24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] ad:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T42c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample e27d133c3b29… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample e27d133c3b29…. Threat score 35/100. 0/27 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3"],"about":{"@type":"SoftwareApplication","name":"2FA Code Engine.exe","applicationCategory":["peexe","executable"],"identifier":"e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","additionalType":"Suspicious sample"},"threatScore":35,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tdc7,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "2FA_Code_Engine.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "2FA_Code_Engine.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "2FA_Code_Engine.exe") Found reference to API "__crtCreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "__crtCreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "VirtualAlloc failed" (Indicator: "VirtualAlloc"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "::WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "VirtualAlloc failed" (Indicator: "VirtualAlloc"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "::WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp")26:Te03,Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")27:T462,"2FA_Code_Engine.exe" called "FindResourceW" with parameter "14" - (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindResourceW" with parameter "18" - (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindResourceW" with parameter "13" - (UID: 00000000-00007864) "msedgewebview2.exe" called "FindResourceW" with parameter "103" - (UID: 00000000-00005224) "msedgewebview2.exe" called "FindResourceW" with parameter "186" - (UID: 00000000-00005224) "msedgewebview2.exe" called "FindResourceW" with parameter "189" - (UID: 00000000-00005224) "msedgewebview2.exe" called "FindResourceW" with parameter "391" - (UID: 00000000-00005224) "msedgewebview2.exe" called "FindResourceW" with parameter "393" - (UID: 00000000-00005224) "msedgewebview2.exe" called "FindResourceW" with parameter "58204" - (UID: 00000000-00005224) "msedgewebview2.exe" called "FindResourceW" with parameter "51625" - (UID: 00000000-00005224) "msedgewebview2.exe" called "FindResourceW" with parameter "51637" - (UID: 00000000-00005224) "msedgewebview2.exe" called "FindResourceW" with parameter "58205" - (UID: 00000000-00005224)28:T42f,"2FA_Code_Engine.exe" called "LoadResource with parameter {'hModule': '7929856', 'hResInfo': '11778240'}" (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadResource with parameter {'hModule': '7929856', 'hResInfo': '11778304'}" (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadResource with parameter {'hModule': '7929856', 'hResInfo': '11778224'}" (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadResource with parameter {'hModule': '1943470080', 'hResInfo': '1946020088'}" (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadResource with parameter {'hModule': '115867650', 'hResInfo': '118097424'}" (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadResource with parameter {'hModule': '148504577', 'hResInfo': '133891288'}" (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadResource with parameter {'hModule': '134086657', 'hResInfo': '134152776'}" (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadResource with parameter {'hModule': '149553153', 'hResInfo': '133891288'}" (UID: 00000000-00007864)29:Tfac,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "2FA_Code_Engine.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "2FA_Code_Engine.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "2FA_Code_Engine.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "2FA_Code_Engine.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "2FA_Code_Engine.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "2FA_Code_Engine.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "2FA_Code_Engine.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "2FA_Code_Engine.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "2FA_Code_Engine.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "2FA_Code_Engine.exe") Found reference to API "BringUacToFront: WaitForSingleObject failed with result:" (Indicator: "WaitForSingleObject"; File: "2FA_Code_Engine.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002220.00000000.302577.7CF85000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002220.00000000.302577.7CF85000.00000002.mdmp") Found reference to API "__crtGetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject crash dump requested" (Indicator: "WaitForSingleObject"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject non-crash dump requested" (Indicator: "WaitForSingleObject"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject process end" (Indicator: "WaitForSingleObject"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp")2a:Tad5,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "2FA_Code_Engine.exe") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")2b:Te7b,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "2FA_Code_Engine.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "2FA_Code_Engine.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "2FA_Code_Engine.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "2FA_Code_Engine.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "2FA_Code_Engine.exe") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "2FA_Code_Engine.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002220.00000000.302577.7CF85000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002220.00000000.302577.7CF85000.00000002.mdmp") Found reference to API "__crtFreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000002.304750.79614000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000002.304750.79614000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004400.00000002.304750.79614000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")2c:T7ed,Found reference to "SHA512 block transform for x86_64, CRYPTOGAMS by " (Indicator: "SHA512"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to "SHA512 block transform for x86_64, CRYPTOGAMS by " (Indicator: "SHA512"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00004400.00000002.304750.66213000.00000004.mdmp, 00000000-00004400.00000003.305316.66213000.00000004.mdmp") Found reference to "TLS_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00004400.00000002.304750.66285000.00000004.mdmp, 00000000-00004400.00000002.304750.6629D000.00000004.mdmp, 00000000-00004400.00000003.305316.66285000.00000004.mdmp, 00000000-00004400.00000003.305316.6629D000.00000004.mdmp") Found reference to "HKDF" (Indicator: "HKDF"; Source: "00000000-00004400.00000002.304750.6629D000.00000004.mdmp, 00000000-00004400.00000002.304750.662C1000.00000004.mdmp, 00000000-00004400.00000003.305316.6629D000.00000004.mdmp, 00000000-00004400.00000003.305316.662C1000.00000004.mdmp") Found reference to "ECDSA/SHA384" (Indicator: "SHA384"; Source: "00000000-00004400.00000002.304750.662F6000.00000004.mdmp, 00000000-00004400.00000002.304750.68300000.00000004.mdmp, 00000000-00004400.00000002.304750.6831B000.00000004.mdmp, 00000000-00004400.00000003.305316.662F6000.00000004.mdmp, 00000000-00004400.00000003.305316.68300000.00000004.mdmp, 00000000-00004400.00000003.305316.6831B000.00000004.mdmp") Found reference to "CDSA/SHA384" (Indicator: "SHA384"; Source: "00000000-00004400.00000002.304750.68300000.00000004.mdmp, 00000000-00004400.00000002.304750.6831B000.00000004.mdmp, 00000000-00004400.00000003.305316.6831B000.00000004.mdmp") Found reference to "SHA512 block transform for x86_64, CRYPTOGAMS by " (Indicator: "SHA512"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp")2d:T44c,"MSI972D.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE") "MSI972D.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE") "MSI972D.tmp" (Access type: "OPEN"; Path: "HKLM\") "MSI972D.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\FEATUREDEVELOPMENTPROPERTIES") "MSI972D.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\APPMODEL\LOOKASIDE\MACHINE") "MSI972D.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\APPMODEL\LOOKASIDE\USER") "MSI972D.tmp" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS") "MSI972D.tmp" (Access type: "QUERY"; Path: "HKCU\LOCAL SETTINGS") "MSI972D.tmp" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\OLE\FEATUREDEVELOPMENTPROPERTIES") "MSI972D.tmp" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\OLE") "MSI972D.tmp" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT") "MSI972D.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING") "MSI972D.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY")2e:Ta9b,"2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2817005661 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2817012215 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2817393875 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2817400428 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2817626471 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2817643024 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2818345057 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2818352081 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2818620647 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2818626965 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2818958158 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2818964801 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2820208183 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2820214766 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2820479811 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2820486433 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2821289896 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2821296469 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2821756350 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2821764707 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2822197969 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2822205637 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2822538394 [PID: 7864] "2FA_Code_Engine.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-2822544941 [PID: 7864] "msiexec.exe" queried SystemProcessInformation at 00000000-00006032-00000C15-2833157006 [PID: 6032]2f:T11ac,"msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Edge-Local-State-Tmp-70350048-5b2d-4143-85a5-ab9d674c9d92.tmp" to "%APPDATA%\2FA Code Engine.exe\EBWebView\Local State" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index" to "%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\Code Cache\wasm\index-dir\temp-index" to "%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\Site Characteristics Database\000001.dbtmp" to "%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Site Characteristics Database\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp" to "%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\Extension Rules\000001.dbtmp" to "%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension Rules\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp" to "%APPDATA%\2FA Code Engine.exe\EBWebView\Default\shared_proto_db\metadata\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\shared_proto_db\000001.dbtmp" to "%APPDATA%\2FA Code Engine.exe\EBWebView\Default\shared_proto_db\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\component_crx_cache\96a9b59d-f7ca-4b07-a825-1ac09477c17d.tmp" to "%APPDATA%\2FA Code Engine.exe\EBWebView\component_crx_cache\metadata.json" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\Extension Scripts\000001.dbtmp" to "%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension Scripts\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\Extension State\000001.dbtmp" to "%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension State\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\91344438-3207-4d8a-9d5d-a2e977597f0b.tmp" to "%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Secure Preferences" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\877c0fad-fc65-4ffc-8304-6d23f9faa8cd.tmp" to "%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Preferences" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\c3d37513-63cb-4a63-97ae-9fc059fb37d9.tmp" to "%APPDATA%\2FA Code Engine.exe\EBWebView\Default\BookmarkMergedSurfaceOrdering" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\26c92cf6-3300-41ab-a984-7e34c75c4207.tmp" to "%APPDATA%\2FA Code Engine.exe\EBWebView\Default\BrowsingTopicsState" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\Network\a19009cc-e1e8-48a2-a0b5-0bca836f6aed.tmp" to "%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\SCT Auditing Pending Reports" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\Shared Dictionary\cache\index-dir\temp-index" to "%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\Network\4da9de47-855f-4c03-bc4f-003f15510514.tmp" to "%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\Sdch Dictionaries" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\Network\2c6793b3-1e32-4919-946b-e65c657c0c19.tmp" to "%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\Network Persistent State"30:T496,Process "WerFault.exe" [UID: 00000000-00004724] Process "WerFault.exe" [UID: 00000000-00002972] Process "WerFault.exe" [UID: 00000000-00005376] Process "WerFault.exe" [UID: 00000000-00002360] Process "WerFault.exe" [UID: 00000000-00007960] Process "WerFault.exe" [UID: 00000000-00007376] Process "WerFault.exe" [UID: 00000000-00007388] Process "WerFault.exe" [UID: 00000000-00007976] Process "WerFault.exe" [UID: 00000000-00004748] Process "WerFault.exe" [UID: 00000000-00006860] Process "WerFault.exe" [UID: 00000000-00006884] Process "WerFault.exe" [UID: 00000000-00007272] Process "WerFault.exe" [UID: 00000000-00004828] Process "WerFault.exe" [UID: 00000000-00003692] Process "WerFault.exe" [UID: 00000000-00005528] Process "WerFault.exe" [UID: 00000000-00002928] Process "WerFault.exe" [UID: 00000000-00004128] Process "WerFault.exe" [UID: 00000000-00004452] Process "WerFault.exe" [UID: 00000000-00007416] Process "WerFault.exe" [UID: 00000000-00005008] Process "WerFault.exe" [UID: 00000000-00005700] Process "WerFault.exe" [UID: 00000000-00006816] Process "WerFault.exe" [UID: 00000000-00002568] Process "WerFault.exe" [UID: 00000000-00004984]31:T1dfc,"msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "6N3Uy9nAUEqs5u96E/og0E/VJAg=" "cchString": "28" "dwFlags": "6" "pcbBinary": "14000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "6N3Uy9nAUEqs5u96E/og0E/VJAg=" "cchString": "28" "dwFlags": "6" "pcbBinary": "14000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "6N3Uy9nAUEqs5u96E/og0E/VJAg=" "cchString": "28" "dwFlags": "6" "pbBinary": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "pcbBinary": "14000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "6N3Uy9nAUEqs5u96E/og0E/VJAg=" "cchString": "28" "dwFlags": "6" "pbBinary": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "pcbBinary": "14000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "Qg7CkVSy3QE=" "cchString": "12" "dwFlags": "6" "pcbBinary": "08000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "Qg7CkVSy3QE=" "cchString": "12" "dwFlags": "6" "pcbBinary": "08000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "Qg7CkVSy3QE=" "cchString": "12" "dwFlags": "6" "pbBinary": "420ec29154b2dd01" "pcbBinary": "08000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "Qg7CkVSy3QE=" "cchString": "12" "dwFlags": "6" "pbBinary": "420ec29154b2dd01" "pcbBinary": "08000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "AAAAAA==" "cchString": "8" "dwFlags": "6" "pcbBinary": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "AAAAAA==" "cchString": "8" "dwFlags": "6" "pcbBinary": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "AAAAAA==" "cchString": "8" "dwFlags": "6" "pbBinary": "00000000" "pcbBinary": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "AAAAAA==" "cchString": "8" "dwFlags": "6" "pbBinary": "00000000" "pcbBinary": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAoyGnEnVVSEuL4DXAs8+MigAAAAACAAAAAAAQZgAAAAEAACAAAACJ9kvWZiLz3nTXjhasklC4TWyyJpHttS+xgYIefNBuYQAAAAAOgAAAAAIAACAAAAB86CWTn1gL/k9jAD/388jT6hNF59tHMaLUQkF2AFeuJzABAACIQV97VB1q9gLT7lO/fgrEaICv7mM5VoD4tSRN6Fx2ROZJ1ZK5U8WIswmZxw/h15KA" "cchString": "692" "dwFlags": "6" "pcbBinary": "06020000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAoyGnEnVVSEuL4DXAs8+MigAAAAACAAAAAAAQZgAAAAEAACAAAACJ9kvWZiLz3nTXjhasklC4TWyyJpHttS+xgYIefNBuYQAAAA" "cchString": "692" "dwFlags": "6" "pcbBinary": "06020000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAoyGnEnVVSEuL4DXAs8+MigAAAAACAAAAAAAQZgAAAAEAACAAAACJ9kvWZiLz3nTXjhasklC4TWyyJpHttS+xgYIefNBuYQAAAAAOgAAAAAIAACAAAAB86CWTn1gL/k9jAD/388jT6hNF59tHMaLUQkF2AFeuJzABAACIQV97VB1q9gLT7lO/fgrEaICv7mM5VoD4tSRN6Fx2ROZJ1ZK5U8WIswmZxw/h15KA" "cchString": "692" "dwFlags": "6" "pbBinary": "01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a321a7127555484b8be035c0b3cf8c8a0000000002000000000010660000000100002000000089f64bd66622f3de74d78e16ac9250b84d6cb22691edb52fb181821e7cd06e61000000000e80000000020000200000007ce825939f580bfe4f63003ff7f3c8d3ea1345e7db4731a2d44241760057ae273001000088415f7b541d6af602d3ee53bf7e0ac46880afee63395680f8b5244de85c7644e649d592b953c588b30999c70fe1d79280fa5881bb1aa15c1cc3557689a031f44b7833e70c1d5504e6ad33b4c14e1586bc015373d5b10eb164dbaaf89c453d02026814a7ca18ca49965a2a3f9ab21a692ced9114bae1ce3b474ff0e5c59e976e66019865029740215cf97bf1ec9f497d8fa0f239f2789cbbb336b15b4dc2469c21ab924b85e90192a381bcbd7cb9c7525f78e2d93d9b3688dc4142dd34ea0dffc777da3afcde572fcda49b6528d182f8e9d409340651495dee5573ae469dbc009eb3e08725e97ada72c9f89e4b8c9ec779035670892d1eab1080178b2b66a309646e242f32bd724af20dd1c0c59a0dd4f125f57cd767a991f4c219d57220f2e426adf7f24785a595492cff024170c9b9400000005aa1a2086f89ce99ea6ed95f0062cee7538c50ce53fa84a06258f3601fe43bc920c59a3cc69d865d8c6e3c65b3841b1dada9c4bb0f3b7b73160fa102581d441f" "pcbBinary": "06020000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAoyGnEnVVSEuL4DXAs8+MigAAAAACAAAAAAAQZgAAAAEAACAAAACJ9kvWZiLz3nTXjhasklC4TWyyJpHttS+xgYIefNBuYQAAAA" "cchString": "692" "dwFlags": "6" "pbBinary": "01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a321a7127555484b8be035c0b3cf8c8a0000000002000000000010660000000100002000000089f64bd66622f3de74d78e16ac9250b84d6cb22691edb52fb181821e7cd06e61000000000e80000000020000200000007ce825939f580bfe4f63003ff7f3c8d3ea1345e7db4731a2d44241760057ae273001000088415f7b541d6af602d3ee53bf7e0ac46880afee63395680f8b5244de85c7644e649d592b953c588b30999c70fe1d79280fa5881bb1aa15c1cc3557689a031f44b7833e70c1d5504e6ad33b4c14e1586bc015373d5b10eb164dbaaf89c453d02026814a7ca18ca49965a2a3f9ab21a692ced9114bae1ce3b474ff0e5c59e976e66019865029740215cf97bf1ec9f497d8fa0f239f2789cbbb336b15b4dc2469c21ab924b85e90192a381bcbd7cb9c7525f78e2d93d9b3688dc4142dd34ea0dffc777da3afcde572fcda49b6528d182f8e9d409340651495dee5573ae469dbc009eb3e08725e97ada72c9f89e4b8c9ec779035670892d1eab1080178b2b66a309646e242f32bd724af20dd1c0c59a0dd4f125f57cd767a991f4c219d57220f2e426adf7f24785a595492cff024170c9b9400000005aa1a2086f89ce99ea6ed95f0062cee7538c50ce53fa84a06258f3601fe43bc920c59a3cc69d865d8c6e3c65b3841b1dada9c4bb0f3b7b73160fa102581d441f" "pcbBinary": "06020000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b" "cchString": "40" "dwFlags": "8" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b" "cchString": "40" "dwFlags": "8" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b" "cchString": "40" "dwFlags": "8" "pbBinary": "Z*pX" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b" "cchString": "40" "dwFlags": "8" "pbBinary": "Z*pX" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "8ae9f0c30ea1668425d0f7d6255d597ead710776" "cchString": "40" "dwFlags": "8" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "8ae9f0c30ea1668425d0f7d6255d597ead710776" "cchString": "40" "dwFlags": "8" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "8ae9f0c30ea1668425d0f7d6255d597ead710776" "cchString": "40" "dwFlags": "8" "pbBinary": "8ae9f0c30ea1668425d0f7d6255d597ead710776" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "8ae9f0c30ea1668425d0f7d6255d597ead710776" "cchString": "40" "dwFlags": "8" "pbBinary": "8ae9f0c30ea1668425d0f7d6255d597ead710776" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "b943fb00c99a258e5f0873d8b450efdbd4065be2" "cchString": "40" "dwFlags": "8" "pcbBinary": "14000000" "pdwFlags": "04000000"}32:Tb4e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-38-006A5830 