQVI","49152:1RGQVIf","49152:RGQVIfS","49152:GQVIfSj","49152:QVIfSjj","49152:VIfSjjp","49152:IfSjjpE","49152:fSjjpE8","49152:SjjpE8r","49152:jjpE8rr","49152:jpE8rrn","49152:pE8rrn8","49152:E8rrn8W","49152:8rrn8Wc","49152:rrn8Wcy","49152:rn8WcyH","24576:jJOcKjD","24576:JOcKjDn","24576:OcKjDnT","24576:cKjDnTc"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"ad6484135f0edf91.bin.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1954304,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792823425000,"last_seen":1792844600000,"last_multi_scan":1792844600000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["kryptik","genkryptik","stealer","hiddentear","ransomware","evasive"]},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":95},"sandbox_signatures":{"informative_count":269,"suspicious_count":26,"malicious_count":7,"total":302},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Dcrypt.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Lazy.723145","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Lazy.723145 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/MSIL.LockFile.c","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_get_geographical_location","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Troj.IA.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Lazy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":".NET source code contains suspicious native API"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"suspicious","value":"Imports suspicious APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Dotnet code contains ability to generate random numbers"},{"type":"informative","value":"YARA signature match – high entropy image embedded in .NET resource"},{"type":"suspicious","value":"YARA signature match - PowerShell with Base64 encoding"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Tries to identify Internet Explorer version from registry"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Found registry location string related to BIOS"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"suspicious","value":"Attempts to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Privilege Escalation","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"suspicious","value":"Contains scheduled task related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicates via socket (possible C&C communication)"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"},{"type":"informative","value":"Contains ability to perform email related activity (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"},{"type":"suspicious","value":"Reads the hosts file"},{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","identifiers":[{"type":"suspicious","value":"YARA signature match - Office macro contains PowerShell commands"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":".NET code is able to query registry"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"},{"type":"suspicious","value":"Reads VM-specific registry key"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"},{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Able to load content into memory (.NET)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Able to use vulnerability or port scanning tools"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Able to delete volume snapshots"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Contains ability to run commands or expressions (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Persistence","technique":"Change Default File Association","attack_id":"T1546.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/001","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate a named-pipe client application (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to hide C2 connections by leveraging external proxy routing"},{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","identifiers":[{"type":"informative","value":"Able to access password managers"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Credential Access","technique":"Cached Domain Credentials","attack_id":"T1003.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/005","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to move file or directory"},{"type":"informative","value":"Identified known pipe name"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Able to download remote files (.NET)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Contains ability to generate intermediate language instructions (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"},{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - PowerShell with Base64 encoding","description":"YARA signature for PowerShell containing Base64 encoding matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-35","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Office macro contains PowerShell commands","description":"YARA signature to detect PowerShell in Office macros matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1059.005","id":"yara-29","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-62","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with bottom confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-19","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\" in Source: sample.bin, \"Software\\Microsoft\\EdgeUpdate\\ClientState\\\" in Source: sample.bin, \"reg add \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" /v svc /d evil.exe\" in Source: sample.bin, \"SYSTEM\\CurrentControlSet\\Control\\Terminal Server\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Cryptography\" in Source: sample.bin, \"Software\\Policies\\Microsoft\\Edge\\WebView2\\\" in Source: sample.bin, \"Software\\Classes\\yudun\" in Source: sample.bin, \"Software\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\" in Source: sample.bin, \"Software\\Policies\\Microsoft\\Edge\\WebView2\\DowngradeVersion\" in Source: sample.bin, \"SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Shares\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"GetSystemInfo\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"VariantClear\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"SetEnvironmentVariable\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\a\\_work\\1\\s\\third_party\\edge_webview2\\win\\webview2_api_writer\\dotNetAPIWrapper\\Microsoft.Web.WebView2.Core\\bin\\ReleasePackage\\Microsoft.Web.WebView2.Core.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"26d34152-879f-4065-bea2-3daa2cfadfb8@microsoft.web.webview2.core.raw.corewebview\"","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-63","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Contains scheduled task related strings","description":"Found string \"schtasks /create /tn Updater /tr evil.exe /sc onlogon\" (Indicator: \"schtasks /create\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1053.005","id":"string-128","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"reg add \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" /v svc /d evil.exe\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"wWebView2: CoreWebView2Environment failed when trying to LoadLibrary: hr=0x\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://learn.microsoft.com\", Found HTTPS url \"https://yudun.pages.dev\", Found HTTPS url \"https://localhost\", Found HTTPS url \"https://www.microsoft.com\", Found HTTPS url \"https://app.yudun.local\", Found HTTPS url \"https://xposedornot.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"Found string \" SMTP \" (Indicator: \"smtp\"; Source: \"sample.bin\"), Found string \"YUDUN_SMTP_\" (Indicator: \"smtp\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-499","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.0.0.0\", \"1.54.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"Ping\" (Indicator: \"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-417","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"ToPemEncoding\" (Indicator: \"PemEncoding\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"wWebView2: CoreWebView2Environment failed when trying to LoadLibrary: hr=0x\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileName\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Ping\" (Indicator: \"ping\"; Source: \"sample.bin\"), Found string \"hostName\" (Indicator: \"hostname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"System.Security.Cryptography.X509Certificates\" (Indicator: \"System.Security.Cryptography\"; Source: \"sample.bin\"), Found string \"FromBase64String\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"

YOUR FILES HAVE BEEN ENCRYPTED

\" (Source: sample.bin, Indicator: \"files have been encrypted\")","origin":"sample.bin","mitre_attack_id":"T1491.001","id":"string-13","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-106","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"--no-upload-gzip don't use gzip compression when uploading\" (Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found string \"--no-upload-gzip don't use gzip compression when uploading\" (Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")\n Found string \"DecompressionStream\" (Source: \"00000000-00005148.00000000.189261.00100000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"YuDun.exe\"\n Observed Namespace \"System.Windows.Forms.Control\" and MemberReference \"Hide\" in \"YuDun.exe\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"$2a","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"msedgewebview2.exe\" called \"FindResourceW\" with parameter \"103\" - (UID: 00000000-00007228)\n \"msedgewebview2.exe\" called \"FindResourceW\" with parameter \"186\" - (UID: 00000000-00007228)\n \"msedgewebview2.exe\" called \"FindResourceW\" with parameter \"189\" - (UID: 00000000-00007228)\n \"msedgewebview2.exe\" called \"FindResourceW\" with parameter \"391\" - (UID: 00000000-00007228)\n \"msedgewebview2.exe\" called \"FindResourceW\" with parameter \"393\" - (UID: 00000000-00007228)\n \"msedgewebview2.exe\" called \"FindResourceW\" with parameter \"58754\" - (UID: 00000000-00007228)\n \"msedgewebview2.exe\" called \"FindResourceW\" with parameter \"52325\" - (UID: 00000000-00007228)\n \"msedgewebview2.exe\" called \"FindResourceW\" with parameter \"52337\" - (UID: 00000000-00007228)\n \"msedgewebview2.exe\" called \"FindResourceW\" with parameter \"58755\" - (UID: 00000000-00007228)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"msedgewebview2.exe\" called \"RemoveDirectoryW\" with parameter %LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\ProvenanceData (UID: 00000000-00007228)\n \"msedgewebview2.exe\" called \"RemoveDirectoryW\" with parameter %LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\ProvenanceDataTensors (UID: 00000000-00007228)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to generate intermediate language instructions (Dotnet)","description":"Observed namespace \"System.Reflection.Emit.DynamicMethod\" and TypeReference \"GetILGenerator\" in \"Microsoft.Web.WebView2.Core.dll\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"Emit\" in \"Microsoft.Web.WebView2.Core.dll\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-171","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate a named-pipe client application (API string)","description":"Found reference to API \"ImpersonateNamedPipeClient\" (Indicator: \"ImpersonateNamedPipeClient\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"ImpersonateNamedPipeClient\" (Indicator: \"ImpersonateNamedPipeClient\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-165","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\"\n Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"YuDun.