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-43-006A57F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-45-00682E03 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007612-25850-45-00682E03 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-52-00659790 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-55-006A55D0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-56-0065B130 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-57-0065BF60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-58-0065BE80 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-59-0065A810 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-60-00661DC0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007612-25850-60-00661DC0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-65-0065A090 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-77-0068FBE3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-114-00658600 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-115-00658540 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-118-00658D90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-137-00659D00 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007612-25850-137-00659D00 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-138-0065A1B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-139-00659FD0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-140-0065F460 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-144-0065EF30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-148-00661410 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007612-25850-148-00661410 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-165-00661F10 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007612-25850-165-00661F10 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-170-006558F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-172-006559C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007612-25850-174-00652B9033:T9ba,Contains base64 string in header "http" in header "GET /0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/faq HTTP/1.1Host: pub.futsalbandung.orgUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/faq HTTP/1.1Host: pub.futsalbandung.orgUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/faq HTTP/1.1Host: pub.futsalbandung.orgUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/faq HTTP/1.1Host: pub.futsalbandung.orgUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "http" in header "GET /0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/config HTTP/1.1Host: pub.futsalbandung.orgUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/config HTTP/1.1Host: pub.futsalbandung.orgUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/config HTTP/1.1Host: pub.futsalbandung.orgUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/config HTTP/1.1Host: pub.futsalbandung.orgUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "http" in header "GET /+n_A3yiwNZa5kZmRi HTTP/2Host: t.meUser-Agent: Go-http-client/2.0Accept-Encoding: gzip" Contains base64 string in header "client/2" in header "GET /+n_A3yiwNZa5kZmRi HTTP/2Host: t.meUser-Agent: Go-http-client/2.0Accept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /+n_A3yiwNZa5kZmRi HTTP/2Host: t.meUser-Agent: Go-http-client/2.0Accept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /+n_A3yiwNZa5kZmRi HTTP/2Host: t.meUser-Agent: Go-http-client/2.0Accept-Encoding: gzip"34:T4ea,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains CRYPTO related strings Matched sigs: Able to access crypto-related API (String) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to crypto DLLs Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to performs encryption on the data Matched sigs: Calls an API typically used to decrypt data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match – cryptographic algorithms35:T230e,Found XOR loop in file "MSI7AC5.tmp" at offset 26493; code bytes = 30d0 Found XOR loop in file "MSI7AC5.tmp" at offset 933044; code bytes = 30d0 Found XOR loop in file "MSI7AC5.tmp" at offset 940663; code bytes = 30d0 Found XOR loop in file "MSI7AC5.tmp" at offset 1258100; code bytes = 30d0 Found XOR loop in file "MSI7AC5.tmp" at offset 1288204; code bytes = 30d0 Found XOR loop in file "MSI7AC5.tmp" at offset 1321703; code bytes = 30d0 Found XOR loop in file "MSI7AC5.tmp" at offset 1322149; code bytes = 30d0 Found XOR loop in file "MSI7AC5.tmp" at offset 1327647; code bytes = 30d0 Found XOR loop in file "MSI7AC5.tmp" at offset 1339969; code bytes = 30d0 Found XOR loop in file "MSI7AC5.tmp" at offset 1341977; code bytes = 30d0 Found XOR loop in file "MSI7AC5.tmp" at offset 1349705; code bytes = 30d0 Found XOR loop in file "MSI7AC5.tmp" at offset 1354381; code bytes = 30d0 Found XOR loop in file "MSI7AC5.tmp" at offset 695694; code bytes = 33c1 Found XOR loop in file "MSI7AC5.tmp" at offset 698037; code bytes = 33c1 Found XOR loop in file "MSI7AC5.tmp" at offset 741884; code bytes = 33c1 Found XOR loop in file "MSI7AC5.tmp" at offset 1309149; code bytes = 33c1 Found XOR loop in file "MSI7AC5.tmp" at offset 1313033; code bytes = 33c1 Found XOR loop in file "MSI7AC5.tmp" at offset 1334883; code bytes = 33c1 Found XOR loop in file "MSI7AC5.tmp" at offset 1363396; code bytes = 33c1 Found XOR loop in file "MSI7AC5.tmp" at offset 941188; code bytes = 30040e Found XOR loop in file "MSI7AC5.tmp" at offset 1269124; code bytes = 30040e Found XOR loop in file "MSI7AC5.tmp" at offset 138687; code bytes = 8030 Found XOR loop in file "MSI7AC5.tmp" at offset 500893; code bytes = 8030 Found XOR loop in file "MSI7AC5.tmp" at offset 906716; code bytes = 8030 Found XOR loop in file "MSI7AC5.tmp" at offset 934291; code bytes = 8030 Found XOR loop in file "MSI7AC5.tmp" at offset 1289451; code bytes = 8030 Found XOR loop in file "MSI7AC5.tmp" at offset 1314340; code bytes = 8030 Found XOR loop in file "MSI7AC5.tmp" at offset 1320644; code bytes = 8030 Found XOR loop in file "MSI7AC5.tmp" at offset 1325992; code bytes = 8030 Found XOR loop in file "MSI7AC5.tmp" at offset 1329654; code bytes = 8030 Found XOR loop in file "MSI7AC5.tmp" at offset 1331422; code bytes = 8030 Found XOR loop in file "MSI7AC5.tmp" at offset 1339944; code bytes = 8030 Found XOR loop in file "MSI7AC5.tmp" at offset 1343774; code bytes = 8030 Found XOR loop in file "MSI7AC5.tmp" at offset 1345540; code bytes = 8030 Found XOR loop in file "MSI7AC5.tmp" at offset 1348300; code bytes = 8030 Found XOR loop in file "MSI7AC5.tmp" at offset 1350344; code bytes = 8030 Found XOR loop in file "MSI7AC5.tmp" at offset 1357113; code bytes = 8030 Found XOR loop in file "MSI7AC5.tmp" at offset 1358806; code bytes = 8030 Found XOR loop in file "MSI7AC5.tmp" at offset 1367927; code bytes = 8030 Found XOR loop in file "MSI7AC5.tmp" at offset 1368778; code bytes = 8030 Found XOR loop in file "MSI7F6A.tmp" at offset 26493; code bytes = 30d0 Found XOR loop in file "MSI7F6A.tmp" at offset 933044; code bytes = 30d0 Found XOR loop in file "MSI7F6A.tmp" at offset 940663; code bytes = 30d0 Found XOR loop in file "MSI7F6A.tmp" at offset 1258100; code bytes = 30d0 Found XOR loop in file "MSI7F6A.tmp" at offset 1288204; code bytes = 30d0 Found XOR loop in file "MSI7F6A.tmp" at offset 1321703; code bytes = 30d0 Found XOR loop in file "MSI7F6A.tmp" at offset 1322149; code bytes = 30d0 Found XOR loop in file "MSI7F6A.tmp" at offset 1327647; code bytes = 30d0 Found XOR loop in file "MSI7F6A.tmp" at offset 1339969; code bytes = 30d0 Found XOR loop in file "MSI7F6A.tmp" at offset 1341977; code bytes = 30d0 Found XOR loop in file "MSI7F6A.tmp" at offset 1349705; code bytes = 30d0 Found XOR loop in file "MSI7F6A.tmp" at offset 1354381; code bytes = 30d0 Found XOR loop in file "MSI7F6A.tmp" at offset 695694; code bytes = 33c1 Found XOR loop in file "MSI7F6A.tmp" at offset 698037; code bytes = 33c1 Found XOR loop in file "MSI7F6A.tmp" at offset 741884; code bytes = 33c1 Found XOR loop in file "MSI7F6A.tmp" at offset 1309149; code bytes = 33c1 Found XOR loop in file "MSI7F6A.tmp" at offset 1313033; code bytes = 33c1 Found XOR loop in file "MSI7F6A.tmp" at offset 1334883; code bytes = 33c1 Found XOR loop in file "MSI7F6A.tmp" at offset 1363396; code bytes = 33c1 Found XOR loop in file "MSI7F6A.tmp" at offset 941188; code bytes = 30040e Found XOR loop in file "MSI7F6A.tmp" at offset 1269124; code bytes = 30040e Found XOR loop in file "MSI7F6A.tmp" at offset 138687; code bytes = 8030 Found XOR loop in file "MSI7F6A.tmp" at offset 500893; code bytes = 8030 Found XOR loop in file "MSI7F6A.tmp" at offset 906716; code bytes = 8030 Found XOR loop in file "MSI7F6A.tmp" at offset 934291; code bytes = 8030 Found XOR loop in file "MSI7F6A.tmp" at offset 1289451; code bytes = 8030 Found XOR loop in file "MSI7F6A.tmp" at offset 1314340; code bytes = 8030 Found XOR loop in file "MSI7F6A.tmp" at offset 1320644; code bytes = 8030 Found XOR loop in file "MSI7F6A.tmp" at offset 1325992; code bytes = 8030 Found XOR loop in file "MSI7F6A.tmp" at offset 1329654; code bytes = 8030 Found XOR loop in file "MSI7F6A.tmp" at offset 1331422; code bytes = 8030 Found XOR loop in file "MSI7F6A.tmp" at offset 1339944; code bytes = 8030 Found XOR loop in file "MSI7F6A.tmp" at offset 1343774; code bytes = 8030 Found XOR loop in file "MSI7F6A.tmp" at offset 1345540; code bytes = 8030 Found XOR loop in file "MSI7F6A.tmp" at offset 1348300; code bytes = 8030 Found XOR loop in file "MSI7F6A.tmp" at offset 1350344; code bytes = 8030 Found XOR loop in file "MSI7F6A.tmp" at offset 1357113; code bytes = 8030 Found XOR loop in file "MSI7F6A.tmp" at offset 1358806; code bytes = 8030 Found XOR loop in file "MSI7F6A.tmp" at offset 1367927; code bytes = 8030 Found XOR loop in file "MSI7F6A.tmp" at offset 1368778; code bytes = 8030 Found XOR loop in file "MSI7E60.tmp" at offset 26493; code bytes = 30d0 Found XOR loop in file "MSI7E60.tmp" at offset 933044; code bytes = 30d0 Found XOR loop in file "MSI7E60.tmp" at offset 940663; code bytes = 30d0 Found XOR loop in file "MSI7E60.tmp" at offset 1258100; code bytes = 30d0 Found XOR loop in file "MSI7E60.tmp" at offset 1288204; code bytes = 30d0 Found XOR loop in file "MSI7E60.tmp" at offset 1321703; code bytes = 30d0 Found XOR loop in file "MSI7E60.tmp" at offset 1322149; code bytes = 30d0 Found XOR loop in file "MSI7E60.tmp" at offset 1327647; code bytes = 30d0 Found XOR loop in file "MSI7E60.tmp" at offset 1339969; code bytes = 30d0 Found XOR loop in file "MSI7E60.tmp" at offset 1341977; code bytes = 30d0 Found XOR loop in file "MSI7E60.tmp" at offset 1349705; code bytes = 30d0 Found XOR loop in file "MSI7E60.tmp" at offset 1354381; code bytes = 30d0 Found XOR loop in file "MSI7E60.tmp" at offset 695694; code bytes = 33c1 Found XOR loop in file "MSI7E60.tmp" at offset 698037; code bytes = 33c1 Found XOR loop in file "MSI7E60.tmp" at offset 741884; code bytes = 33c1 Found XOR loop in file "MSI7E60.tmp" at offset 1309149; code bytes = 33c1 Found XOR loop in file "MSI7E60.tmp" at offset 1313033; code bytes = 33c1 Found XOR loop in file "MSI7E60.tmp" at offset 1334883; code bytes = 33c1 Found XOR loop in file "MSI7E60.tmp" at offset 1363396; code bytes = 33c1 Found XOR loop in file "MSI7E60.tmp" at offset 941188; code bytes = 30040e Found XOR loop in file "MSI7E60.tmp" at offset 1269124; code bytes = 30040e Found XOR loop in file "MSI7E60.tmp" at offset 138687; code bytes = 8030 Found XOR loop in file "MSI7E60.tmp" at offset 500893; code bytes = 8030 Found XOR loop in file "MSI7E60.tmp" at offset 906716; code bytes = 8030 Found XOR loop in file "MSI7E60.tmp" at offset 934291; code bytes = 8030 Found XOR loop in file "MSI7E60.tmp" at offset 1289451; code bytes = 8030 Found XOR loop in file "MSI7E60.tmp" at offset 1314340; code bytes = 8030 Found XOR loop in file "MSI7E60.tmp" at offset 1320644; code bytes = 8030 Found XOR loop in file "MSI7E60.tmp" at offset 1325992; code bytes = 8030 Found XOR loop in file "MSI7E60.tmp" at offset 1329654; code bytes = 8030 Found XOR loop in file "MSI7E60.tmp" at offset 1331422; code bytes = 8030 Found XOR loop in file "MSI7E60.tmp" at offset 1339944; code bytes = 8030 Found XOR loop in file "MSI7E60.tmp" at offset 1343774; code bytes = 8030 Found XOR loop in file "MSI7E60.tmp" at offset 1345540; code bytes = 8030 Found XOR loop in file "MSI7E60.tmp" at offset 1348300; code bytes = 8030 Found XOR loop in file "MSI7E60.tmp" at offset 1350344; code bytes = 8030 Found XOR loop in file "MSI7E60.tmp" at offset 1357113; code bytes = 8030 Found XOR loop in file "MSI7E60.tmp" at offset 1358806; code bytes = 8030 Found XOR loop in file "MSI7E60.tmp" at offset 1367927; code bytes = 8030 Found XOR loop in file "MSI7E60.tmp" at offset 1368778; code bytes = 803036:T488,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007864-00000C2C-2827207527") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")37:T442,Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007864-00000C2C-2827207527") Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found string "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found string "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found string "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found string "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")38:T66b,Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "2FA_Code_Engine.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "2FA_Code_Engine.exe") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "2FA_Code_Engine.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00004400.00000002.304750.662F6000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp")39:T40f,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "2FA_Code_Engine.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "2FA_Code_Engine.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00007864-00000C2C-2824898699") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")3a:T116d,Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "2FA_Code_Engine.exe") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "2FA_Code_Engine.exe") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "2FA_Code_Engine.exe") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "2FA_Code_Engine.exe") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "2FA_Code_Engine.exe") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "2FA_Code_Engine.exe") Found reference to API "__crtGetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp")3b:T9f3,Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "2FA_Code_Engine.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; File: "2FA_Code_Engine.exe") Found reference to API "GlobalMemoryStatus" (Indicator: "GlobalMemoryStatus"; File: "2FA_Code_Engine.exe") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "2FA_Code_Engine.exe") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; File: "2FA_Code_Engine.exe") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "2FA_Code_Engine.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp")3c:Tc38,Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "2FA_Code_Engine.exe") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "2FA_Code_Engine.exe") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "2FA_Code_Engine.exe") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "2FA_Code_Engine.exe") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "EnumDateFormatsW" (Indicator: "EnumDateFormats"; Source: "00000000-00004400.00000003.305316.6831B000.00000004.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp")3d:Tc80,Found system information discovery API: "GetSystemInfo" in file "2FA_Code_Engine.exe" Found system information discovery API: "GetEnvironmentStringsW" in file "2FA_Code_Engine.exe" Found system information discovery API: "GetNativeSystemInfo" in file "2FA_Code_Engine.exe" Found system information discovery API: "GetMonitorInfoW" in file "2FA_Code_Engine.exe" Found system information discovery API: "ExpandEnvironmentStringsW" in file "2FA_Code_Engine.exe" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00003476.00000000.301913.69261000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00003932.00000000.303065.1458D000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00003932.00000000.303065.1458D000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation SystemExtendedHandleInformation" in "00000000-00003932.00000000.303065.1458D000.00000002.mdmp" Found system information discovery API: "::NtQuerySystemInformation" in "00000000-00003932.00000000.303065.1458D000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00003932.00000000.303065.1458D000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00003932.00000000.303065.1458D000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00003932.00000000.303065.1458D000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00003932.00000000.303065.1458D000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00003932.00000000.303065.1458D000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00005224.00000000.300792.1458D000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00005224.00000000.300792.1458D000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation SystemExtendedHandleInformation" in "00000000-00005224.00000000.300792.1458D000.00000002.mdmp" Found system information discovery API: "::NtQuerySystemInformation" in "00000000-00005224.00000000.300792.1458D000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00005224.00000000.300792.1458D000.00000002.mdmp"3e:T4d9,Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; File: "2FA_Code_Engine.exe") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "2FA_Code_Engine.exe") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "2FA_Code_Engine.exe") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "2FA_Code_Engine.exe") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")3f:Taa6,Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "2FA_Code_Engine.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "2FA_Code_Engine.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "2FA_Code_Engine.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "2FA_Code_Engine.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "2FA_Code_Engine.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00005224-00000C2C-2839854083") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "2FA_Code_Engine.exe") Found reference to API "AttemptToNotifyRunningChrome:SendMessage" (Indicator: "sendmessage"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "Mojo.Channel.WriteSendMessageProcessType" (Indicator: "sendmessage"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00004400.00000003.305316.6622D000.00000004.mdmp") Found reference to API "AttemptToNotifyRunningChrome:SendMessage" (Indicator: "sendmessage"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")40:T1df2,"2FA_Code_Engine.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000098f06300e810f576000000000800000068ee6300000000000000000000000000308d0905b0ef63004a00000180ee63006100700069002d006d0073002d00770069006e002d0063006f00720065002d00700072006f00630065007300b544fe22007b090578ef6300000057762d006c00f000577600000000acee630020762174a8ef6300b0e8fc766d9a9b55feffffff0cef6300c019fa7601000000000057760000000000000000007b090500000000184f0a05f000577618011d01b8ef6300f20df976090000006cef630078ef6300ed45fe22007b090500000000184f0a0500000000801b09050000f5769493c176f000f576b0520901f2bffd76 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000905b48fdd0410ea63006509fe761200000000000000d06cb2760200000088180905b48fdd0430ea63006509fe761200000000000000d06cb276f0b9c8741200000044ea6300ae2efb760200000000000000d06cb27654ea6300e16cb27602000000000000007cea630068207b7602000000000000006613dad77092d07400000000bcea6300201b8076ffffffffccea630058107b763c107b76d613dad77092d0749cb9c874f0b9c874acea6300a8ea63000d0000000d0000005041ec747cc82575000000004041ec74c8ea630040eb6300608d7e7652ec3ea1feffffffd8ea6300900f7b765041ec74e8ea63000625df747cc825755041ec74f4ea6300 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000006300c656f97678ea63000000000000770a050000000000770a050074fb7678ea63000000000000770a0510eb6300ec74fb7624770a055ceb6300000000002f75fb767a6fdf7378000000000000002c020000000000007a6fdf73000000002e00d77328eb630000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ff000000a10300000000000000000000008000000000000000000000000000000000000000000000000000002c020000000000007a6fdf73000000002e00d77328eb6300b025f9764541fe2224eb63008073fb76e30100003d0000007a6fdf7364eb6300 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000000000000000009540fe2200ea630020430b0500ed6300b0e8fc764d9a9b55feffffff20430b05787ffa76584b0a050000000020430b050a000b00b6c7b273000000000000000060a6b27370a6b27320430b05283f0b05140000000000000000000000584b0a050000000030eb6300d708f97620430b05000000008403fe7f00000000f000ab7300000000094d0b3dec61fc765fd6f8766c02000020430b0500000000844b0a051800000000000000b8eb630040080000000000000000000000000000010000003d13bd50b4eb6300350100c07c4b0a058ceb630030a1b173feffffffb8eb63000000000000000000000000006c0200009ceb6300 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000006c7c00006c7c0000b02d090597c90c05b02d09050000000000000000b0ee6300b0e8fc762d859b55feffffff58ee630002cbf976e8020000f00200001c04090528ee630040000000000009050800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000f002000000000000000000005e00000000000000e8020000080010000000090500000000000000000000000074ee6300febaf976080010000000000000000000906ffd7300000000c0ee6300b52cb3760000090508001000e8020000d5914cd44000000000000000 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000d5751425c0de8907e0da1405c0e18907b0e8fc764d9a9b55feffffffe0da1405787ffa7618610a0500000000e0da14050c000d00a2e99d720000000000000000d4e19d72e4e19d72e0da140590a5120504000000000000000000000018610a0500000000f0df8907d708f976e0da1405000000008403fe7f00000000f0009972000000008d26f520ec61fc765fd6f87610050000e0da14050000000044610a05180000000000000078e0890740080000000000000000000000000000010000003605809774e08907350100c03c610a054ce0890700119c72feffffff78e08907000000000000000000000000100500005ce08907 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000001505b1caf976808b150500000000b800000000000000000009050800000040ed890700000000000009050800000020ed8907c0000000d0077300000073000000000000000000300100008052140500000000000000000000000002000000c000000018027300000000001800000000007300b800000008001000000009053c097300580002083809730078ed8907febaf976080010000000000000000000808dfb73c4ed8907b52cb3760000090508001000b8000000d192a6d300000000808dfb73904c1505c3cab47600000000b0cab476000000008ced89071000000064f68907a0f4b3768deaefa2feffffffd4ed8907908dfb7340000000b8000000 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000fd7610fe14050000090510fe140594fcfd76c0fa130500000905c0fa13056400000026001b00c851140500000000640000001f000c0088d41205000000000c0000000000000090f41305bffa1305c0fa130578d412050000090500000000c4ea8907a6ebf976000000000000000000000000c0fa130500000000000000000ceb8907e638b3760000090500000000c0fa13051994a6d3c0fa1305b08dfb73402bd7730000000064f68907a0f4b376d8ea8907feffffff64f68907a0f4b376f5eaefa2feffffff1ceb8907698ffb7300000000508ffb7330eb8907cdf6e8734c59fd73c0fa1305d0fde87344eb89079668f57340890a056068f573c07b1505 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007864)41:T59a,Found reference to API "IsWow64Process" (Indicator: "IsWow64Process"; File: "2FA_Code_Engine.exe") Found reference to API "IsWow64Process2" (Indicator: "IsWow64Process"; File: "2FA_Code_Engine.exe") Found reference to API "IsWow64Process2" (Indicator: "IsWow64Process"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "::IsWow64Process" (Indicator: "IsWow64Process"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "IsWow64Process" (Indicator: "IsWow64Process"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "IsWow64Process" (Indicator: "IsWow64Process"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "IsWow64Process2" (Indicator: "IsWow64Process"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "IsWow64Process2" (Indicator: "IsWow64Process"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp") Found reference to API "::IsWow64Process" (Indicator: "IsWow64Process"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "IsWow64Process" (Indicator: "IsWow64Process"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp")42:T593,"2FA_Code_Engine.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "2FA_Code_Engine.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "2FA_Code_Engine.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "2FA_Code_Engine.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "2FA_Code_Engine.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "2FA_Code_Engine.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2FA_Code_Engine.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "MSI972D.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2FA Code Engine.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2FA Code Engine.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")43:T9ad,Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "2FA_Code_Engine.exe") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "2FA_Code_Engine.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "2FA_Code_Engine.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "2FA_Code_Engine.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002220.00000000.302577.7CF85000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000002.304750.79614000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp")44:T5f3,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "2FA_Code_Engine.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "2FA_Code_Engine.exe") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "2FA_Code_Engine.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "2FA_Code_Engine.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "2FA_Code_Engine.exe") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00004400.00000003.305316.6622D000.00000004.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp")45:T91c,Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "2FA_Code_Engine.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "2FA_Code_Engine.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "2FA_Code_Engine.exe") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; File: "2FA_Code_Engine.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")46:T754,"msedgewebview2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTP"; Value: "") "msedgewebview2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: ""; Value: "") "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: "HIDDEN"; Value: "") "msedgewebview2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTP"; Value: "") "msedgewebview2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES"; Key: ""; Value: "") "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES"; Key: "HIDDEN"; Value: "") "msedgewebview2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTP"; Value: "") "msedgewebview2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: ""; Value: "") "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: "HIDDEN"; Value: "")47:Tcbd,"2FA_Code_Engine.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007864-00000C17-2826794435 "msiexec.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006032-00000C17-2827741658 "msiexec.exe" queries volume information of "C:\share" at 00000000-00006032-00000C17-2832275716 "msiexec.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006032-00000C17-2834403189 "msedgewebview2.exe" queries volume information of "C:\Windows\System32\drivers\etc\hosts" at 00000000-00005224-00000C17-2843786281 "msedgewebview2.exe" queries volume information of "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\Trust Protection Lists\manifest.json" at 00000000-00005224-00000C17-2848619622 "msedgewebview2.exe" queries volume information of "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\MEIPreload\manifest.json" at 00000000-00005224-00000C17-2848622524 "msedgewebview2.exe" queries volume information of "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\WidevineCdm\manifest.json" at 00000000-00005224-00000C17-2848625069 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\segoeui.ttf" at 00000000-00005224-00000C17-2849338060 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\segoeuib.ttf" at 00000000-00005224-00000C17-2849353378 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\seguisb.ttf" at 00000000-00005224-00000C17-2849485571 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\timesi.ttf" at 00000000-00005224-00000C17-2851663557 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\timesi.ttf" at 00000000-00005224-00000C17-2851723959 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\timesbi.ttf" at 00000000-00005224-00000C17-2851730471 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\timesbi.ttf" at 00000000-00005224-00000C17-2851735087 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\ARIALN.TTF" at 00000000-00005224-00000C17-2851761294 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\ARIALN.TTF" at 00000000-00005224-00000C17-2851766078 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\ariali.ttf" at 00000000-00005224-00000C17-2851767873 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\ariali.ttf" at 00000000-00005224-00000C17-2851801481 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\ARIALNI.TTF" at 00000000-00005224-00000C17-2851805169 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\ARIALNI.TTF" at 00000000-00005224-00000C17-2851808785 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\ARIALNB.TTF" at 00000000-00005224-00000C17-2851811698 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\ARIALNB.TTF" at 00000000-00005224-00000C17-2851815180 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\arialbi.ttf" at 00000000-00005224-00000C17-2851816936 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\arialbi.ttf" at 00000000-00005224-00000C17-285182157848:T42c,Found string "GetCommandLineA" (Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found string "GetCommandLineW" (Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found string "GetCommandLineA" (Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found string "GetCommandLineW" (Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found string "GetCommandLineA" (Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found string "GetCommandLineW" (Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp")49:T778,Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "2FA_Code_Engine.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "2FA_Code_Engine.exe") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtOpenProcess" (Indicator: "NtOpenProcess"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetProcessHeaps" (Indicator: "GetProcessHeaps"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "NtOpenProcess" (Indicator: "NtOpenProcess"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "GetProcessHeaps" (Indicator: "GetProcessHeaps"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")4a:T610,"2FA Code Engine.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "2FA Code Engine.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "2FA Code Engine.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "2FA Code Engine.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "2FA Code Engine.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "2FA Code Engine.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "2FA Code Engine.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "2FA Code Engine.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "2FA Code Engine.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "2FA Code Engine.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "2FA Code Engine.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "2FA Code Engine.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "2FA Code Engine.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "2FA Code Engine.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")4b:T562,"2FA_Code_Engine.exe" called "CreateDirectoryW" with parameter \\?\C:\Users (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "CreateDirectoryW" with parameter \\?\C:\Users\%OSUSER% (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "CreateDirectoryW" with parameter \\?\%USERPROFILE%\AppData (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "CreateDirectoryW" with parameter \\?\%USERPROFILE%\AppData\Roaming (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "CreateDirectoryW" with parameter \\?\%APPDATA%\Notonlycode (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "CreateDirectoryW" with parameter \\?\%APPDATA%\Notonlycode\2FA Code Engine 93.11.1 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "CreateDirectoryW" with parameter \\?\%APPDATA%\Notonlycode\2FA Code Engine 93.11.1\install (UID: 00000000-00007864) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\2FA Code Engine.exe (UID: 00000000-00005224) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView (UID: 00000000-00005224) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Crashpad (UID: 00000000-00005224) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Crashpad\reports (UID: 00000000-00005224)4c:Tc40,"2FA_Code_Engine.exe" called "NtCreateNamedPipeFile" with parameter "pipe\ToServerAdvinst_Extract_C:\2FA_Code_Engine.exe" - (UID: 00000000-00007864) "2FA Code Engine.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.5740.952.7889707601427223284" - (UID: 00000000-00005740) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\crashpad_5224_XAFNIEVZNFZVXIRL" - (UID: 00000000-00005224) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.5224.7872.10617734820277754850" - (UID: 00000000-00005224) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.5224.7872.13169556438417274843" - (UID: 00000000-00005224) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.5224.7872.12768388708972171360" - (UID: 00000000-00005224) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.5224.7872.16756401638841479819" - (UID: 00000000-00005224) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.5224.7872.4300140392835298955" - (UID: 00000000-00005224) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.5224.5396.20675590498264754" - (UID: 00000000-00005224) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.5224.7872.6591011724066337172" - (UID: 00000000-00005224) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.5224.7872.8178353442614193698" - (UID: 00000000-00005224) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.5224.7872.4814590552596934238" - (UID: 00000000-00005224) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.5224.5396.8412957839668860662" - (UID: 00000000-00005224) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.5224.5396.4368391447242615935" - (UID: 00000000-00005224) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.5224.7872.11744763582972715185" - (UID: 00000000-00005224) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.5224.7872.4698943305848615906" - (UID: 00000000-00005224) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.5224.7872.221297647453062745" - (UID: 00000000-00005224) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.5224.7872.11948996118894005865" - (UID: 00000000-00005224) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.5224.7872.1077791773805025704" - (UID: 00000000-00005224) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.5224.7872.17596327187753490309" - (UID: 00000000-00005224) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\crashpad_5224_XAFNIEVZNFZVXIRL" - (UID: 00000000-00004400) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.6072.4432.17305025798141891310" - (UID: 00000000-00006072)4d:T5835,"2FA_Code_Engine.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\psapi.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\WindowsCodecs.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\msi.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USP10.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\msls31.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\mpr.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\profapi.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\gdiplus.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\userenv.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dwmapi.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\davhlpr.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\oleaut32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\comctl32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\gdi32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\user32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\comdlg32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\msimg32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dbghelp.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wininet.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\urlmon.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cabinet.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\propsys.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\rsaenh.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\apphelp.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\msasn1.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\crypt32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wintrust.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\lpk.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\setupapi.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\usp10.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\msihnd.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shcore.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptsp.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\secur32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\samcli.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\netapi32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\netutils.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\srvcli.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wkscli.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RICHED20.DLL (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter msi.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\KERNEL32.DLL (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\VERSION.DLL (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\OLE32.DLL (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter Ntdll.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\TSAPPCMP.DLL (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter MsiMsg.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\SHLWAPI.DLL (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\WLDP.DLL (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\ADVAPI32.DLL (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\APPHELP.DLL (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\sxs.DLL (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\MSCOREE.DLL (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\fusion.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\SHELL32.DLL (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\NTDLL.DLL (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\PCACLI.DLL (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\USER32.DLL (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\RPCRT4.DLL (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007864) "MSI972D.tmp" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007612) "MSI972D.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007612) "MSI972D.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00007612) "MSI972D.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007612) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ntmarta.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedge.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter MDMRegistration.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter DWrite.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter dnsapi.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-shcore-scaling-l1-1-1.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\telclient.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\oneds.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter Iphlpapi.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\oneauth.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter webauthn.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wldp.