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00002368.00000000.189954.7C845000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"Microsoft.Web.WebView2.Core.dll\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe has big resource with name: \"payload/Microsoft.Web.WebView2.WinForms.dll\" size: \"38752\" and abnormal entropy:\"6.313555038114599\"\n ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe has big resource with name: \"payload/WebView2Loader.dll\" size: \"164704\" and abnormal entropy:\"6.202270803089459\"\n ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe has big resource with name: \"payload/YuDun.exe\" size: \"158208\" and abnormal entropy:\"6.247235937115333\"\n ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe has big resource with name: \"payload/app/pay-qr.png\" size: \"67807\" and abnormal entropy:\"7.930137694843477\"\n ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe has big resource with name: \"payload/app/js/signatures.js\" size: \"21492\" and abnormal entropy:\"6.169070845816497\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007288.00000000.184862.00332000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007288.00000000.184862.02A70000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"YuDun.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 96E70000\n \"msedgewebview2.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 96E70000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2f","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$30","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"$31","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"msedgewebview2.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007228-00000C2C-1127681529\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00007228-00000C2C-1129967043\")\n Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"00000000-00007228-00000C2C-1129967742\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"00000000-00007228-00000C2C-1134729438\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"Microsoft.Web.WebView2.Core.dll\"\n Observed function \"ToBase64String\" in \"YuDun.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"fromcharcode\"; File: \"engine.js\")\n Found reference to API \"fromCharCodeU\" (Indicator: \"fromcharcode\"; Source: \"00000000-00005148.00000000.189261.00020000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography.X509Certificates\" in [Source: \"Microsoft.Web.WebView2.Core.dll\"]\n Observed namespace \"System.Security.Cryptography\" in [Source: \"YuDun.exe\"]\n Observed namespace \"System.Security.Cryptography.X509Certificates\" in [Source: \"YuDun.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Cryptographic Related","name":"Dotnet code contains ability to generate random numbers","description":"Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"Create\" in \"YuDun.exe\"\n Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"GetBytes\" in \"YuDun.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-150","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - PowerShell with Base64 encoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$32","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$33","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"$34","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"YuDun.exe\"\n Observed dotnet function \"GetDirectories\" in \"YuDun.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"::GetUserNameW\" (Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found string \"BIOSVersion\" (Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found string \"OSVersionInformation\" (Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found string \"::GetUserNameW\" (Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found string \"BIOSVersion\" (Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")\n Found string \"OSVersionInformation\" (Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")\n Found string \"::GetUserNameW\" (Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"$35","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00007288-00000C2C-1067954067\")\n Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"EnumServicesStatusExW\" (Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found string \"EnumServicesStatusExW\" (Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00008036-00000C2C-1134743414\")\n Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007288)\n \"YuDun.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003388)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007288)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007288)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007288)\n \"YuDun.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003388)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"YuDun.exe\" called \"IsWow64Process\" with parameter \"3388\" - (UID: 00000000-00003388)\n \"msedgewebview2.exe\" called \"IsWow64Process\" with parameter \"7228\" - (UID: 00000000-00007228)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" called \"EnumWindows\" with parameter \"9425984\" - (UID: 00000000-00007288)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" called \"GetWindowTextW\" with parameter \"2k\" - (UID: 00000000-00007288)\n \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" called \"GetWindowTextW\" with parameter \"c65107592d4e2620\" - (UID: 00000000-00007288)\n \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" called \"GetWindowTextW\" with parameter \"ck(W\" - (UID: 00000000-00007288)\n \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" called \"GetWindowTextW\" with parameter \"895bc5888c5b10620e54065cea81a8522f54a8520cff765e28574c6862970e4e005fcb59dc8355531b52fa5eeb5f7763b9650f5f0230\" - (UID: 00000000-00007288)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"YuDun.exe\" called \"GetActiveWindow\" (UID: 00000000-00003388)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007288)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000005bdedb01258800005fb26aa2fe7f000000006784fe7f000001000000000000000100000000000000000000000000000038b28f0000000000e4e870a2fe7f0000803f6784fe7f00000000c5a4fe7f0000010000000000000000000000000000000100000000000000f4396784fe7f000078000000 (UID: 00000000-00007288)\n \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f023000002000000007f000000000000000000000100000000000000c05f1189fe7f00000001000000000000b85f1189fe7f00000000000000000000409df1a3fe7f0000000000000000000000010000000000000e2d7847ec59000000006784fe7f00000100000000000000df101089fe7f00000000000000000000b85f1189fe7f000000000000 (UID: 00000000-00007288)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007288)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"GetEnvironmentVariable\" in \"YuDun.exe\"\n Observed function \"GetEnvironmentVariable\" in \"Microsoft.Web.WebView2.WinForms.dll\"\n Observed function \"SetEnvironmentVariable\" in \"Microsoft.Web.WebView2.WinForms.dll\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"YuDun.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"YuDun.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"msedgewebview2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"msedgewebview2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"YuDun.exe\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-152","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to BIOS","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\BIOS\" (Indicator: \"hardware\\description\\system\\bios\") in Source: 00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\n Observed string: \"HARDWARE\\DESCRIPTION\\System\\BIOS\" (Indicator: \"hardware\\description\\system\\bios\") in Source: 00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-350","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"Hardware\\Description\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\n Observed string: \"Hardware\\Description\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %LOCALAPPDATA%\\YUDUNPCMANAGER\\WEBVIEW2LOADER.DLL\n WEBVIEW2LOADER.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"msedgewebview2.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D27478B9-2058-11E8-B41F-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")\n \"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" queried token user identity (UID: 00000000-00007288)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$40","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"YuDun.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"msedgewebview2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"YuDun.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"msedgewebview2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\YUDUN.EXE\")\n \"msedgewebview2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CHROME.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to identify Internet Explorer version from registry","description":"\"msedgewebview2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\"; Key: \"VERSION\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-103","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"YuDun.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValueNames\" in \"YuDun.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"YuDun.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":".NET source code contains suspicious native API","description":"Observed API \"LoadLibrary\" in \"Microsoft.Web.WebView2.Core.dll\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":5,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\"\n Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"YuDun.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"file/memory contains long string(File: \"YuDun.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"WebView2Loader.dll\")\n file/memory contains long string(File: \"YuDun.exe\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$42","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"msedgewebview2.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$43","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\YuDunPCManager\\YuDun.exe\"\" - (UID: 00000000-00007288)\n \"YuDun.