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l1-1-0.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shcore.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter atlthunk.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter OLEACC.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\hevcdecoder.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\ffmpeg.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\TenantRestrictionsPlugin.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\optimization_guide_internal.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00005224) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\microsoft_shell_integration.dll (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\dbghelp.dll (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004400) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006628) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006628) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00006628) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00006628) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006628) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006628) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006628) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006628) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006628) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00006628) "msedgewebview2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006628) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedge.dll (UID: 00000000-00006628) "msedgewebview2.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006628) "msedgewebview2.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006628) "msedgewebview2.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00006628) "msedgewebview2.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00006628) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00006628) "msedgewebview2.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00006628) "msedgewebview2.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006628) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00006628)4e:T167f,"msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\BrowserMetrics-spare.pma & %APPDATA%\2FA Code Engine.exe\EBWebView\BrowserMetrics\BrowserMetrics-6AD149FC-1468.pma (UID: 00000000-00005224) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Edge-Local-State-Tmp-70350048-5b2d-4143-85a5-ab9d674c9d92.tmp & %APPDATA%\2FA Code Engine.exe\EBWebView\Local State (UID: 00000000-00005224) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index & %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Code Cache\js\index-dir\todelete_e55e9aa82d21e3ba (UID: 00000000-00005224) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index & %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Code Cache\wasm\index-dir\todelete_6b058474d7ccb371 (UID: 00000000-00005224) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index & %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index (UID: 00000000-00005224) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Code Cache\wasm\index-dir\temp-index & %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index (UID: 00000000-00005224) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Site Characteristics Database/000001.dbtmp & %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Site Characteristics Database/CURRENT (UID: 00000000-00005224) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Sync Data\LevelDB/000001.dbtmp & %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Sync Data\LevelDB/CURRENT (UID: 00000000-00005224) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension Rules/000001.dbtmp & %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension Rules/CURRENT (UID: 00000000-00005224) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Default\shared_proto_db\metadata/000001.dbtmp & %APPDATA%\2FA Code Engine.exe\EBWebView\Default\shared_proto_db\metadata/CURRENT (UID: 00000000-00005224) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Default\shared_proto_db/000001.dbtmp & %APPDATA%\2FA Code Engine.exe\EBWebView\Default\shared_proto_db/CURRENT (UID: 00000000-00005224) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\component_crx_cache\96a9b59d-f7ca-4b07-a825-1ac09477c17d.tmp & %APPDATA%\2FA Code Engine.exe\EBWebView\component_crx_cache\metadata.json (UID: 00000000-00005224) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension Scripts/000001.dbtmp & %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension Scripts/CURRENT (UID: 00000000-00005224) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension State/000001.dbtmp & %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension State/CURRENT (UID: 00000000-00005224) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Default\91344438-3207-4d8a-9d5d-a2e977597f0b.tmp & %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Secure Preferences (UID: 00000000-00005224) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Default\877c0fad-fc65-4ffc-8304-6d23f9faa8cd.tmp & %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Preferences (UID: 00000000-00005224) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Default\c3d37513-63cb-4a63-97ae-9fc059fb37d9.tmp & %APPDATA%\2FA Code Engine.exe\EBWebView\Default\BookmarkMergedSurfaceOrdering (UID: 00000000-00005224) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Default\26c92cf6-3300-41ab-a984-7e34c75c4207.tmp & %APPDATA%\2FA Code Engine.exe\EBWebView\Default\BrowsingTopicsState (UID: 00000000-00005224) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\a19009cc-e1e8-48a2-a0b5-0bca836f6aed.tmp & %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\SCT Auditing Pending Reports (UID: 00000000-00006628) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index & %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Shared Dictionary\cache\index-dir\todelete_4a185c3000ba9046 (UID: 00000000-00006628) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Shared Dictionary\cache\index-dir\temp-index & %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index (UID: 00000000-00006628) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\4da9de47-855f-4c03-bc4f-003f15510514.tmp & %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\Sdch Dictionaries (UID: 00000000-00006628) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\2c6793b3-1e32-4919-946b-e65c657c0c19.tmp & %APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\Network Persistent State (UID: 00000000-00006628)4f:T11b80,"2FA_Code_Engine.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter FindFirstStreamW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter FindNextStreamW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter SetDllDirectory (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GuardCheckLongJumpTarget (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter PathIsUNCW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter PathFileExistsW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter CLSIDFromString (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter WinSqmIsOptedIn (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter SaferiChangeRegistryScope (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter SaferGetLevelInformation (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter CoQueryProxyBlanket (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter ApphelpGetMsiProperties (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter SdbInitDatabase (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter SdbFindFirstMsiPackage_Str (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter SdbReleaseDatabase (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter CheckElevationEnabled (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter PcaNotifyMsiInstall (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderPathW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter RtlImageNtHeaderEx (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter CoIsHandlerConnected (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter PcaNotifyMsiCustomAction (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter I_RpcBindingInqLocalClientPID (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter wsprintfW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter CoDisconnectObject (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter CoFreeUnusedLibraries (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter RegDeleteKeyW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter GdiplusShutdown (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter DestroyCursor (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00007864) "MSI972D.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007612) "MSI972D.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007612) "MSI972D.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007612) "MSI972D.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007612) "MSI972D.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007612) "MSI972D.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007612) "MSI972D.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007612) "MSI972D.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007612) "MSI972D.tmp" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007612) "MSI972D.tmp" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007612) "MSI972D.tmp" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007612) "MSI972D.tmp" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00007612) "MSI972D.tmp" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007612) "MSI972D.tmp" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007612) "MSI972D.tmp" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00007612) "MSI972D.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007612) "MSI972D.tmp" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00007612) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlGetDeviceFamilyInfoEnum (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter BuildExplicitAccessWithNameW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter BuildSecurityDescriptorW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter AccProvGetCapabilities (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsSandboxedProcess (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WerRegisterCustomMetadata (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateProcessAsUserW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtSetInformationProcess (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSecurityInfo (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsValidSecurityDescriptor (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorControl (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorOwner (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorGroup (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorDacl (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorSacl (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsValidAcl (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetAce (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetSecurityInfo (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter PrefetchVirtualMemory (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter ChromeMain (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter signal (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateWindowStationW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetThreadDesktop (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter BuildTrusteeWithSidW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetProcessWindowStation (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateDesktopW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterClassExW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter EdgeGetAlternatePrefetchResult (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsDeviceRegisteredWithManagement (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter NetGetAadJoinInformation (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter NetFreeAadJoinInformation (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetCurrentPackageFullName (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjectsEx (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterPowerSettingNotification (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterSuspendResumeNotification (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetProcessDpiAwarenessContext (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CryptProtectData (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSALookupServiceBeginW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSALookupServiceNextW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSALookupServiceEnd (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSACreateEvent (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter NotifyAddrChange (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetPropW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterPointerDeviceNotifications (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter DnsIsZtEnabled (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetPointerDevices (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetDisplayConfigBufferSizes (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter QueryDisplayConfig (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter DisplayConfigGetDeviceInfo (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RoActivateInstance (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterDeviceNotificationW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetICMProfileW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WTSRegisterSessionNotification (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtSetInformationFile (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetTokenInformation (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter MapGenericMask (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter AccessCheck (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetQueueStatus (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateRestrictedToken (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateSplitter (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter FreeSplitter (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter FreeLogs (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateTelemetryClientDecoder (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter FreeTelemetryClientDecoder (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter FreeTelemetryClientDecoderPayload (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateOneDSWrapper (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter FreeOneDSWrapper (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateCommonSchemaHelper (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter FreeCommonSchemaHelper (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateEventListenerService (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter FreeEventListenerService (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetDecodeDebugEventBufferFunc (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlConvertDeviceFamilyInfoToString (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetAdaptersInfo (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CryptProtectMemory (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter LdrRegisterDllNotification (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetPersistedRegistryValueW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetCaretBlinkTime (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidA (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegDeleteKeyExW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetNamedSecurityInfoW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetNamedSecurityInfoW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter AddMandatoryAce (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNIsUserVerifyingPlatformAuthenticatorAvailable (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNAuthenticatorMakeCredential (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNAuthenticatorGetAssertion (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNCancelCurrentOperation (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNGetErrorName (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNFreeCredentialAttestation (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNFreeAssertion (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNGetPlatformCredentialList (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNFreePlatformCredentialList (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNDeletePlatformCredential (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNGetApiVersionNumber (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter OneAuthInitialize (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WldpQueryWindowsLockdownMode (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetPackagesByPackageFamily (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetCurrentApplicationUserModelId (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutList (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter ImmGetIMEFileNameW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter PerfStartProviderEx (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter PerfSetCounterSetInfo (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CryptUnprotectMemory (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter PathMatchSpecW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CertAddStoreToCollection (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetProcessDpiAwareness (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlIsStateSeparationEnabled (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter LoadIconW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter LoadImageW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter EnableNonClientDpiScaling (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsIconic (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsZoomed (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter ClientToScreen (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSystemMetricsForDpi (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInterfaces (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetupDiDestroyDeviceInfoList (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterDragDrop (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CertControlStore (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter PerfCreateInstance (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter PerfSetCounterRefValue (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateBitmap (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateIconIndirect (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter UuidCreate (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetPropW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutNameW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetWindowDisplayAffinity (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetClassInfoExW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter AtlThunk_AllocateData (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter AtlThunk_InitData (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter AtlThunk_DataToCode (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter AtlThunk_FreeData (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateStdAccessibleObject (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetInputScope (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter ScreenToClient (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter ChildWindowFromPoint (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetProcessLaunchForegroundPolicy (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter OneAuthReadAllAccounts (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter OneAuthDiscoverAccounts (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderPathW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtOpenSection (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlInitUnicodeString (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter EnableWindow (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetParent (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter PerfDeleteInstance (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CharLowerW (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CertFindCertificateInStore (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CertGetEnhancedKeyUsage (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsWindowArranged (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SHCreateAssociationRegistration (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter avcodec_find_decoder (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterHostUpdateNotification (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter UnregisterHostUpdateNotification (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter NCryptOpenStorageProvider (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter NCryptIsAlgSupported (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter NCryptFreeObject (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter NCryptCreatePersistedKey (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetWindowDC (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter OffsetRect (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateRectRgnIndirect (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateRectRgn (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CombineRgn (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SelectClipRgn (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsRectEmpty (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter TrackMouseEvent (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetMessageTime (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetCapture (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter WindowFromPoint (UID: 00000000-00005224) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlGetDeviceFamilyInfoEnum (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter WerRegisterCustomMetadata (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetNamedPipeClientProcessId (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtSuspendProcess (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlGetUnloadEventTraceEx (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter NetGetAadJoinInformation (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter NetFreeAadJoinInformation (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetProcessAppSessionGuid (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetWindowsFlightIdsComponentStr (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter WindowsGetStringRawBuffer (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpAddRequestHeaders (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpWriteData (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter MiniDumpWriteDump (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtResumeProcess (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004400) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlGetDeviceFamilyInfoEnum (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter WerRegisterCustomMetadata (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter PrefetchVirtualMemory (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter ChromeMain (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter signal (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSALookupServiceBeginW (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjectsEx (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSALookupServiceNextW (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSALookupServiceEnd (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSACreateEvent (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter NotifyAddrChange (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter DhcpCApiInitialize (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSACloseEvent (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter CryptProtectMemory (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSASendTo (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSAResetEvent (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSARecvFrom (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSAEnumNetworkEvents (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00006628) "msedgewebview2.exe" called "GetProcAddress" with a parameter CancelIPChangeNotify (UID: 00000000-00006628)50:Ta42,"INSERT INTO `ControlEvent` (`Dialog_`, `Control_`,`Event`,`Argument`, `Condition`, `Ordering`) VALUES ('" (Source: 2FA_Code_Engine.exe, Indicator: "insert into `controlevent` (`dialog_`, `control_`,`event`,`argument`, `condition`, `ordering`) values ('") "SELECT `Data` FROM `Binary` WHERE `Name` = '" (Source: 2FA_Code_Engine.exe, Indicator: "select `data` from `binary` where `name` = '") "SELECT `Data` FROM `Binary` WHERE `Name` = 'InstallerAnalytics.dll'" (Source: 2FA_Code_Engine.exe, Indicator: "select `data` from `binary` where `name` = 'installeranalytics.dll'") "UPDATE `Property` SET `Property`.`Value`=? WHERE Property=?" (Source: 2FA_Code_Engine.exe, Indicator: "update `property` set `property`.`value`=? where property=?") "INSERT INTO `Property` (`Property`, `Value`) VALUES (?, ?)" (Source: 2FA_Code_Engine.exe, Indicator: "insert into `property` (`property`, `value`) values (?, ?)"), "SELECT `Value` FROM `Property` WHERE Property='%s'" (Source: 2FA_Code_Engine.exe, Indicator: "select `value` from `property` where property='%s'"), "SELECT `Component` FROM `Component`" (Source: 2FA_Code_Engine.exe, Indicator: "select `component` from `component`"), "UPDATE `Component` SET `Component`.`ComponentId`=? WHERE Component=?" (Source: 2FA_Code_Engine.exe, Indicator: "update `component` set `component`.`componentid`=? where component=?"), "SELECT `Text` FROM `UIText` WHERE `Key` = '%s'" (Source: 2FA_Code_Engine.exe, Indicator: "select `text` from `uitext` where `key` = '%s'"), "SELECT `Value` FROM `Property` WHERE `Property` = '%s'" (Source: 2FA_Code_Engine.exe, Indicator: "select `value` from `property` where `property` = '%s'"), "SELECT `Data` FROM `Binary` WHERE `Name` = 'Prereq.dll'" (Source: 2FA_Code_Engine.exe, Indicator: "select `data` from `binary` where `name` = 'prereq.dll'"), "SELECT `Data` FROM `Binary` WHERE `Name` = 'viewer.exe'" (Source: 2FA_Code_Engine.exe, Indicator: "select `data` from `binary` where `name` = 'viewer.exe'"), "INSERT OR REPLACE INTO meta(key,value) VALUES(?,?)" (Source: 00000000-00004400.00000003.305316.00100000.00000004.mdmp, Indicator: "insert or replace into meta(key,value) values(?,?)"), "SELECT int_value FROM config WHERE key = ?" (Source: 00000000-00004400.00000003.305316.00144000.00000004.mdmp, Indicator: "select int_value from config where key = ?"), "DELETE FROM page_contents WHERE time_stamp < ?" (Source: 00000000-00005224.00000001.302711.00004000.00000004.mdmp, 00000000-00005224.00000002.304634.00004000.00000004.mdmp, 00000000-00005224.00000003.305202.00004000.00000004.mdmp, Indicator: "delete from page_contents where time_stamp < ?")51:T703,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "2FA_Code_Engine.exe") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateProcessWithTokenW" (Indicator: "CreateProcess"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "CreateProcessWithTokenW" (Indicator: "CreateProcess"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "CreateProcessWithTokenW" (Indicator: "CreateProcess"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")52:T646,Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; File: "2FA_Code_Engine.exe") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "CreateDirectoryAndGetError" (Indicator: "CreateDirectory"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateDirectory" (Indicator: "CreateDirectory"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateDirectoryAndGetError" (Indicator: "CreateDirectory"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "CreateDirectory" (Indicator: "CreateDirectory"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "CreateDirectoryAndGetError" (Indicator: "CreateDirectory"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "CreateDirectory" (Indicator: "CreateDirectory"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp")53:T104b,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "2FA_Code_Engine.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "CreateFileFromAppW" (Indicator: "CreateFile"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateFileVersionInfoWin" (Indicator: "CreateFile"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateFileFromAppW" (Indicator: "CreateFile"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "CreateFileVersionInfoWin" (Indicator: "CreateFile"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "CreateFileFromAppW" (Indicator: "CreateFile"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "CreateFileVersionInfoWin" (Indicator: "CreateFile"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp")54:T402,Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; File: "2FA_Code_Engine.exe") Found reference to API "RegUnLoadKeyW" (Indicator: "RegUnLoadKey"; File: "2FA_Code_Engine.exe") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "RegDisablePredefinedCache" (Indicator: "RegDisablePredefinedCache"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "RegDisablePredefinedCache" (Indicator: "RegDisablePredefinedCache"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")55:T43a,Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "2FA_Code_Engine.exe") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "2FA_Code_Engine.exe") Found reference to API "ShellExecuteInfo members:" (Indicator: "ShellExecute"; File: "2FA_Code_Engine.exe") Found reference to API "Call to ShellExecuteEx() returned:" (Indicator: "ShellExecute"; File: "2FA_Code_Engine.exe") Found reference to API "Call to ShellExecute() for verb<" (Indicator: "ShellExecute"; File: "2FA_Code_Engine.exe") Found reference to API "::ShellExecuteEx() call failed with error code:" (Indicator: "ShellExecute"; File: "2FA_Code_Engine.exe") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")56:T628,Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "2FA_Code_Engine.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "2FA_Code_Engine.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "2FA_Code_Engine.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "2FA_Code_Engine.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "2FA_Code_Engine.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")57:T796,Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "2FA_Code_Engine.exe") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "2FA_Code_Engine.exe") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp")58:Td6f,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "2FA_Code_Engine.exe") Found reference to API "__crtCreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "__crtCreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")59:T856,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "2FA_Code_Engine.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "2FA_Code_Engine.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002220.00000000.302577.7CF85000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002220.00000000.302577.7CF85000.00000002.mdmp") Found reference to API "?_XGetLastError@std@@YAXXZ" (Indicator: "GetLastError"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000002.304750.79614000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000002.304750.79614000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp")5a:T453,Found reference to API "ShowWindow" (Indicator: "ShowWindow"; File: "2FA_Code_Engine.exe") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; File: "2FA_Code_Engine.exe") Found reference to API "AttemptToNotifyRunningChrome:GetWindowThreadProcessId failed" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "AttemptToNotifyRunningChrome:GetWindowThreadProcessId failed" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp")5b:T816,"MSI7AC5.tmp" contains export function called "AI_AuthorSinglePackage" at ordinal 1 "MSI7AC5.tmp" contains export function called "AI_ResolveKnownFolders" at ordinal 2 "MSI7AC5.tmp" contains export function called "AI_SearchOfficeAddins" at ordinal 3 "MSI7AC5.tmp" contains export function called "AddCaspolSecurityPolicy" at ordinal 4 "MSI7AC5.tmp" contains export function called "AiSelfRegCA" at ordinal 5 "MSI7AC5.tmp" contains export function called "ApplyHKCUToAllUsers" at ordinal 6 "MSI7AC5.tmp" contains export function called "BringUacToFront" at ordinal 7 "MSI7AC5.tmp" contains export function called "BrowseForFile" at ordinal 8 "MSI7AC5.tmp" contains export function called "CheckFreeTCPPort" at ordinal 9 "MSI7AC5.tmp" contains export function called "CheckIfUserExists" at ordinal 10 "MSI7AC5.tmp" contains export function called "ChooseTextStyles" at ordinal 11 "MSI7AC5.tmp" contains export function called "CloseApplication" at ordinal 12 "MSI7AC5.tmp" contains export function called "CollectFeaturesWithoutCab" at ordinal 13 "MSI7AC5.tmp" contains export function called "ComputeReplaceProductsList" at ordinal 14 "MSI7AC5.tmp" contains export function called "ConfigureNonAdminServiceStart" at ordinal 15 "MSI7AC5.tmp" contains export function called "ConfigureServFailActions" at ordinal 16 "MSI7AC5.tmp" contains export function called "CopyFileFolder" at ordinal 17 "MSI7AC5.tmp" contains export function called "CopyMsiLogFileCommit" at ordinal 18 "MSI7AC5.tmp" contains export function called "CopyMsiLogFileFromUI" at ordinal 19 "MSI7AC5.tmp" contains export function called "CopyMsiLogFileRollback" at ordinal 20 "MSI7AC5.tmp" contains export function called "CopyToUserProfile" at ordinal 21 "MSI7AC5.tmp" contains export function called "CreateExeProcess" at ordinal 22 "MSI7AC5.tmp" contains export function called "DeleteEmptyDirectory" at ordinal 23 "MSI7AC5.tmp" contains export function called "DeleteFromCheckList" at ordinal 24 "MSI7AC5.tmp" contains export function called "DeleteFromComboBox" at ordinal 255c:T27ea,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 2FA_Code_Engine.exe "Software\Caphyon\Advanced Installer\" in Source: 2FA_Code_Engine.exe "Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\" in Source: 2FA_Code_Engine.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 2FA_Code_Engine.exe "Software\Microsoft\Internet Explorer\Settings" in Source: 2FA_Code_Engine.exe "Software\JavaSoft\Java Runtime Environment\" in Source: 2FA_Code_Engine.exe "Software\JavaSoft\Java Development Kit\" in Source: 2FA_Code_Engine.exe "Software\Microsoft\Windows NT\CurrentVersion" in Source: 2FA_Code_Engine.exe "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 2FA_Code_Engine.exe "Software\Caphyon\Setups" in Source: 2FA_Code_Engine.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 2FA_Code_Engine.exe "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 2FA_Code_Engine.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\TempPackages" in Source: 2FA_Code_Engine.exe "Software\Classes" in Source: 2FA_Code_Engine.exe "SOFTWARE\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\SQMClient" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "Hardware\Description\System\CentralProcessor\0" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Flighting\Build" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient\Windows\CommonDatapoints" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "Software\" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp "Software\" in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\MiniDumpAuxiliaryDlls" in Source: 00000000-00004400.00000002.304750.6622D000.00000004.mdmp 00000000-00004400.00000002.304750.66285000.00000004.mdmp 00000000-00004400.00000003.305316.66285000.00000004.mdmp "Software\Microsoft\SystemCertificates\TrustedPeople\PhysicalStores" in Source: 00000000-00004400.00000002.304750.66285000.00000004.mdmp 00000000-00004400.00000003.305316.66285000.00000004.mdmp "Software\Microsoft\EnterpriseCertificates\Disallowed\PhysicalStores" in Source: 00000000-00004400.00000002.304750.66285000.00000004.mdmp 00000000-00004400.00000003.305316.66285000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\CA" in Source: 00000000-00004400.00000002.304750.662C1000.00000004.mdmp 00000000-00004400.00000003.305316.662C1000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Root" in Source: 00000000-00004400.00000002.304750.662C1000.00000004.mdmp 00000000-00004400.00000003.305316.662C1000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\trust" in Source: 00000000-00004400.00000002.304750.662C1000.00000004.mdmp 00000000-00004400.00000003.305316.662C1000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.10.3.37!7" in Source: 00000000-00004400.00000002.304750.662D4000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00004400.00000002.304750.662D4000.00000004.mdmp 00000000-00004400.00000003.305316.662D4000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Disallowed" in Source: 00000000-00004400.00000002.304750.662F6000.00000004.mdmp 00000000-00004400.00000003.305316.662F6000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\TrustedPeople" in Source: 00000000-00004400.00000002.304750.662F6000.00000004.mdmp 00000000-00004400.00000002.304750.6831B000.00000004.mdmp 00000000-00004400.00000003.305316.662F6000.00000004.mdmp 00000000-00004400.00000003.305316.6831B000.00000004.mdmp "ACHINE\Software\Microsoft\WindowsRuntim" in Source: 00000000-00004400.00000003.305316.0011C000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00004400.00000003.305316.66285000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004400.00000003.305316.6629D000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00004400.00000003.305316.6629D000.00000004.mdmp "Software\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00004400.00000003.305316.68300000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Edge\WebView2" in Source: 00000000-00005224.00000000.300792.00178000.00000004.mdmp 00000000-00005224.00000001.302711.00178000.00000004.mdmp 00000000-00005224.00000002.304634.00178000.00000004.mdmp 00000000-00005224.00000003.305202.00178000.00000004.mdmp "Software\Microsoft\EdgeWebView\StabilityMetrics" in Source: 00000000-00005224.00000000.300792.00178000.00000004.mdmp 00000000-00005224.00000001.302711.00178000.00000004.mdmp 00000000-00005224.00000002.304634.00178000.00000004.mdmp 00000000-00005224.00000003.305202.00178000.00000004.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp "SOFTWARE\Policies\Microsoft\SQMClient" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp 00000000-00005224.00000001.302711.4A127000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp 00000000-00005224.00000001.302711.4A127000.00000002.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp 00000000-00005224.00000001.302711.4A127000.00000002.mdmp "Hardware\Description\System\CentralProcessor\0" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Flighting\Build" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient\Windows\CommonDatapoints" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp 00000000-00005224.00000001.302711.4A127000.00000002.mdmp 00000000-00005224.00000002.304634.4A482000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "Software\" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "Software\Microsoft\EdgeWebView\PreferenceMACs\Default" in Source: 00000000-00005224.00000001.302711.00004000.00000004.mdmp 00000000-00005224.00000002.304634.00004000.00000004.mdmp 00000000-00005224.00000003.305202.00004000.00000004.mdmp5d:T91d,Process 2FA_Code_Engine.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7864:168:WilStaging_02" Process 2FA_Code_Engine.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7864:64:WilError_03" Process 2FA_Code_Engine.exe created mutex with name "Local\SM0:7864:168:WilStaging_02" Process 2FA_Code_Engine.exe created mutex with name "SM0:7864:64:WilError_03" Process 2FA_Code_Engine.exe created mutex with name "SM0:7864:168:WilStaging_02" Process 2FA_Code_Engine.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7864:168:WilStaging_02" Process msiexec.exe created mutex with name "\BaseNamedObjects\Local\SM0:6032:304:WilStaging_02" Process msiexec.exe created mutex with name "\BaseNamedObjects\SM0:6032:304:WilStaging_02" Process msiexec.exe created mutex with name "\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process msiexec.exe created mutex with name "\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process msiexec.exe created mutex with name "\BaseNamedObjects\SM0:6032:120:WilError_03" Process MsiExec.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2664:168:WilStaging_02" Process MsiExec.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2664:168:WilStaging_02" Process MsiExec.exe created mutex with name "Local\SessionImmersiveColorMutex" Process MsiExec.exe created mutex with name "SM0:2664:168:WilStaging_02" Process MsiExec.exe created mutex with name "Local\SM0:2664:168:WilStaging_02" Process MsiExec.exe created mutex with name "DBWinMutex" Process MsiExec.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SessionImmersiveColorMutex" Process MsiExec.exe created mutex with name "\Sessions\1\BaseNamedObjects\DBWinMutex" Process msiexec.exe created mutex with name "\BaseNamedObjects\_MSIExecute" Process msiexec.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5964:168:WilStaging_02" Process msiexec.exe created mutex with name "SM0:5964:64:WilError_03" Process msiexec.exe created mutex with name "Local\SM0:5964:168:WilStaging_02" Process msiexec.exe created mutex with name "SM0:5964:168:WilStaging_02" Process msiexec.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5964:168:WilStaging_02"5e:T58a,Found string - \\.\pipe\ToServer Found string - \\.\pipe\ToEnhandedUI Found string - \\.\pipe\ToServerAdvinst_Extract_C:\2FA_Code_Engine.exe Found string - \\.\pipe\crashpad_5224_XAFNIEVZNFZVXIRL Found string - \\.\pipe\LOCAL\mojo.5224.7872.10617734820277754850 Found string - \\.\pipe\LOCAL\mojo.5224.7872.13169556438417274843 Found string - \\.\pipe\LOCAL\mojo.5224.7872.12768388708972171360 Found string - \\.\pipe\LOCAL\mojo.5224.7872.16756401638841479819 Found string - \\.\pipe\LOCAL\mojo.5224.7872.4300140392835298955 Found string - \\.\pipe\LOCAL\mojo.5224.5396.20675590498264754 Found string - \\.\pipe\LOCAL\mojo.5224.7872.6591011724066337172 Found string - \\.\pipe\LOCAL\mojo.5224.7872.8178353442614193698 Found string - \\.\pipe\LOCAL\mojo.5224.7872.4814590552596934238 Found string - \\.\pipe\LOCAL\mojo.5224.5396.8412957839668860662 Found string - \\.\pipe\LOCAL\mojo.5224.5396.4368391447242615935 Found string - \\.\pipe\LOCAL\mojo.5224.7872.11744763582972715185 Found string - \\.\pipe\LOCAL\mojo.5224.7872.4698943305848615906 Found string - \\.\pipe\LOCAL\mojo.5224.7872.221297647453062745 Found string - \\.\pipe\LOCAL\mojo.5224.7872.11948996118894005865 Found string - \\.\pipe\LOCAL\mojo.5224.7872.1077791773805025704 Found string - \\.\pipe\LOCAL\mojo.5224.7872.17596327187753490309 Found string - \\.\pipe\ Found string - \\.\pipe\LOCAL\mojo. Found string - \\.\pipe\mojo.5f:Ta3b8,"SOFTWARE\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\SQMClient" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "Hardware\Description\System\CentralProcessor\0" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Flighting\Build" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient\Windows\CommonDatapoints" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "Software\" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp "Software\" in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\MiniDumpAuxiliaryDlls" in Source: 00000000-00004400.00000002.304750.6622D000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\MiniDumpAuxiliaryDlls" in Source: 00000000-00004400.00000002.304750.66285000.00000004.mdmp "Software\Microsoft\SystemCertificates\TrustedPeople\PhysicalStores" in Source: 00000000-00004400.00000002.304750.66285000.00000004.mdmp "Software\Microsoft\EnterpriseCertificates\Disallowed\PhysicalStores" in Source: 00000000-00004400.00000002.304750.66285000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\CA" in Source: 00000000-00004400.00000002.304750.662C1000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Root" in Source: 00000000-00004400.00000002.304750.662C1000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\trust" in Source: 00000000-00004400.00000002.304750.662C1000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.10.3.37!7" in Source: 00000000-00004400.00000002.304750.662D4000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00004400.00000002.304750.662D4000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Disallowed" in Source: 00000000-00004400.00000002.304750.662F6000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\TrustedPeople" in Source: 00000000-00004400.00000002.304750.662F6000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\TrustedPeople" in Source: 00000000-00004400.00000002.304750.6831B000.00000004.mdmp "ACHINE\Software\Microsoft\WindowsRuntim" in Source: 00000000-00004400.00000003.305316.0011C000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00004400.00000003.305316.66285000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\MiniDumpAuxiliaryDlls" in Source: 00000000-00004400.00000003.305316.66285000.00000004.mdmp "Software\Microsoft\SystemCertificates\TrustedPeople\PhysicalStores" in Source: 00000000-00004400.00000003.305316.66285000.00000004.mdmp "Software\Microsoft\EnterpriseCertificates\Disallowed\PhysicalStores" in Source: 00000000-00004400.00000003.305316.66285000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004400.00000003.305316.6629D000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00004400.00000003.305316.6629D000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\CA" in Source: 00000000-00004400.00000003.305316.662C1000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Root" in Source: 00000000-00004400.00000003.305316.662C1000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\trust" in Source: 00000000-00004400.00000003.305316.662C1000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00004400.00000003.305316.662D4000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Disallowed" in Source: 00000000-00004400.00000003.305316.662F6000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\TrustedPeople" in Source: 00000000-00004400.00000003.305316.662F6000.00000004.mdmp "Software\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00004400.00000003.305316.68300000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\TrustedPeople" in Source: 00000000-00004400.00000003.305316.6831B000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Edge\WebView2" in Source: 00000000-00005224.00000000.300792.00178000.00000004.mdmp "Software\Microsoft\EdgeWebView\StabilityMetrics" in Source: 00000000-00005224.00000000.300792.00178000.00000004.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\SQMClient" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "Hardware\Description\System\CentralProcessor\0" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Flighting\Build" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient\Windows\CommonDatapoints" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "Software\" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp "Software\Microsoft\EdgeWebView\PreferenceMACs\Default" in Source: 00000000-00005224.00000001.302711.00004000.00000004.mdmp "2235-1001\Software\Microsoft\EdgeWebView\" in Source: 00000000-00005224.00000001.302711.000CC000.00000004.mdmp "L_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005224.00000001.302711.000EC000.00000004.mdmp "\MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005224.00000001.302711.000EC000.00000004.mdmp "\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\EdgeWebView\msProcessIntegrityV4" in Source: 00000000-00005224.00000001.302711.000F4000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Edge\WebView2" in Source: 00000000-00005224.00000001.302711.00178000.00000004.mdmp "Software\Microsoft\EdgeWebView\StabilityMetrics" in Source: 00000000-00005224.00000001.302711.00178000.00000004.mdmp "SOFTWARE\360\360se6" in Source: 00000000-00005224.00000001.302711.00904000.00000004.mdmp "SOFTWARE\360Chrome" in Source: 00000000-00005224.00000001.302711.00904000.00000004.mdmp "SOFTWARE\360ChromeX" in Source: 00000000-00005224.00000001.302711.00904000.00000004.mdmp "SOFTWARE\SogouExplorer" in Source: 00000000-00005224.00000001.302711.00904000.00000004.mdmp "SOFTWARE\Tencent\QQBrowser" in Source: 00000000-00005224.00000001.302711.00904000.00000004.mdmp "SOFTWARE\Lenovo\SLBrowser" in Source: 00000000-00005224.00000001.302711.00904000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005224.00000001.302711.4A127000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00005224.00000001.302711.4A127000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00005224.00000001.302711.4A127000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00005224.00000001.302711.4A127000.00000002.mdmp "Y\MACHINE\Software\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00005224.00000001.302711.61A13000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Disallowed" in Source: 00000000-00005224.00000001.302711.61ABC000.00000004.mdmp "938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005224.00000001.302711.61ABC000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_22502.1401.11.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.64B13000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00005224.00000001.302711.64B13000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\ROOT" in Source: 00000000-00005224.00000001.302711.64B13000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\CA" in Source: 00000000-00005224.00000001.302711.64B13000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Disallowed" in Source: 00000000-00005224.00000001.302711.64B13000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\TrustedPeople" in Source: 00000000-00005224.00000001.302711.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.StorePurchaseApp_22312.1401.4.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGamingOverlay_6.123.11012.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.549981C3F5F10_4.2308.1005.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.54.63007.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGamingOverlay_6.124.1221.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsSoundRecorder_1.0.71.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsNotepad_11.2312.18.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_1.0.186.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsFeedbackHub_1.2401.20253.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.64B13000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9" in Source: 00000000-00005224.00000001.302711.64B13000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005224.00000001.302711.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.22621.1_neutral_neutral_cw5n1h2txyewy\App\Capabilities" in Source: 00000000-00005224.00000001.302711.64BE9000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.22621.900_neutral_neutral_cw5n1h2txyewy\App\Capabilities" in Source: 00000000-00005224.00000001.302711.64BE9000.00000004.mdmp "TRY\MACHINE\Software\Microsoft\WindowsRuntim" in Source: 00000000-00005224.00000001.302711.64BE9000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005224.00000001.302711.64BE9000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_1.0.211.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Todos_2.114.7122.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Clipchamp.Clipchamp_2.9.1.0_neutral__yxz26nhyzhsrt\App\Capabilities" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCamera_2023.2312.3.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.PowerAutomateDesktop_1.0.1225.0_x64__8wekyb3d8bbwe\PAD.Console\Capabilities" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCalculator_11.2311.0.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsSoundRecorder_1.0.71.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_1.0.186.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Getstarted_10.2309.0.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Paint_11.2403.28.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_1.0.57.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_1.23092.151.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ScreenSketch_11.2312.33.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_1.23092.158.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_1.0.188.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace_36354489" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00005224.00000001.302711.69600000.00000004.mdmp "Software\Microsoft\EdgeWebView\PreferenceMACs\Default" in Source: 00000000-00005224.00000002.304634.00004000.00000004.mdmp "2235-1001\Software\Microsoft\EdgeWebView\" in Source: 00000000-00005224.00000002.304634.000CC000.00000004.mdmp "\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\EdgeWebView\msProcessIntegrityV4" in Source: 00000000-00005224.00000002.304634.000F4000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Edge\WebView2" in Source: 00000000-00005224.00000002.304634.00178000.00000004.mdmp "Software\Microsoft\EdgeWebView\StabilityMetrics" in Source: 00000000-00005224.00000002.304634.00178000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005224.00000002.304634.4A482000.00000002.mdmp "Software\Microsoft\EdgeWebView\PreferenceMACs\Default" in Source: 00000000-00005224.00000003.305202.00004000.00000004.mdmp "L_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005224.00000003.305202.000EC000.00000004.mdmp "\MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005224.00000003.305202.000EC000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Edge\WebView2" in Source: 00000000-00005224.00000003.305202.00178000.00000004.mdmp "Software\Microsoft\EdgeWebView\StabilityMetrics" in Source: 00000000-00005224.00000003.305202.00178000.00000004.mdmp "SOFTWARE\360\360se6" in Source: 00000000-00005224.00000003.305202.00904000.00000004.mdmp "SOFTWARE\360Chrome" in Source: 00000000-00005224.00000003.305202.00904000.00000004.mdmp "SOFTWARE\360ChromeX" in Source: 00000000-00005224.00000003.305202.00904000.00000004.mdmp "SOFTWARE\SogouExplorer" in Source: 00000000-00005224.00000003.305202.00904000.00000004.mdmp "SOFTWARE\Tencent\QQBrowser" in Source: 00000000-00005224.00000003.305202.00904000.00000004.mdmp "SOFTWARE\Lenovo\SLBrowser" in Source: 00000000-00005224.00000003.305202.00904000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceRegistration" in Source: 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp "Software\Policies\Microsoft\Edge\WebView2\" in Source: 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp "SOFTWARE\Microsoft\AuthN" in Source: 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp "Software\Policies\Microsoft\SystemCertificates\Disallowed" in Source: 00000000-00005224.00000003.305202.61ABC000.00000004.mdmp "938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005224.00000003.305202.61ABC000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_22502.1401.11.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.64B13000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00005224.00000003.305202.64B13000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\ROOT" in Source: 00000000-00005224.00000003.305202.64B13000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\CA" in Source: 00000000-00005224.00000003.305202.64B13000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Disallowed" in Source: 00000000-00005224.00000003.305202.64B13000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\TrustedPeople" in Source: 00000000-00005224.00000003.305202.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.StorePurchaseApp_22312.1401.4.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGamingOverlay_6.123.11012.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.549981C3F5F10_4.2308.1005.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.54.63007.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGamingOverlay_6.124.1221.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsSoundRecorder_1.0.71.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsNotepad_11.2312.18.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_1.0.186.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsFeedbackHub_1.2401.20253.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.64B13000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9" in Source: 00000000-00005224.00000003.305202.64B13000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005224.00000003.305202.64B13000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.22621.1_neutral_neutral_cw5n1h2txyewy\App\Capabilities" in Source: 00000000-00005224.00000003.305202.64BE9000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.22621.900_neutral_neutral_cw5n1h2txyewy\App\Capabilities" in Source: 00000000-00005224.00000003.305202.64BE9000.00000004.mdmp "TRY\MACHINE\Software\Microsoft\WindowsRuntim" in Source: 00000000-00005224.00000003.305202.64BE9000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_1.0.211.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Todos_2.114.7122.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Clipchamp.Clipchamp_2.9.1.0_neutral__yxz26nhyzhsrt\App\Capabilities" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCamera_2023.2312.3.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.PowerAutomateDesktop_1.0.1225.0_x64__8wekyb3d8bbwe\PAD.Console\Capabilities" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCalculator_11.2311.0.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsSoundRecorder_1.0.71.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_1.0.186.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Getstarted_10.2309.0.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Paint_11.2403.28.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_1.0.57.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_1.23092.151.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ScreenSketch_11.2312.33.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_1.23092.158.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_1.0.188.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace_36354489" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00005224.00000003.305202.69600000.00000004.mdmp "Software\Classes\CLSID\" in Source: 00000000-00005740.00000000.300722.5D4FF000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00005740.00000000.300722.5D4FF000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005740.00000000.300722.5D4FF000.00000002.mdmp "Software\Policies\Microsoft\Edge\WebView2\" in Source: 00000000-00005740.00000000.300722.5D4FF000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005740.00000000.300722.5D4FF000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005740.00000000.300722.5D4FF000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00005740.00000000.300722.5D4FF000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00005740.00000000.300722.5D4FF000.00000002.mdmp "Software\" in Source: 00000000-00005740.00000000.300722.5D4FF000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00005740.00000000.300722.5D4FF000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00005740.00000000.300722.5D4FF000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00005740.00000000.300722.5D4FF000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00005740.00000000.300722.5D4FF000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115" in Source: 00000000-00005740.00000000.300722.8CD26000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00005740.00000000.300722.8CD26000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005740.00000000.300722.8CD26000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00005740.00000000.300722.8CE80000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00005740.00000000.300722.F35F0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F" in Source: 00000000-00005740.00000000.300722.F35F0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-0" in Source: 00000000-00005740.00000000.300722.F35F0000.00000004.mdmp "y\Machine\Software\Classes\A@" in Source: 00000000-00005740.00000001.302643.F35F0000.00000004.mdmp "y\Machine\Software\Classes\A@" in Source: 00000000-00005740.00000003.305632.F35F0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00005752.00000000.302908.5CF32000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00005752.00000000.302908.5CF32000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00005752.00000000.302908.5CF32000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00005752.00000000.302908.5CF32000.00000002.mdmp "Software\" in Source: 00000000-00005752.00000000.302908.5CF32000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00005752.00000000.302908.5CF32000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005752.00000000.302908.5CF32000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00005752.00000000.302908.5CF32000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005752.00000000.302908.5CF32000.00000002.mdmp "\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\EdgeWebView\msEdgeDisableThirdPartyHook" in Source: 00000000-00006072.00000000.301566.00090000.00000004.mdmp "\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\EdgeWebView\msEdgeDisableThirdPartyHook" in Source: 00000000-00006072.00000001.303485.00090000.00000004.mdmp "\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\EdgeWebView\msEdgeDisableThirdPartyHook" in Source: 00000000-00006072.00000002.305300.00090000.00000004.