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe\" --embedded-browser-webview=1 --webview\" - (UID: 00000000-00003388)\n \"msedgewebview2.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe\" --type=utility --utility-sub-type=netw\" - (UID: 00000000-00007228)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"$44","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$45","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"$46","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"file/memory contains long string with (Indicator: \"GetExecutingAssembly\"; File: \"YuDun.exe\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"RegDisablePredefinedCache\" (Indicator: \"RegDisablePredefinedCache\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")\n Found reference to API \"RegDisablePredefinedCache\" (Indicator: \"RegDisablePredefinedCache\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadDataTaskAsync\" in \"YuDun.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Contains ability to run commands or expressions (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Invoke-Expression\"; File: \"signatures.js\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-288","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"YuDun.exe\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"AttemptToNotifyRunningChrome:GetWindowThreadProcessId failed\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"AttemptToNotifyRunningChrome:GetWindowThreadProcessId failed\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\"\n Observed function \"Process.Start\" in \"YuDun.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"WebView2Loader.dll\" contains export function called \"CompareBrowserVersions\" at ordinal 1\n \"WebView2Loader.dll\" contains export function called \"CreateCoreWebView2Environment\" at ordinal 2\n \"WebView2Loader.dll\" contains export function called \"CreateCoreWebView2EnvironmentWithOptions\" at ordinal 3\n \"WebView2Loader.dll\" contains export function called \"GetAvailableCoreWebView2BrowserVersionString\" at ordinal 4\n \"WebView2Loader.dll\" contains export function called \"GetAvailableCoreWebView2BrowserVersionStringWithOptions\" at ordinal 5","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$4e","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"YuDun.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"YuDun.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"YuDun.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"Microsoft.Web.WebView2.Core.dll\" as clean (type is \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"), Antivirus vendors marked dropped file \"WebView2Loader.dll\" as clean (type is \"PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections\"), Antivirus vendors marked dropped file \"Microsoft.Web.WebView2.WinForms.dll\" as clean (type is \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$4f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$50","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$51","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"$52","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$53","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$54","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\6078762b90671c2ff9ba39318e2176d8\\mscorlib.ni.dll\" at 78460000\n \"YuDun.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\6078762b90671c2ff9ba39318e2176d8\\mscorlib.ni.dll\" at 78460000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at A22D0000\n \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A24A0000\n \"YuDun.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at A22D0000\n \"YuDun.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A24A0000\n \"msedgewebview2.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A24A0000\n \"msedgewebview2.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at A22D0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 79AC0000\n \"YuDun.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 79AC0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at A4AB0000\n \"YuDun.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at A4AB0000\n \"msedgewebview2.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at A4AB0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a387a2fe7f0000@ntdll.dll\"\n \"220023000000000038a387a2fe7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" was detected as \".NET\" and name: \"Library\"\n \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"Microsoft.Web.WebView2.Core.dll\" was detected as \".NET\" and name: \"Library\"\n \"Microsoft.Web.WebView2.Core.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"WebView2Loader.dll\" was detected as \".NET\" and name: \"Library\"\n \"WebView2Loader.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"YuDun.exe\" was detected as \".NET\" and name: \"Library\"\n \"YuDun.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"Microsoft.Web.WebView2.WinForms.dll\" was detected as \".NET\" and name: \"Library\"\n \"Microsoft.Web.WebView2.WinForms.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$55","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"Microsoft.Web.WebView2.Core.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"YuDun.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"Microsoft.Web.WebView2.WinForms.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"Microsoft.Web.WebView2.Core.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"WebView2Loader.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"Microsoft.Web.WebView2.WinForms.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" has an executable section named \".text\"\n \"Microsoft.Web.WebView2.Core.dll\" has an executable section named \".text\"\n \"WebView2Loader.dll\" has an executable section named \".text\"\n \"YuDun.exe\" has an executable section named \".text\"\n \"Microsoft.Web.WebView2.WinForms.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"WebView2Loader.dll\" has an writable section named \".data\"\n \"WebView2Loader.dll\" has an writable section named \".fptable\"\n \"WebView2Loader.dll\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$56","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x1dc800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x1dc634\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"WebView2Loader.dll\" has high imagebase \"0x180000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$57","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"app.yudun.local\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$58","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"YuDun.exe\" searching for class \"Shell_TrayWnd\"\n \"YuDun.exe\" searching for class \"Chrome_MessageWindow\"\n \"YuDun.exe\" searching for class \"ApplicationManager_DesktopShellWindow\"\n \"msedgewebview2.exe\" searching for class \"Chrome_MessageWindow\"\n \"msedgewebview2.exe\" searching for class \"ApplicationManager_DesktopShellWindow\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$5a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$5b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"YuDun.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"msedgewebview2.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\sslkey.txt\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"YuDun.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"msedgewebview2.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$5c","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$5d","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$5e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"Microsoft.Web.WebView2.Core.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%LOCALAPPDATA%\\YuDunPCManager\\Microsoft.Web.WebView2.Core.dll]- [targetUID: 00000000-00007288]\n \"WebView2Loader.dll\" has type \"PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections\"- Location: [%LOCALAPPDATA%\\YuDunPCManager\\WebView2Loader.dll]- [targetUID: 00000000-00007288]\n \"Microsoft.Web.WebView2.WinForms.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%LOCALAPPDATA%\\YuDunPCManager\\Microsoft.Web.WebView2.WinForms.dll]- [targetUID: 00000000-00007288]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" queries basic process information of the \"C:\\ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" (UID: 7288)\n \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\YuDunPCManager\\YuDun.exe\" (UID: 7288)\n \"YuDun.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\YuDunPCManager\\YuDun.exe\" (UID: 3388)\n \"YuDun.exe\" queries basic process information of the \"C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe\" (UID: 3388)\n \"YuDun.exe\" queries basic process information of the \"C:\\Windows\\System32\\svchost.exe\" (UID: 3388)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$5f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$60","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Calls an API typically used to find device information\n Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$61","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\Desktop\\??????.lnk\"\n \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" trying to access LNK file \"%USERPROFILE%\\Desktop\\??????.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$62","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$63","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$64","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"$65","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files (.NET)","description":"Observed dotnet function \"WebRequest.GetResponse\" in \"YuDun.exe\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"YuDun.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":7,"id":"static-201","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Able to hide C2 connections by leveraging external proxy routing","description":"file/memory contains long string with (Indicator: \"entropy.exe\"; File: \"engine.js\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-719","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Able to use vulnerability or port scanning tools","description":"file/memory contains long string with (Indicator: \"nmap -sc\"; File: \"signatures.js\")","origin":"File/Memory","mitre_attack_id":"T1595.002","relevance":1,"id":"string-996","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"Observed Namespace \"System.Net.Sockets.TcpListener\" and MemberReference \"AcceptTcpClient\" in \"YuDun.exe\"\n Observed Namespace \"System.Net.Sockets.TcpClient\" and MemberReference \"Close\" in \"YuDun.exe\"\n Observed Namespace \"System.Net.Sockets.TcpListener\" and MemberReference \".ctor\" in \"YuDun.exe\"\n Observed Namespace \"System.Net.Sockets.TcpListener\" and MemberReference \"Start\" in \"YuDun.exe\"\n Observed Namespace \"System.Net.Sockets.TcpClient\" and MemberReference \"set_ReceiveTimeout\" in \"YuDun.exe\"\n Observed Namespace \"System.Net.Sockets.TcpClient\" and MemberReference \"set_SendTimeout\" in \"YuDun.exe\"\n Observed Namespace \"System.Net.Sockets.TcpClient\" and MemberReference \"GetStream\" in \"YuDun.exe\"\n Observed Namespace \"System.Net.Sockets.TcpClient\" and MemberReference \"get_Client\" in \"YuDun.