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00006356.00000000.301579.1458D000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00006356.00000000.301579.1458D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\SQMClient" in Source: 00000000-00006356.00000000.301579.1458D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00006356.00000000.301579.1458D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00006356.00000000.301579.1458D000.00000002.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00006356.00000000.301579.1458D000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00006356.00000000.301579.1458D000.00000002.mdmp "Hardware\Description\System\CentralProcessor\0" in Source: 00000000-00006356.00000000.301579.1458D000.00000002.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00006356.00000000.301579.1458D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Flighting\Build" in Source: 00000000-00006356.00000000.301579.1458D000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient\Windows\CommonDatapoints" in Source: 00000000-00006356.00000000.301579.1458D000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006356.00000000.301579.1458D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00006356.00000000.301579.1458D000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006356.00000000.301579.1458D000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00006356.00000000.301579.1458D000.00000002.mdmp "Software\" in Source: 00000000-00006356.00000000.301579.1458D000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00006356.00000000.301579.1458D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00006356.00000000.301579.1458D000.00000002.mdmp "\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\EdgeWebView\" in Source: 00000000-00006628.00000000.301304.000C8000.00000004.mdmp "\Machine\Software\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\cohort" in Source: 00000000-00006628.00000001.303225.00074000.00000004.mdmp "\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\EdgeWebView\" in Source: 00000000-00006628.00000001.303225.000C8000.00000004.mdmp "\Machine\Software\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\cohort" in Source: 00000000-00006628.00000002.305143.00074000.00000004.mdmp "\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\EdgeWebView\" in Source: 00000000-00006628.00000002.305143.000C8000.00000004.mdmp "\Machine\Software\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\cohort" in Source: 00000000-00006628.00000003.305275.00074000.00000004.mdmp "\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\EdgeWebView\" in Source: 00000000-00006628.00000003.305275.000C8000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007612.00000000.300598.04AE0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00007864.00000000.299416.00A6D000.00000002.mdmp "Software\Caphyon\Advanced Installer\" in Source: 00000000-00007864.00000000.299416.00A6D000.00000002.mdmp "Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\" in Source: 00000000-00007864.00000000.299416.00A6D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007864.00000000.299416.00A6D000.00000002.mdmp "Software\Microsoft\Internet Explorer\Settings" in Source: 00000000-00007864.00000000.299416.00A6D000.00000002.mdmp "Software\JavaSoft\Java Runtime Environment\" in Source: 00000000-00007864.00000000.299416.00A6D000.00000002.mdmp "Software\JavaSoft\Java Development Kit\" in Source: 00000000-00007864.00000000.299416.00A6D000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007864.00000000.299416.00A6D000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00007864.00000000.299416.00A6D000.00000002.mdmp "Software\Caphyon\Setups" in Source: 00000000-00007864.00000000.299416.00A6D000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007864.00000000.299416.00A6D000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00007864.00000000.299416.00A6D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\TempPackages" in Source: 00000000-00007864.00000000.299416.00A6D000.00000002.mdmp60:T9e9,"GET /0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/faq HTTP/1.1 Host: pub.futsalbandung.org User-Agent: Go-http-client/1.1 Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Thu 15 Oct 2026 21:48:13 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=31 cfOrigin;dur=645 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=3fHj%2FPurfQ%2B44VGe9Z3uHj1xiDuvGSnJRYqkYyzS6ZlJSH13%2BJPCfRj5wVNl%2F2ERn4%2BIM%2FqAUm9Ty6jvvhDUjwUrSIJAMSevkFjf%2FwV3ArUjzzl3Z3HUvoysH5Ll5r%2B%2FhFaWdOEQ3Dw%3D"}]} CF-RAY: a4b206d37f8e6780-DFW alt-svc: h3=":443"; ma=86400 with no response body "GET /0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/config HTTP/1.1 Host: pub.futsalbandung.org User-Agent: Go-http-client/1.1 Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Thu 15 Oct 2026 21:48:13 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=33 cfOrigin;dur=198 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=wUT5nJ%2BqNCVcRvwcswvy6qF3qABy9lnbEVJS%2FU0PGpT3nBeg0svw%2B7PbpDDZZ8xSwDoyJrimHvbPPfjONBVBOHZpeHluw1CcDIJ6laHoQ96MlFWL7ZbBHw7QIpM69RTrSpP%2FQRgF%2BTg%3D"}]} Content-Encoding: gzip CF-RAY: a4b206d80bae6780-DFW alt-svc: h3=":443"; ma=86400 with response body ==>7B22656E63223A22573249384175424D4D365562584F6168305731464B334953325378797A6958647A5A4B69354B35495257734A76494B6D475643556E34646E....... "GET /+n_A3yiwNZa5kZmRi HTTP/2 Host: t.me User-Agent: Go-http-client/2.0 Accept-Encoding: gzip" Response ==> HTTP/2 200 OK Content-Type: text/html; charset=utf-8 Date: Thu 15 Oct 2026 21:47:59 GMT Server: nginx/1.30.1 Set-Cookie: stel_ssid=750389617559a4cafd_9026148509404086883; expires=Fri 16 Oct 2026 21:47:59 GMT; path=/; samesite=None; secure; HttpOnly Content-Security-Policy: frame-ancestors https://web.telegram.org X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Encoding: gzip Cache-Control: no-store Pragma: no-cache Strict-Transport-Security: max-age=35768000 with response body ==>BINARY_CONTENT.......61:T4c0c,"2FA_Code_Engine.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 741d0000 "2FA_Code_Engine.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 769f0000 "2FA_Code_Engine.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 769f0000 "2FA_Code_Engine.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 769f0000 "2FA_Code_Engine.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 769f0000 "2FA_Code_Engine.exe" loaded module "KERNEL32" at base 76230000 "2FA_Code_Engine.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 769f0000 "2FA_Code_Engine.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 769f0000 "2FA_Code_Engine.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 769f0000 "2FA_Code_Engine.exe" loaded module "USER32.DLL" at base 756f0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\PSAPI.DLL" at base 76f30000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSCODECS.DLL" at base 74050000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPT.DLL" at base 74030000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\MSI.DLL" at base 73d70000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\USP10.DLL" at base 73d50000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\MSLS31.DLL" at base 73d20000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74c40000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\MPR.DLL" at base 749b0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74450000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\PROFAPI.DLL" at base 73d00000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\GDIPLUS.DLL" at base 73b90000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 744d0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 73b60000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\DAVHLPR.DLL" at base 73b50000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76380000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 764d0000 "2FA_Code_Engine.exe" loaded module "IMM32.DLL" at base 768a0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\COMCTL32.DLL" at base 73ab0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 74c60000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 761b0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\GDI32.DLL" at base 765c0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\USER32.DLL" at base 756f0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\COMDLG32.DLL" at base 75f70000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\MSIMG32.DLL" at base 73aa0000 "2FA_Code_Engine.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76230000 "2FA_Code_Engine.exe" loaded module "KERNEL32.DLL" at base 76230000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\DBGHELP.DLL" at base 738c0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 74520000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 73710000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\CABINET.DLL" at base 73480000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 76230000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 733b0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73380000 "2FA_Code_Engine.exe" loaded module "NTDLL.DLL" at base 76f50000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74350000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\MSASN1.DLL" at base 73370000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 76610000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 752d0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 76570000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\LPK.DLL" at base 5270000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 758a0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\MSIHND.DLL" at base 73300000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\SHCORE.DLL" at base 76c70000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTSP.DLL" at base 741b0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\SECUR32.DLL" at base 732f0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\SAMCLI.DLL" at base 732a0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32.DLL" at base 76720000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\NETAPI32.DLL" at base 73280000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\NETUTILS.DLL" at base 734b0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\SRVCLI.DLL" at base 734c0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\WKSCLI.DLL" at base 73260000 "2FA_Code_Engine.exe" loaded module "GDIPLUS.DLL" at base 73b90000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.22621.1635_NONE_9FA79A41E294B962\GDIPLUS.DLL" at base 73b90000 "2FA_Code_Engine.exe" loaded module "OLE32.DLL" at base 76380000 "2FA_Code_Engine.exe" loaded module "COMCTL32.DLL" at base 749d0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 731e0000 "2FA_Code_Engine.exe" loaded module "ADVAPI32.DLL" at base 761b0000 "2FA_Code_Engine.exe" loaded module "VERSION.DLL" at base 74c40000 "2FA_Code_Engine.exe" loaded module "SHLWAPI.DLL" at base 76570000 "2FA_Code_Engine.exe" loaded module "SHELL32.DLL" at base 74c60000 "2FA_Code_Engine.exe" loaded module "MSI.DLL" at base 73d70000 "2FA_Code_Engine.exe" loaded module "RPCRT4.DLL" at base 76930000 "2FA_Code_Engine.exe" loaded module "SSPICLI.DLL" at base 732c0000 "2FA_Code_Engine.exe" loaded module "OLEAUT32.DLL" at base 764d0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSWOW64\KERNEL32.DLL" at base 76230000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSWOW64\VERSION.DLL" at base 74c40000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSWOW64\OLE32.DLL" at base 76380000 "2FA_Code_Engine.exe" loaded module "COMCTL32" at base 749d0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSWOW64\SHLWAPI.DLL" at base 76570000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSWOW64\WLDP.DLL" at base 729f0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSWOW64\ADVAPI32.DLL" at base 761b0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSWOW64\MSI.DLL" at base 73d70000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSWOW64\APPHELP.DLL" at base 74350000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSWOW64\MSCOREE.DLL" at base 72990000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72900000 "2FA_Code_Engine.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74430000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 74c60000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSWOW64\NTDLL.DLL" at base 76f50000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSWOW64\PCACLI.DLL" at base 728e0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSWOW64\USER32.DLL" at base 756f0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSWOW64\RPCRT4.DLL" at base 76930000 "2FA_Code_Engine.exe" loaded module "KERNELBASE" at base 769f0000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 72960000 "2FA_Code_Engine.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74430000 "MSI972D.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 741d0000 "MSI972D.tmp" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 769f0000 "MSI972D.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 769f0000 "MSI972D.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 769f0000 "MSI972D.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 769f0000 "MSI972D.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74450000 "MSI972D.tmp" loaded module "RPCRT4.DLL" at base 76930000 "MSI972D.tmp" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 764d0000 "MSI972D.tmp" loaded module "KERNEL32.DLL" at base 76230000 "MSI972D.tmp" loaded module "OLEAUT32" at base 764d0000 "MSI972D.tmp" loaded module "%WINDIR%\SYSWOW64\ONECORECOMMONPROXYSTUB.DLL" at base 740d0000 "MSI972D.tmp" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 73af0000 "msedgewebview2.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe692a0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe90ff0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe90ff0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffe90ff0000 "msedgewebview2.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffe91740000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe90ff0000 "msedgewebview2.exe" loaded module "KERNEL32" at base 7ffe925d0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffe90ff0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffe90ff0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffe90ff0000 "msedgewebview2.exe" loaded module "VERSION.DLL" at base 7ffe873d0000 "msedgewebview2.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 7ffe926a0000 "msedgewebview2.exe" loaded module "KERNEL32.DLL" at base 7ffe925d0000 "msedgewebview2.exe" loaded module "ADVAPI32.DLL" at base 7ffe92220000 "msedgewebview2.exe" loaded module "RPCRT4.DLL" at base 7ffe91fd0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 7ffe90060000 "msedgewebview2.exe" loaded module "NTMARTA.DLL" at base 7ffe90060000 "msedgewebview2.exe" loaded module "USER32.DLL" at base 7ffe93030000 "msedgewebview2.exe" loaded module "NTDLL.DLL" at base 7ffe93bd0000 "msedgewebview2.exe" loaded module "KERNELBASE" at base 7ffe90ff0000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\144.0.3719.115\MSEDGE.DLL" at base 7ffe4a560000 "msedgewebview2.exe" loaded module "KBDUS.DLL" at base 7ffe8e3f0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe8e600000 "msedgewebview2.exe" loaded module "OLE32.DLL" at base 7ffe91e10000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffe936b0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffe936b0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.PROFILE.PLATFORMDIAGNOSTICSANDUSAGEDATASETTINGS.DLL" at base 7ffe790e0000 "msedgewebview2.exe" loaded module "POLICYMANAGER.DLL" at base 7ffe89420000 "msedgewebview2.exe" loaded module "USERENV.DLL" at base 7ffe905b0000 "msedgewebview2.exe" loaded module "SHLWAPI.DLL" at base 7ffe92110000 "msedgewebview2.exe" loaded module "MDMREGISTRATION.DLL" at base 7ffe7bbb0000 "msedgewebview2.exe" loaded module "NETAPI32.DLL" at base 7ffe864a0000 "msedgewebview2.exe" loaded module "OLEAUT32.DLL" at base 7ffe91a30000 "msedgewebview2.exe" loaded module "DWRITE.DLL" at base 7ffe8cf00000 "msedgewebview2.exe" loaded module "WS2_32.DLL" at base 7ffe92fb0000 "msedgewebview2.exe" loaded module "SHELL32.DLL" at base 1b0670e0000 "msedgewebview2.exe" loaded module "COMCTL32.DLL" at base 7ffe7bd30000 "msedgewebview2.exe" loaded module "CRYPT32.DLL" at base 7ffe915d0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\NLANSP_C.DLL" at base 7ffe6f2c0000 "msedgewebview2.exe" loaded module "IPHLPAPI.DLL" at base 7ffe8fb60000 "msedgewebview2.exe" loaded module "GDI32.DLL" at base 7ffe91cd0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffe92350000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffe91e10000 "msedgewebview2.exe" loaded module "DNSAPI.DLL" at base 7ffe8fb90000 "msedgewebview2.exe" loaded module "API-MS-WIN-SHCORE-SCALING-L1-1-1.DLL" at base 7ffe926a0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.DLL" at base 7ffe80e20000 "msedgewebview2.exe" loaded module "WTSAPI32.DLL" at base 7ffe8a970000 "msedgewebview2.exe" loaded module "CFGMGR32.DLL" at base 7ffe90c00000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.APPCORE.DLL" at base 7ffe8a390000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ffe8eeb0000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\144.0.3719.115\TELCLIENT.DLL" at base 7ffe4a230000 "msedgewebview2.exe" loaded module "MSCMS.DLL" at base 7ffe89130000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\144.0.3719.115\ONEDS.DLL" at base 7ffe49ef0000 "msedgewebview2.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffe90040000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.DIAGNOSTICS.TELEMETRY.PLATFORMTELEMETRYCLIENT.DLL" at base 7ffe781f0000 "msedgewebview2.exe" loaded module "WINHTTP.DLL" at base 7ffe8b310000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\144.0.3719.115\ONEAUTH.DLL" at base 7ffe49940000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.IMMERSIVE.DLL" at base 7ffe7f230000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\CAPABILITYACCESSMANAGERCLIENT.DLL" at base 7ffe77bb0000 "msedgewebview2.exe" loaded module "WEBAUTHN.DLL" at base 7ffe67150000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\USERMGRPROXY.DLL" at base 7ffe7e3a0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WLDP.DLL" at base 7ffe907e0000 "msedgewebview2.