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Receive\" in \"YuDun.exe\"","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"YuDun.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"get_Headers\" in \"YuDun.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadDataTaskAsync\" in \"YuDun.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"CancelAsync\" in \"YuDun.exe\"\n Observed Namespace \"System.Net.HttpWebRequest\" and MemberReference \"set_ReadWriteTimeout\" in \"YuDun.exe\"\n Observed Namespace \"System.Net.HttpWebRequest\" and MemberReference \"set_UserAgent\" in \"YuDun.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Receive\" in \"YuDun.exe\"","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"edgeInternetConnectivityPrivate\" (Indicator: \"InternetConnect\"; Source: \"00000000-00005148.00000000.189261.0004C000.00000004.mdmp, 00000000-00005148.00000000.189261.00120000.00000004.mdmp, 00000000-00005148.00000000.189261.005EC000.00000004.mdmp\")\n Found reference to API \"permission:edgeInternetConnectivityPrivate\" (Indicator: \"InternetConnect\"; Source: \"00000000-00005148.00000000.189261.0056C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to perform email related activity (Dotnet)","description":"$68","origin":"Static Parser","mitre_attack_id":"T1071.003","relevance":1,"id":"static-160","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"Microsoft.Web.WebView2.Core.dll\"\n Observed namespace \"System.Net\" in \"YuDun.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \"gethostbyname\"; File: \"signatures.js\")\n Found reference to API \"forged shutdown request, got:\" (Indicator: \" shutdown \"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"forged shutdown request, got:\" (Indicator: \" shutdown \"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \".googleapis.com\"; File: \"index.html\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"details too long to display","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005148.00000000.189261.00544000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Identified known pipe name","description":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00007228-00000CCE-1126176370\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":3,"id":"string-735","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7\n Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://localhost:86\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Pattern Matching","name":"Detected EICAR test file artifact","description":"$6a","origin":"File/Memory","relevance":10,"id":"string-22","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – high entropy image embedded in .NET resource","description":"YARA signature for high entropy images embedded in resource file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-214","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"CreateWindowStationW\" (Indicator: \"CreateWindowStation\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")\n Found reference to API \"CreateWindowStationW\" (Indicator: \"CreateWindowStation\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"::WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"::WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"::WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access password managers","description":"file/memory contains long string with (Indicator: \"1password\"; File: \"Login Data\")","origin":"File/Memory","mitre_attack_id":"T1555.005","relevance":3,"id":"string-10057","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"file/memory contains long string with (Indicator: \"--user-data-dir\"; File: \"msedgewebview2.exe\")\n Found string \"--user-data-dir=\" (Indicator: \"--user-data-dir\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"--user-data-dir\"; Source: \"00000000-00005148.00000000.189261.00114000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: WebView2Loader.dll]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"file/memory contains long string(File: \"YuDun.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"msedgewebview2.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 99620000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$6d","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"YuDun.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"msedgewebview2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" called \"GetComputerNameW\" (UID: 00000000-00007288)\n \"msedgewebview2.exe\" called \"GetComputerNameW\" (UID: 00000000-00007228)\n \"msedgewebview2.exe\" called \"GetComputerNameW\" (UID: 00000000-00008036)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"YuDun.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"msedgewebview2.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"msedgewebview2.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_PrimaryScreen\" in \"YuDun.exe\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-164","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessById\" in \"YuDun.exe\"\n Observed function \"get_ProcessName\" in \"YuDun.exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002368.00000000.189954.7C845000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"__crtGetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002368.00000000.189954.7C845000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002368.00000000.189954.7C845000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$70","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Microsoft\\Windows\\CurrentVersion\\App Paths\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00000456.00000000.190611.779C2000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"PRUNINGMODE\")\n \"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PROFILEENUMMODE\")\n \"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"ICMPROFILE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\"\n Found registry deletion API: \"NtDeleteKey\" in \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\"\n Found registry deletion API: \"NtDeleteValueKey\" in \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"YuDun.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003388)\n \"msedgewebview2.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007228)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\DeviceApi\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found string \"\\Device\\KsecDD\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00004252.00000000.188720.85400000.00000004.mdmp, 00000000-00004252.00000001.190639.85400000.00000004.mdmp\")\n Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004252.00000000.188720.85400000.00000004.mdmp, 00000000-00004252.00000001.190639.85400000.00000004.mdmp\")\n Found string \"\\Device\\DeviceApi\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")\n Found string \"\\Device\\KsecDD\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcessWithToken\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"$74","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$75","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$76","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"msedgewebview2.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" opened \"\\Device\\KsecDD\"\n \"YuDun.exe\" opened \"\\Device\\KsecDD\"\n \"msedgewebview2.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$77","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$78","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00000456.00000000.190611.779C2000.00000002.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002740.00000000.190796.E6A0A000.00000002.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004252.00000000.188720.E6A0A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$79","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"pay-qr.png\" has type \"PNG image data 628 x 628 8-bit/color RGBA non-interlaced\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$7a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"Microsoft.Web.WebView2.Core.dll\" was detected as \"Microsoft Visual C# / Basic .NET\"\n \"YuDun.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"Microsoft.Web.WebView2.WinForms.dll\" was detected as \"Microsoft Visual C# / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".tls\" has very low entropy (0.02)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" at 00000000-00007288-00000C15-1069197601\n \"msedgewebview2.exe\" at 00000000-00007228-00000C15-1130031283","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"\"YuDun.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\YUDUN\\DEFAULTICON\"; Key: \"(DEFAULT)\"; Value: \"\"%LOCALAPPDATA%\\YuDunPCManager\\YuDun.exe\"\n1\"), \"YuDun.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\YUDUN\\SHELL\\OPEN\\COMMAND\"; Key: \"(DEFAULT)\"; Value: \"\"%LOCALAPPDATA%\\YuDunPCManager\\YuDun.exe\" \"%1\"\")","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"YuDun.exe\" has section name .rsrc with entropy \"7.567684036767468\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads VM-specific registry key","description":"\"YuDun.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"VMWARE USER PROCESS\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-33","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"8/26 Antivirus vendors marked sample as malicious (30% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"YuDun.exe\" has resource with unusual entropy \"RT_ICON:7.4315386636622796\"\n \"YuDun.exe\" has resource with unusual entropy \"RT_ICON:7.698987581503241\"\n \"YuDun.exe\" has resource with unusual entropy \"RT_ICON:7.7540595568174515\"\n \"YuDun.exe\" has resource with unusual entropy \"RT_ICON:7.7383003803737545\"\n \"YuDun.exe\" has resource with unusual entropy \"RT_ICON:7.616076683686735\"\n \"YuDun.exe\" has resource with unusual entropy \"RT_ICON:7.399377030415703\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Microsoft.Web.WebView2.Core.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%LOCALAPPDATA%\\YuDunPCManager\\Microsoft.Web.WebView2.Core.dll]- [targetUID: 00000000-00007288]\n \"WebView2Loader.dll\" has type \"PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections\"- Location: [%LOCALAPPDATA%\\YuDunPCManager\\WebView2Loader.dll]- [targetUID: 00000000-00007288]\n \"YuDun.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%LOCALAPPDATA%\\YuDunPCManager\\YuDun.exe]- [targetUID: 00000000-00007288]\n \"Microsoft.Web.WebView2.WinForms.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%LOCALAPPDATA%\\YuDunPCManager\\Microsoft.Web.WebView2.WinForms.dll]- [targetUID: 00000000-00007288]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$7b","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to retrieve NetBIOS or DNS name associated with the local computer","description":"\"msedgewebview2.exe\" called \"GetComputerNameExW\" with parameters {\"NameType\": \"1\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-287","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[]) at 5a5ac9624714a1a27abac8221dabd3b3-6000006-InstallForm~CreateShortcut","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"Network Related","name":"Reads the hosts file","description":"\"msedgewebview2.exe\" read 4096 bytes from file \"C:\\Windows\\System32\\drivers\\etc\\hosts\"","origin":"API Call","mitre_attack_id":"T1018","relevance":10,"id":"api-33","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe\" connects to 135.233.45.222 on port 443 (TCP)\n Process \"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe\" connects to 52.123.251.28 on port 443 (TCP)\n Process \"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe\" connects to 52.228.161.161 on port 443 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_GENRansomware\" matched file \"YuDun.exe\" as \"Detects command variations typically used by ransomware\"\n YARA signature \"INDICATOR_EXE_Packed_Enigma\" matched file \"sample.bin\" as \"Detects executables packed with Enigma\"\n YARA signature \"INDICATOR_EXE_Packed_VMProtect\" matched file \"sample.bin\" as \"Detects executables packed with VMProtect.\"\n YARA signature \"INDICATOR_EXE_Packed_Themida\" matched file \"sample.bin\" as \"Detects executables packed with Themida\"\n YARA signature \"INDICATOR_SUSPICIOUS_GENRansomware\" matched file \"sample.bin\" as \"Detects command variations typically used by ransomware\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to delete volume snapshots","description":"file/memory contains long string(File: \"signatures.js\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-634","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$7c","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"WebView2Loader.dll\" claimed CRC 698662 while the actual is CRC 183456\n \"YuDun.exe\" claimed CRC 183456 while the actual is CRC 185927","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryExW\n LoadLibraryW\n TerminateProcess\n IsDebuggerPresent\n GetModuleHandleW\n VirtualProtect\n OutputDebugStringA\n GetModuleHandleExW\n GetModuleFileNameW\n GetSystemInfo\n GetStartupInfoW\n SleepConditionVariableSRW\n FindFirstFileW\n GetCommandLineW\n UnhandledExceptionFilter\n GetProcAddress\n CreateFileW\n FindFirstFileExW\n LoadLibraryExA\n FindNextFileW\n OutputDebugStringW\n GetCommandLineA\n GetFileAttributesW\n WriteFile","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"Microsoft.Web.WebView2.WinForms.dll\" claims program is from Sun Mar 26 06:17:39 2062","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\YuDunPCManager\\YuDun.exe\"\" - (UID: 00000000-00007288)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$7d","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_AsyncRAT\" matched process \"00000000-00007288\" as \"Detects AsyncRAT\"\n YARA signature \"MALWARE_Win_AsyncRAT\" matched file \"sample.bin\" as \"Detects AsyncRAT\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"details too long to display","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Reads VM-specific registry key"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]}],"intel_graph":{"map":{"Domain:app.yudun.local":{"type":"Domain","value":"app.yudun.local"},"File:03c261333b9a5d80e8f87ac2344aee9d1e71f13e1a0221bac81ae4d78ba54547":{"type":"File","value":"03c261333b9a5d80e8f87ac2344aee9d1e71f13e1a0221bac81ae4d78ba54547"},"File:2fd56ca98c9be54668606408530261c1ae326748cf389ed5261e88bad964687b":{"type":"File","value":"2fd56ca98c9be54668606408530261c1ae326748cf389ed5261e88bad964687b"},"File:41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304":{"type":"File","value":"41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304"},"File:653104f47a4b738b58d7057099697a9da4bc17d84be549feab9f5f93ee220f16":{"type":"File","value":"653104f47a4b738b58d7057099697a9da4bc17d84be549feab9f5f93ee220f16"},"File:958efdb7f13a6d1f3079756c96956cc96cf713ae46fa085c8b1e7f44316a4f7e":{"type":"File","value":"958efdb7f13a6d1f3079756c96956cc96cf713ae46fa085c8b1e7f44316a4f7e"},"File:a54194473bad1db6ad6c80af26eb9e116c1fcececde196f84c049a12fbe3b31a":{"type":"File","value":"a54194473bad1db6ad6c80af26eb9e116c1fcececde196f84c049a12fbe3b31a"},"File:a7b8be525030f19d9e88c6e684bca053dc7a3b080c31c3d9428f7438e7b6768f":{"type":"File","value":"a7b8be525030f19d9e88c6e684bca053dc7a3b080c31c3d9428f7438e7b6768f"},"File:a9a09232c25805323d4cfb3fc8f545a190a9c8a99c93262ea99d0b88df99ec90":{"type":"File","value":"a9a09232c25805323d4cfb3fc8f545a190a9c8a99c93262ea99d0b88df99ec90"},"File:ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c":{"type":"File","value":"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","verdict":{"verdict":"suspicious","verdict_source":"static file analysis engine","reasons":["Associated with known suspicious activity"]},"filetype":"PE32 executable for MS Windows 4.00 (GUI), Intel i386 Mono/.Net assembly, 3 sections","filetype_short":"PE32"},"File:aff48d20a556fbadd3bd39aef4a2574195574f9f73a89df3158175e582ebaaa7":{"type":"File","value":"aff48d20a556fbadd3bd39aef4a2574195574f9f73a89df3158175e582ebaaa7"},"File:b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec":{"type":"File","value":"b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec"},"File:c24d0ad74c25c1adc847380437dd19ecebee83753c93839f023091039c11e283":{"type":"File","value":"c24d0ad74c25c1adc847380437dd19ecebee83753c93839f023091039c11e283"},"File:d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e":{"type":"File","value":"d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e"},"File:e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c":{"type":"File","value":"e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c"},"File:ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7":{"type":"File","value":"ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7"},"File:fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d":{"type":"File","value":"fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d"}},"chains":[{"id":"1563528359484846263","root":"File:ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","edges":[],"verdict":{"verdict":"suspicious","verdict_source":"static file analysis engine","reasons":["Associated with known suspicious activity"]}},{"id":"sandbox_network","root":"File:ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","edges":[{"edge_kind":"contacted_domain","from_key":"File:ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","to_key":"Domain:app.yudun.local"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","edges":[{"edge_kind":"extracted","from_key":"File:ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","to_key":"File:2fd56ca98c9be54668606408530261c1ae326748cf389ed5261e88bad964687b"},{"edge_kind":"extracted","from_key":"File:ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","to_key":"File:958efdb7f13a6d1f3079756c96956cc96cf713ae46fa085c8b1e7f44316a4f7e"},{"edge_kind":"extracted","from_key":"File:ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","to_key":"File:a7b8be525030f19d9e88c6e684bca053dc7a3b080c31c3d9428f7438e7b6768f"},{"edge_kind":"extracted","from_key":"File:ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","to_key":"File:a9a09232c25805323d4cfb3fc8f545a190a9c8a99c93262ea99d0b88df99ec90"},{"edge_kind":"extracted","from_key":"File:ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","to_key":"File:a54194473bad1db6ad6c80af26eb9e116c1fcececde196f84c049a12fbe3b31a"},{"edge_kind":"extracted","from_key":"File:ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","to_key":"File:b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec"},{"edge_kind":"extracted","from_key":"File:ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","to_key":"File:653104f47a4b738b58d7057099697a9da4bc17d84be549feab9f5f93ee220f16"},{"edge_kind":"extracted","from_key":"File:ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","to_key":"File:41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304"},{"edge_kind":"extracted","from_key":"File:ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","to_key":"File:aff48d20a556fbadd3bd39aef4a2574195574f9f73a89df3158175e582ebaaa7"},{"edge_kind":"extracted","from_key":"File:ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","to_key":"File:c24d0ad74c25c1adc847380437dd19ecebee83753c93839f023091039c11e283"},{"edge_kind":"extracted","from_key":"File:ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","to_key":"File:fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d"},{"edge_kind":"extracted","from_key":"File:ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","to_key":"File:03c261333b9a5d80e8f87ac2344aee9d1e71f13e1a0221bac81ae4d78ba54547"},{"edge_kind":"extracted","from_key":"File:ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","to_key":"File:d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e"},{"edge_kind":"extracted","from_key":"File:ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","to_key":"File:ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7"},{"edge_kind":"extracted","from_key":"File:ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","to_key":"File:e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":60,"spawned_processes_count":60,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":86,"imported_dlls_count":155,"dropped_files_count":0,"extracted_files_count":15,"files_written_count":149,"files_deleted_count":0,"registry_keys_created_count":15,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":15,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["kryptik","genkryptik","stealer","hiddentear","ransomware","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"6adca33714703825360372e2","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Lazy","submit_name":"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe","analysis_start_time":"2026-10-24T12:23:20+00:00","indicators_count":{"informative":267,"suspicious":65,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"app.yudun.local","country":"-","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}],"processes":[{"pid":7288,"ppid":0,"name":"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe","command_line":"","sha256":"ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c","normalized_path":"C:\\ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c.exe","uid":"00000000-00007288","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":3388,"ppid":7288,"name":"YuDun.exe","command_line":"","sha256":"2fd56ca98c9be54668606408530261c1ae326748cf389ed5261e88bad964687b","normalized_path":"%LOCALAPPDATA%\\YuDunPCManager\\YuDun.exe","parent_uid":"00000000-00007288","uid":"00000000-00003388"},{"pid":7228,"ppid":3388,"name":"msedgewebview2.exe","command_line":"--embedded-browser-webview=1 --webview-exe-name=YuDun.exe --webview-exe-version=1.54.0.0 --user-data-dir=\"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --mojo-named-platform-channel-pipe=3388.2140.3844785736939200741","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00003388","uid":"00000000-00007228"},{"pid":4252,"ppid":7228,"name":"msedgewebview2.exe","command_line":"--type=crashpad-handler --user-data-dir=%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=141.0.7390.66 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe\" --annotation=plat=Win64 \"--annotation=prod=Edge WebView2\" --annotation=ver=141.0.3537.71 --initial-client-data=0x1f0,0x1f4,0x1f8,0x144,0x1fc,0x7ffe77a8a9d8,0x7ffe77a8a9e4,0x7ffe77a8a9f0","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00004252"},{"pid":8424,"ppid":7228,"name":"msedgewebview2.exe","command_line":"$7e","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00008424"},{"pid":6696,"ppid":8424,"name":"WerFault.exe","command_line":"-u -p 8424 -s 392","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008424","uid":"00000000-00006696"},{"pid":8036,"ppid":7228,"name":"msedgewebview2.exe","command_line":"$7f","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00008036"},{"pid":8976,"ppid":7228,"name":"msedgewebview2.exe","command_line":"$80","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00008976"},{"pid":8840,"ppid":8976,"name":"WerFault.exe","command_line":"-u -p 8976 -s 388","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008976","uid":"00000000-00008840"},{"pid":5148,"ppid":7228,"name":"msedgewebview2.exe","command_line":"$81","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00005148"},{"pid":2144,"ppid":7228,"name":"msedgewebview2.exe","command_line":"$82","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00002144"},{"pid":8336,"ppid":2144,"name":"WerFault.exe","command_line":"-u -p 2144 -s 396","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002144","uid":"00000000-00008336"},{"pid":444,"ppid":7228,"name":"msedgewebview2.exe","command_line":"$83","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00000444"},{"pid":8248,"ppid":444,"name":"WerFault.exe","command_line":"-u -p 444 -s 340","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00000444","uid":"00000000-00008248"},{"pid":8572,"ppid":7228,"name":"msedgewebview2.exe","command_line":"$84","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00008572"},{"pid":7500,"ppid":8572,"name":"WerFault.exe","command_line":"-u -p 8572 -s 416","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008572","uid":"00000000-00007500"},{"pid":2260,"ppid":7228,"name":"msedgewebview2.exe","command_line":"$85","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00002260"},{"pid":4256,"ppid":2260,"name":"WerFault.exe","command_line":"-u -p 2260 -s 396","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002260","uid":"00000000-00004256"},{"pid":2368,"ppid":7228,"name":"msedgewebview2.exe","command_line":"$86","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00002368"},{"pid":1004,"ppid":2368,"name":"WerFault.exe","command_line":"-u -p 2368 -s 416","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002368","uid":"00000000-00001004"},{"pid":6740,"ppid":7228,"name":"msedgewebview2.exe","command_line":"$87","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00006740"},{"pid":7824,"ppid":6740,"name":"WerFault.exe","command_line":"-u -p 6740 -s 388","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00006740","uid":"00000000-00007824"},{"pid":8060,"ppid":7228,"name":"msedgewebview2.exe","command_line":"$88","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00008060"},{"pid":9112,"ppid":8060,"name":"WerFault.exe","command_line":"-u -p 8060 -s 392","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008060","uid":"00000000-00009112"},{"pid":1840,"ppid":7228,"name":"msedgewebview2.exe","command_line":"$89","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00001840"},{"pid":2756,"ppid":1840,"name":"WerFault.exe","command_line":"-u -p 1840 -s 380","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00001840","uid":"00000000-00002756"},{"pid":456,"ppid":7228,"name":"msedgewebview2.exe","command_line":"$8a","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00000456"},{"pid":6452,"ppid":456,"name":"WerFault.exe","command_line":"-u -p 456 -s 396","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00000456","uid":"00000000-00006452"},{"pid":2740,"ppid":7228,"name":"msedgewebview2.exe","command_line":"$8b","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00002740"},{"pid":8340,"ppid":2740,"name":"WerFault.exe","command_line":"-u -p 2740 -s 380","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002740","uid":"00000000-00008340"},{"pid":4560,"ppid":7228,"name":"msedgewebview2.exe","command_line":"$8c","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00004560"},{"pid":9024,"ppid":4560,"name":"WerFault.exe","command_line":"-u -p 4560 -s 312","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00004560","uid":"00000000-00009024"},{"pid":2420,"ppid":7228,"name":"msedgewebview2.exe","command_line":"$8d","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00002420"},{"pid":2612,"ppid":2420,"name":"WerFault.exe","command_line":"-u -p 2420 -s 380","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002420","uid":"00000000-00002612"},{"pid":8136,"ppid":7228,"name":"msedgewebview2.exe","command_line":"$8e","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00008136"},{"pid":5976,"ppid":8136,"name":"WerFault.exe","command_line":"-u -p 8136 -s 392","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008136","uid":"00000000-00005976"},{"pid":7232,"ppid":7228,"name":"msedgewebview2.exe","command_line":"$8f","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00007232"},{"pid":1756,"ppid":7232,"name":"WerFault.exe","command_line":"-u -p 7232 -s 376","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00007232","uid":"00000000-00001756"},{"pid":4996,"ppid":7228,"name":"msedgewebview2.exe","command_line":"$90","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00004996"},{"pid":7808,"ppid":4996,"name":"WerFault.exe","command_line":"-u -p 4996 -s 396","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00004996","uid":"00000000-00007808"},{"pid":8844,"ppid":7228,"name":"msedgewebview2.exe","command_line":"$91","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00007228","uid":"00000000-00008844"},{"pid":2156,"ppid":8844,"name":"WerFault.exe","command_line":"-u -p 8844 -s 380","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008844","uid":"00000000-00002156"},{"pid":2460,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 236 -p 8424 -ip 8424","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00002460","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":1760,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 432 -p 8976 -ip 8976","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00001760","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":7908,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 588 -p 2144 -ip 2144","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007908","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":3480,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 604 -p 444 -ip 444","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00003480","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":8872,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 612 -p 8572 -ip 8572","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00008872","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":5136,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 612 -p 2260 -ip 2260","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00005136","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":7804,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 644 -p 2368 -ip 2368","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007804","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":7812,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 644 -p 6740 -ip 6740","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007812","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":2380,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 644 -p 8060 -ip 8060","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00002380","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":7184,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 656 -p 1840 -ip 1840","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007184","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":6068,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 696 -p 456 -ip 456","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00006068","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":3356,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 692 -p 2740 -ip 2740","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00003356","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":2804,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 644 -p 4560 -ip 4560","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00002804","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":2776,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 584 -p 2420 -ip 2420","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00002776","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":900,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 636 -p 8136 -ip 8136","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00000900","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":1188,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 576 -p 7232 -ip 7232","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00001188","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":8488,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 612 -p 4996 -ip 4996","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00008488","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":3532,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 696 -p 8844 -ip 8844","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00003532","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="}],"all_imported_dlls":["vcruntime140_clr0400.dll","WindowsCodecs.dll","umpdc.dll","Windows.UI.dll","mswsock.dll","bcryptprimitives.dll","winmm.dll","nlaapi.dll","wintrust.dll","kernel32.dll","GdiPlus.dll","Windows.StateRepositoryPS.dll","msasn1.dll","DataExchange.dll","msedge.dll","mscoree.dll","gdi32full.dll","aadWamExtension.dll","directmanipulation.dll","omadmapi.dll","msvcp_win.dll","kernel.appcore.dll","clrjit.dll","System.Windows.Forms.ni.dll","linkinfo.dll","OneCoreUAPCommonProxyStub.dll","gpapi.dll","virtdisk.dll","IPHLPAPI.DLL","oneds.dll","imm32.dll","TextShaping.dll","WebView2Loader.dll","winsta.dll","dcomp.dll","Windows.Security.Authentication.OnlineId.dll","user32.dll","slc.dll","crypt32.dll","devobj.dll","vcruntime140_1.dll","AppResolver.dll","ws2_32.dll","shell32.dll","cryptbase.dll","CoreMessaging.dll","imagehlp.dll","Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient.dll","apphelp.dll","win32u.dll","SHCore.dll","profapi.dll","IconCodecService.dll","rasadhlp.dll","DWrite.dll","edputil.dll","msedge_elf.dll","vcruntime140.dll","sxs.dll","BCP47Langs.dll","dnsapi.dll","Windows.StateRepositoryCore.dll","samcli.dll","msvcp140.dll","sechost.dll","wldp.dll","urlmon.dll","sppc.dll","EmbeddedBrowserWebView.dll","twinapi.appcore.dll","KBDUS.DLL","telclient.dll","setupapi.dll","npmproxy.dll","fltLib.dll","mscorlib.ni.dll","mdmregistration.dll","dmcmnutils.dll","coloradapterclient.dll","KernelBase.dll","clr.dll","System.Xml.ni.dll","rsaenh.dll","comctl32.dll","dbghelp.dll","Windows.Security.Authentication.Web.Core.dll","combase.dll","ucrtbase_clr0400.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","mscms.dll","psapi.dll","clbcatq.dll","dsreg.dll","policymanager.dll","ffmpeg.dll","ntasn1.dll","rpcrt4.dll","shlwapi.dll","mscoreei.dll","System.Drawing.ni.dll","System.Core.ni.dll","System.Configuration.ni.dll","cfgmgr32.dll","ucrtbase.dll","WinTypes.dll","propsys.dll","cscapi.dll","dxgi.dll","ntdll.dll","ntmarta.dll","ntshrui.dll","WindowManagementAPI.dll","msctf.dll","mpr.dll","wkscli.dll","dhcpcsvc6.dll","advapi32.dll","System.ni.dll","powrprof.dll","atlthunk.dll","netprofm.dll","ole32.dll","iertutil.dll","userenv.dll","ncrypt.dll","dhcpcsvc.dll","MicrosoftAccountWAMExtension.dll","oleaut32.dll","msvcp110_win.dll","gdi32.dll","windows.storage.dll","TextInputFramework.dll","InputHost.dll","wtsapi32.dll","version.dll","FWPUCLNT.DLL","msvcrt.dll","sspicli.dll","netapi32.dll","bcrypt.dll","uxtheme.dll","CoreUIComponents.dll","nsi.dll","winhttp.dll","d3d11.dll","scrrun.dll","netutils.dll","oleacc.dll","dpapi.dll","VxSSL64.dll","cryptsp.dll","srvcli.dll","OneCoreCommonProxyStub.dll","twinapi.dll","tbs.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"YuDun.exe","sha256":"2fd56ca98c9be54668606408530261c1ae326748cf389ed5261e88bad964687b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"Microsoft.Web.WebView2.Core.dll","sha256":"958efdb7f13a6d1f3079756c96956cc96cf713ae46fa085c8b1e7f44316a4f7e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"Microsoft.Web.WebView2.WinForms.dll","sha256":"a7b8be525030f19d9e88c6e684bca053dc7a3b080c31c3d9428f7438e7b6768f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"WebView2Loader.dll","sha256":"a9a09232c25805323d4cfb3fc8f545a190a9c8a99c93262ea99d0b88df99ec90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"metadata","sha256":"a54194473bad1db6ad6c80af26eb9e116c1fcececde196f84c049a12fbe3b31a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"data_1","sha256":"b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"settings.dat","sha256":"653104f47a4b738b58d7057099697a9da4bc17d84be549feab9f5f93ee220f16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"throttle_store.dat","sha256":"41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"0292e61e-2882-424d-98c5-a8a8dc51c155.tmp","sha256":"aff48d20a556fbadd3bd39aef4a2574195574f9f73a89df3158175e582ebaaa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"1d49a363-8f97-441d-a125-fa622b45d613.tmp","sha256":"c24d0ad74c25c1adc847380437dd19ecebee83753c93839f023091039c11e283","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"index","sha256":"fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"temp-index","sha256":"03c261333b9a5d80e8f87ac2344aee9d1e71f13e1a0221bac81ae4d78ba54547","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"data_0","sha256":"d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"data_2","sha256":"ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"data_3","sha256":"e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\Microsoft.Web.WebView2.Core.dll","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\Microsoft.Web.WebView2.WinForms.dll","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2Loader.dll","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\YuDun.exe","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\app\\index.html","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\app\\pay-qr.png","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\app\\css\\styles.css","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\app\\js\\app.js","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\app\\js\\cloud.js","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\app\\js\\engine.js","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\app\\js\\signatures.js","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\app\\vendor\\lucide.min.js","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\sigs\\db.json","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%USERPROFILE%\\Desktop\\??????.lnk","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\debug.log","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Crashpad\\throttle_store.dat","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Crashpad\\settings.dat","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"pipe\\crashpad_7228_VDSAQUKBTGPZKENI","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\BrowserMetrics\\BrowserMetrics-6ADCA3BD-1C3C.pma","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\lockfile","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Variations","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\a5f4f9fc-9383-4ac2-bff4-2657ea5d9f18.tmp","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"pipe\\LOCAL\\mojo.7228.3472.14405135135550942727","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\ShaderCache\\index","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\ShaderCache\\data_0","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\ShaderCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\ShaderCache\\data_2","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\ShaderCache\\data_3","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%TEMP%\\sslkey.txt","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"pipe\\LOCAL\\mojo.7228.3472.6374665854889323723","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Last Version","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\README","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\ServerCertificate","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"pipe\\LOCAL\\mojo.7228.3472.14066191490151524179","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\History","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Site Characteristics Database\\LOG","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Site Characteristics Database\\LOCK","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\ClientCertificates\\LOG","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\ClientCertificates\\LOCK","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Vpn Tokens","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Login Data For Account","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Login Data","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Login Data For Account-journal","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Web Data","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Code Cache\\js\\index","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Web Data-journal","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Vpn Tokens-journal","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\ServerCertificate-journal","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Sync Data\\LevelDB\\LOG","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Login Data-journal","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Sync Data\\LevelDB\\LOCK","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\History-journal","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\PersistentOriginTrials\\LOG","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\PersistentOriginTrials\\LOCK","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Site Characteristics Database\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Sync Data\\LevelDB\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Site Characteristics Database\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Sync Data\\LevelDB\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Safe Browsing Network\\NetworkDataMigrated","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Favicons","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Favicons-journal","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Network\\NetworkDataMigrated","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Extension Rules\\LOG","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Extension Rules\\LOCK","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Extension Rules\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Code Cache\\wasm\\index","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Extension Rules\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\e3d6ce46-28ea-4ce8-b73a-219e839e6dbf.tmp","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Local State~RF2d060f.TMP","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Code Cache\\js\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\b3a3f8d4-0293-4514-8931-0a9263b12cdd.tmp","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Code Cache\\wasm\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Local State~RF2d066d.TMP","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\discount_infos_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\discounts_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\discounts_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\discount_infos_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\LOG","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\LOCK","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\commerce_subscription_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\commerce_subscription_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\shared_proto_db\\metadata\\LOG","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\shared_proto_db\\metadata\\LOCK","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\shared_proto_db\\metadata\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\shared_proto_db\\metadata\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\parcel_tracking_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\parcel_tracking_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"pipe\\LOCAL\\mojo.7228.3472.5454464863564828738","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\GPUCache\\index","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\GPUCache\\data_0","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\GPUCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\SharedStorage","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\SharedStorage-journal","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\SharedStorage-wal","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\GPUCache\\data_2","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\GPUCache\\data_3","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\DawnWebGPUCache\\index","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\DawnWebGPUCache\\data_0","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\DawnWebGPUCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\DawnWebGPUCache\\data_2","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\DawnWebGPUCache\\data_3","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\DawnGraphiteCache\\index","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\shared_proto_db\\metadata\\000003.log","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\DawnGraphiteCache\\data_0","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\DawnGraphiteCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\DawnGraphiteCache\\data_2","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\DawnGraphiteCache\\data_3","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Sync Data\\LevelDB\\000003.log","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\shared_proto_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\shared_proto_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\shared_proto_db\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\shared_proto_db\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Site Characteristics Database\\000003.log","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Extension Rules\\000003.log","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Extension Scripts\\LOG","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Extension Scripts\\LOCK","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Extension Scripts\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Extension Scripts\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%TEMP%\\ff0a00cd-2e1b-42b6-aab0-e55871e83feb.tmp","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\shared_proto_db\\000003.log","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Extension Scripts\\000003.log","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Crashpad","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Crashpad\\reports","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Crashpad\\attachments","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Crashpad\\metadata","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Safe Browsing Network\\Safe Browsing Cookies","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Shared Dictionary\\db","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Shared Dictionary\\cache\\index","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Safe Browsing Network\\Safe Browsing Cookies-journal","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Shared Dictionary\\db-journal","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Network\\Trust Tokens","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Network\\Trust Tokens-journal","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Shared Dictionary\\cache\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Network\\Cookies","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Network\\Reporting and NEL","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Network\\Cookies-journal","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Network\\Reporting and NEL-journal","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Network\\72d93f09-4375-463b-9bff-d9fc6421055c.tmp","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Network\\d0cb9327-0846-414c-929d-6e6375ac4496.tmp","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Network\\SCT Auditing Pending Reports~RF2d1d8f.TMP","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Network\\b80781d5-cc21-4429-b220-b58cdb1953fe.tmp","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"path":"%LOCALAPPDATA%\\YuDunPCManager\\WebView2\\EBWebView\\Default\\Network\\68868594-38c5-4ea0-8639-b69a52eba378.tmp","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\YUDUN\\","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"key":"HKCUHKCU\\YUDUN\\DEFAULTICON\\","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"key":"HKCUHKCU\\YUDUN\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"key":"HKCUHKCU\\YUDUN\\SHELL\\","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"key":"HKCUHKCU\\YUDUN\\SHELL\\OPEN\\","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"key":"HKCUHKCU\\\\","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"key":"HKCUHKCU\\SOFTWARE\\\\","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\\\","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGEWEBVIEW\\\\","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGEWEBVIEW\\BLBEACON\\\\","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGEWEBVIEW\\THIRDPARTY\\\\","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGEUPDATE\\CLIENTSTATE\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGEWEBVIEW\\STABILITYMETRICS\\","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\HVSI\\","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7288:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7288:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7288:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7288:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"Local\\SM0:7288:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"Local\\SM0:7288:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:7288:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:7288:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\YuDunPCManager_SingleInstance","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3388:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3388:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"Local\\SM0:3388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:3388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"Local\\SM0:3388:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:3388:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"YuDunPCManager_SingleInstance","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:7228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:7228:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SmartScreenLocalDatadownloadCache68be4bd775136db0f9e7851cec6f5d23","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"Local\\SM0:7228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SmartScreenLocalDatauriCache68be4bd775136db0f9e7851cec6f5d23","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SmartScreenRemoteDatacustomSettings98ca09912fef8ca8df73fb9c732c832f","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SmartScreenRemoteDatawarnStateCache68be4bd775136db0f9e7851cec6f5d23","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SmartScreenRemoteDataedgeSettings98ca09912fef8ca8df73fb9c732c832f","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SmartScreenRemoteDatacustomSynchronousLookupUris98ca09912fef8ca8df73fb9c732c832f","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SmartScreenRemoteDatatopTraffic98ca09912fef8ca8df73fb9c732c832f","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7228:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SmartScreenRemoteDatacustomSettings98ca09912fef8ca8df73fb9c732c832f","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SmartScreenRemoteDataedgeSettings98ca09912fef8ca8df73fb9c732c832f","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SmartScreenRemoteDatacustomSynchronousLookupUris98ca09912fef8ca8df73fb9c732c832f","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SmartScreenRemoteDatatopTraffic98ca09912fef8ca8df73fb9c732c832f","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SmartScreenLocalDatadownloadCache68be4bd775136db0f9e7851cec6f5d23","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SmartScreenLocalDatauriCache68be4bd775136db0f9e7851cec6f5d23","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SmartScreenRemoteDatawarnStateCache68be4bd775136db0f9e7851cec6f5d23","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4252:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"Local\\SM0:4252:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:4252:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4252:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8424:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:8424:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8036:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8036:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:8036:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:8036:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"Local\\SM0:8036:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8036:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:5148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2144:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:2144:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:444:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:444:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:8572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2260:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:2260:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2368:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:2368:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:6740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8060:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:8060:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1840:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:1840:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:2740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4560:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:4560:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:2420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8136:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]},{"name":"SM0:8136:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adca33714703825360372e2"}]}]}},"report_ids":{"sandbox_job_ids":["6adca33714703825360372e2"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Lazy.Generic Sample ad6484135f0e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ad6484135f0e…. Malware family: Lazy.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 7 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c"}],["$","meta","4",{"property":"og:title","content":"Malicious Lazy.Generic Sample ad6484135f0e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ad6484135f0e…. Malware family: Lazy.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 7 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Lazy.Generic Sample ad6484135f0e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ad6484135f0e…. Malware family: Lazy.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 7 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L92","11",{}]]