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 7ffe90ff0000 "msedgewebview2.exe" loaded module "SECUR32.DLL" at base 7ffe85ad0000 "msedgewebview2.exe" loaded module "IMM32.DLL" at base 7ffe931f0000 "msedgewebview2.exe" loaded module "SETUPAPI.DLL" at base 1b068fb0000 "msedgewebview2.exe" loaded module "SSPICLI.DLL" at base 7ffe90290000 "msedgewebview2.exe" loaded module "BCRYPT.DLL" at base 7ffe908d0000 "msedgewebview2.exe" loaded module "BCRYPTPRIMITIVES" at base 7ffe91740000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\SHCORE.DLL" at base 7ffe926a0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffe8ffb0000 "msedgewebview2.exe" loaded module "DEVOBJ.DLL" at base 7ffe90bd0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL" at base 7ffe90ff0000 "msedgewebview2.exe" loaded module "WINTRUST.DLL" at base 7ffe913a0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\INPUTHOST.DLL" at base 7ffe7f020000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ffe76d10000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffe91740000 "msedgewebview2.exe" loaded module "ATLTHUNK.DLL" at base 7ffe75170000 "msedgewebview2.exe" loaded module "OLEACC.DLL" at base 7ffe76df0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\DIRECTMANIPULATION.DLL" at base 7ffe7e2d0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SECURITY.AUTHENTICATION.WEB.CORE.DLL" at base 7ffe79f40000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffe936b0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\IERTUTIL.DLL" at base 7ffe83650000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\ONECORECOMMONPROXYSTUB.DLL" at base 7ffe7d230000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\VAULTCLI.DLL" at base 7ffe77390000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.WEB.DLL" at base 7ffe82c70000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\AADWAMEXTENSION.DLL" at base 7ffe72f10000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\MICROSOFTACCOUNTWAMEXTENSION.DLL" at base 7ffe682e0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffe90ff0000 "msedgewebview2.exe" loaded module "COMBASE.DLL" at base 7ffe936b0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffe8eff0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffe8bd00000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 7ffe8c6e0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 7ffe88840000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\144.0.3719.115\FFMPEG.DLL" at base 7ffe494d0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\TENANTRESTRICTIONSPLUGIN.DLL" at base 7ffe89a50000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.LAUNCHER.DLL" at base 7ffe83fc0000 "msedgewebview2.exe" loaded module "EXT-MS-WIN-SESSION-USERMGR-L1-1-0.DLL" at base 7ffe88120000 "msedgewebview2.exe" loaded module "NCRYPT.DLL" at base 7ffe908a0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\PCPKSP.DLL" at base 7ffe82720000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTPROV.DLL" at base 7ffe82850000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.USERPROFILE.DIAGNOSTICSSETTINGS.DLL" at base 7ffe7f490000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\144.0.3719.115\MICROSOFT_SHELL_INTEGRATION.DLL" at base 7ffe86ee0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\FLIGHTSETTINGS.DLL" at base 7ffe84100000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\FCON.DLL" at base 7ffe83f40000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SECURITY.AUTHENTICATION.ONLINEID.DLL" at base 7ffe828c0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffe89b90000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffe73910000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffe904b0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffe88150000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffe89270000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffe8feb0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffe7f460000 "msedgewebview2.exe" loaded module "DBGHELP.DLL" at base 7ffe87030000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-WOW64-L1-1-2.DLL" at base 7ffe90ff0000 "msedgewebview2.exe" loaded module "PSAPI.DLL" at base 7ffe931e0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-VERSION-L1-1-0.DLL" at base 7ffe90ff0000 "msedgewebview2.exe" loaded module "VERIFIER.DLL" at base 7ffe68260000 "msedgewebview2.exe" loaded module "DHCPCSVC.DLL" at base 7ffe8a990000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 7ffe90ff000062:T462,"2FA_Code_Engine.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 74030000 "2FA_Code_Engine.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75330000 "msiexec.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 91740000 "msiexec.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 908D0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75330000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 74030000 "msiexec.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 74030000 "msiexec.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75330000 "MSI972D.tmp" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 74030000 "MSI972D.tmp" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75330000 "2FA Code Engine.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 91740000 "2FA Code Engine.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 908D0000 "msedgewebview2.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 91740000 "msedgewebview2.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 908D000063:T886,"2FA_Code_Engine.exe" touched "Msi install server" (Path: "HKCU\WOW6432NODE\CLSID\{000C101C-0000-0000-C000-000000000046}") "2FA_Code_Engine.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{000C103E-0000-0000-C000-000000000046}\TREATAS") "2FA_Code_Engine.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS") "MSI972D.tmp" touched "ShellWindows" (Path: "HKCU\WOW6432NODE\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}") "MSI972D.tmp" touched "PSOAInterface" (Path: "HKCU\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") "MSI972D.tmp" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "2FA Code Engine.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "msedgewebview2.exe" touched "Ptype_PSFactory" (Path: "HKCU\CLSID\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}\TREATAS") "msedgewebview2.exe" touched "TF_InputProcessorProfiles" (Path: "HKCU\CLSID\{33C53A50-F456-4884-B049-85FD643ECFED}\TREATAS") "msedgewebview2.exe" touched "TF_ThreadMgr" (Path: "HKCU\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\TREATAS") "msedgewebview2.exe" touched "TF_CategoryMgr" (Path: "HKCU\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\TREATAS") "msedgewebview2.exe" touched "TF_DisplayAttributeMgr" (Path: "HKCU\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\TREATAS") "msedgewebview2.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "msedgewebview2.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS") "msedgewebview2.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "msedgewebview2.exe" touched "@%SystemRoot%\system32\shell32.dll,-22067" (Path: "HKCU\CLSID\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}\SHELLFOLDER") "msedgewebview2.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "msedgewebview2.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER")64:T4ec,"2FA_Code_Engine.exe" file has an entrypoint instructions - "call 0x649ede,jmp 0x649542,push ebp,mov ebp, esp,or dword ptr [0x79a0a0], 1,sub esp, 0x28,mov dword ptr [0x79ded0], 0,push 0xa,call dword ptr [0x6dd2a0],test eax, eax,je 0x6499f0,push ebx,push esi,push edi,xor eax, eax,lea edi, [ebp - 0x28],xor ecx, ecx,push ebx,cpuid ,mov esi, ebx,pop ebx,nop ,mov dword ptr [edi], eax,mov dword ptr [edi + 4], esi,mov dword ptr [edi + 8], ecx,mov dword ptr [edi + 0xc], edx,mov eax, dword ptr [ebp - 0x28],mov ecx, dword ptr [ebp - 0x1c],mov dword ptr [ebp - 4], eax,xor ecx, 0x49656e69,mov eax, dword ptr [ebp - 0x20],xor eax, 0x6c65746e," "MSI7AC5.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100aa27e,call 0x100aa992,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100aa134,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,or dword ptr [0x1013e020], 1,sub esp, 0x28,mov dword ptr [0x1013faa4], 0,push 0xa,call dword ptr [0x100e5188],test eax, eax,je 0x100aa5a9,push ebx,push esi,push edi,xor eax, eax,lea edi, [ebp - 0x28],xor ecx, ecx,push ebx,cpuid ,mov esi, ebx,pop ebx,nop ,mov dword ptr [edi], eax,mov dword ptr [edi + 4], esi,mov dword ptr [edi + 8], ecx,"65:T1396,Process "msiexec.exe" (UID: 00000000-00006032) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "msiexec.exe" (UID: 00000000-00006032) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, HOMEPATH, HOMEDRIVE" Process "MsiExec.exe" (UID: 00000000-00002664) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", LOGONSERVER="\\DESKTOP-8LD9T6N", OneDrive="%USERPROFILE%\OneDrive", USERDNSDOMAIN="DESKTOP-8LD9T6N", PROCESSOR_ARCHITEW6432="AMD64", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:"" Process "MsiExec.exe" (UID: 00000000-00002664) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, USERNAME, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles, NUMBER_OF_PROCESSORS" Process "MsiExec.exe" (UID: 00000000-00002108) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles, NUMBER_OF_PROCESSORS" Process "MsiExec.exe" (UID: 00000000-00002108) was launched with missing environment variables: "USERDNSDOMAIN, PROCESSOR_ARCHITEW6432" Process "2FA Code Engine.exe" (UID: 00000000-00005740) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-8LD9T6N", EFC_5244="1"" Process "2FA Code Engine.exe" (UID: 00000000-00005740) was launched with modified environment variables: "PSModulePath, Path" Process "msedgewebview2.exe" (UID: 00000000-00005224) was launched with new environment variables: "WEBVIEW2_RELEASE_CHANNEL_PREFERENCE="0"" Process "msedgewebview2.exe" (UID: 00000000-00004400) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_5224_XAFNIEVZNFZVXIRL", IS_EDGE_WEBVIEW="1", EDGE_WEBVIEW_PREFETCH_HOSTED_APP="/pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4", EDGE_BROWSER_PID="5224"" Process "msedgewebview2.exe" (UID: 00000000-00004400) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "msedgewebview2.exe" (UID: 00000000-00002584) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="0", COMPONENT_INSTALLER_DIR="%APPDATA%\2FA Code Engine.exe\EBWebView", EDGE_USER_DATA_DIR="%APPDATA%\2FA Code Engine.exe\EBWebView", EDGE_METRICS_CLIENT_ID_HASH="7837653605702566598"" Process "msedgewebview2.exe" (UID: 00000000-00007300) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CURL_CA_BUNDLE, PATHEXT, DriverData, IS_EDGE_WEBVIEW, ProgramData, ProgramW6432, HOMEPATH, WEBVIEW2_RELEASE_CHANNEL_PREFERENCE, PROCESSOR_IDENTIFIER, EDGE_WEBVIEW_PREFETCH_HOSTED_APP, ProgramFiles, PUBLIC, windir, USERDOMAIN, LOGONSERVER, OneDrive, APPDATA, CommonProgramFiles, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, HOMEDRIVE, USERPROFILE, EFC_5244, CommonProgramFiles(x86), NUMBER_OF_PROCESSORS, EDGE_METRICS_CLIENT_ID_HASH" Process "msedgewebview2.exe" (UID: 00000000-00006356) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%PROGRAMFILES%\(x86)\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="0", EDGE_USER_DATA_DIR="%APPDATA%\2FA Code Engine.exe\EBWebView", USERNAME="%OSUSER%", USERDNSDOMAIN="DESKTOP-8LD9T6N", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", IS_EDGE_WEBVIEW="1", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", WEBVIEW2_RELEASE_CHANNEL_PREFERENCE="0", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", EDGE_WEBVIEW_PREFETCH_HOSTED_APP="/pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", windir="C:\WINDOWS", USERDOMAIN="DESKTOP-8LD9T6N", LOGONSERVER="\\DESKTOP-8LD9T6N", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", CommonProgramFiles="%PROGRAMFILES%\Common Files", OS="Windows_NT", COMPUTERNAME="DESKTOP-8LD9T6N", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", HOMEDRIVE="C:", USERPROFILE="C:\Users\%OSUSER%", EFC_5244="1", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", NUMBER_OF_PROCESSORS="8", EDGE_METRICS_CLIENT_ID_HASH="7837653605702566598""66:T9da,"2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ".") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "..") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "0409") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ADVANCEDINSTALLERS") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "APPLOCKER") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BESTPRACTICES") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BTHPROPS") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CATROOT") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "COM") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CONFIG") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CONFIGURATION") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DIAGSVCS") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DISM") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DOWNLEVEL") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DRIVERS") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DRIVERSTORE") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "F12") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FXSTMP") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "GROUPPOLICY") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "GROUPPOLICYUSERS") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ICSXML") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "IME") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "INETSRV") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "INPUTMETHOD") "2FA_Code_Engine.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "INSTALLSHIELD")67:Tb2f,Observed system executable string:"%WINDIR%\system32\psapi.dll" [Source: 00000000-00007864-00000C2B-2818200826] Observed system executable string:"%WINDIR%\system32\WindowsCodecs.dll" [Source: 00000000-00007864-00000C2B-2818267624] Observed system executable string:"%WINDIR%\system32\bcrypt.dll" [Source: 00000000-00007864-00000C2B-2818311164] Observed system executable string:"%WINDIR%\system32\msi.dll" [Source: 00000000-00007864-00000C2B-2818585269] Observed system executable string:"%WINDIR%\system32\USP10.dll" [Source: 00000000-00007864-00000C2B-2818779050] Observed system executable string:"%WINDIR%\system32\msls31.dll" [Source: 00000000-00007864-00000C2B-2818821736] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007864-00000C2B-2818878786] Observed system executable string:"%WINDIR%\system32\mpr.dll" [Source: 00000000-00007864-00000C2B-2818919399] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00007864-00000C2B-2819111149] Observed system executable string:"%WINDIR%\system32\profapi.dll" [Source: 00000000-00007864-00000C2B-2819149909] Observed system executable string:"%WINDIR%\system32\gdiplus.dll" [Source: 00000000-00007864-00000C2B-2819213675] Observed system executable string:"%WINDIR%\system32\userenv.dll" [Source: 00000000-00007864-00000C2B-2819250131] Observed system executable string:"%WINDIR%\system32\dwmapi.dll" [Source: 00000000-00007864-00000C2B-2819299020] Observed system executable string:"%WINDIR%\system32\davhlpr.dll" [Source: 00000000-00007864-00000C2B-2819407181] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00007864-00000C2B-2819463833] Observed system executable string:"%WINDIR%\system32\oleaut32.dll" [Source: 00000000-00007864-00000C2B-2819517009] Observed system executable string:"%WINDIR%\system32\comctl32.dll" [Source: 00000000-00007864-00000C2B-2819624611] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00007864-00000C2B-2819711234] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00007864-00000C2B-2819779845] Observed system executable string:"%WINDIR%\system32\gdi32.dll" [Source: 00000000-00007864-00000C2B-2819812614] Observed system executable string:"%WINDIR%\system32\user32.dll" [Source: 00000000-00007864-00000C2B-2819853000] Observed system executable string:"%WINDIR%\system32\comdlg32.dll" [Source: 00000000-00007864-00000C2B-2819910082] Observed system executable string:"%WINDIR%\system32\msimg32.dll" [Source: 00000000-00007864-00000C2B-2819960579] Observed system executable string:"%WINDIR%\system32\dbghelp.dll" [Source: 00000000-00007864-00000C2B-2820021283] Observed system executable string:"%WINDIR%\system32\wininet.dll" [Source: 00000000-00007864-00000C2B-2820150653]68:Tc0c,Spawned process "msiexec.exe" with commandline "/V" (UID: 00000000-00006032) Spawned process "MsiExec.exe" with commandline "-Embedding FA337FD2F14F7C0D5075CEFB69B2C322 C" (UID: 00000000-00002664) Spawned process "msiexec.exe" with commandline "/i "%APPDATA%\\Notonlycode\\2FA Code Engine 93.11.1\\install\\2F ..." (UID: 00000000-00005964), Spawned process "MsiExec.exe" with commandline "-Embedding 32887C1A40FCFBA6EAB85C83ABB00F1B" (UID: 00000000-00002108), Spawned process "MSI972D.tmp" with commandline "/DontWait /dir "%LOCALAPPDATA%\\Notonlycode\\2FA Code Engine\\" ..." (UID: 00000000-00007612), Spawned process "2FA Code Engine.exe" (UID: 00000000-00005740), Spawned process "msedgewebview2.exe" with commandline "--embedded-browser-webview=1 --webview-exe-name="2FA Code Engine ..." (UID: 00000000-00005224) Spawned process "msedgewebview2.exe" with commandline "--type=crashpad-handler "--user-data-dir=%APPDATA%\\2FA Code Eng ..." (UID: 00000000-00004400), Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\2F ..." (UID: 00000000-00002584) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00006628) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007300) Spawned process "msedgewebview2.exe" with commandline "--type=renderer --noerrdialogs --user-data-dir="%APPDATA%\\2FA C ..." (UID: 00000000-00006072), Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\2F ..." (UID: 00000000-00006356) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00002196) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\2F ..." (UID: 00000000-00003476), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00005412), Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\2F ..." (UID: 00000000-00007204) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00002132) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\2F ..." (UID: 00000000-00002220), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00001904), Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\2F ..." (UID: 00000000-00005752) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003932)69:Tc0c,Spawned process "msiexec.exe" with commandline "/V" (UID: 00000000-00006032) Spawned process "MsiExec.exe" with commandline "-Embedding FA337FD2F14F7C0D5075CEFB69B2C322 C" (UID: 00000000-00002664) Spawned process "msiexec.exe" with commandline "/i "%APPDATA%\\Notonlycode\\2FA Code Engine 93.11.1\\install\\2F ..." (UID: 00000000-00005964), Spawned process "MsiExec.exe" with commandline "-Embedding 32887C1A40FCFBA6EAB85C83ABB00F1B" (UID: 00000000-00002108), Spawned process "MSI972D.tmp" with commandline "/DontWait /dir "%LOCALAPPDATA%\\Notonlycode\\2FA Code Engine\\" ..." (UID: 00000000-00007612), Spawned process "2FA Code Engine.exe" (UID: 00000000-00005740), Spawned process "msedgewebview2.exe" with commandline "--embedded-browser-webview=1 --webview-exe-name="2FA Code Engine ..." (UID: 00000000-00005224) Spawned process "msedgewebview2.exe" with commandline "--type=crashpad-handler "--user-data-dir=%APPDATA%\\2FA Code Eng ..." (UID: 00000000-00004400), Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\2F ..." (UID: 00000000-00002584) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00006628) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007300) Spawned process "msedgewebview2.exe" with commandline "--type=renderer --noerrdialogs --user-data-dir="%APPDATA%\\2FA C ..." (UID: 00000000-00006072), Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\2F ..." (UID: 00000000-00006356) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00002196) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\2F ..." (UID: 00000000-00003476), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00005412), Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\2F ..." (UID: 00000000-00007204) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00002132) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\2F ..." (UID: 00000000-00002220), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00001904), Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\2F ..." (UID: 00000000-00005752) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003932)6a:T947,The input sample is signed with a certificate issued by "CN=YE2, O=Let's Encrypt, C=US" (SHA1: FC:C1:F3:FA:E5:5E:2A:25:B3:FC:7B:1E:46:DE:44:29:D5:A4:2D:CF; see report for more information) The input sample is signed with a certificate issued by "CN=Root YE, O=ISRG, C=US" (SHA1: F8:15:8C:A8:A3:A7:C5:DB:D7:84:22:18:F5:D9:49:CE:C8:3A:CD:BA; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X2, O=Internet Security Research Group, C=US" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: C2:28:12:7F:8C:B2:D6:C7:3A:96:F0:44:37:DF:F9:9A:E8:C6:84:BC; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 47:BE:AB:C9:22:EA:E8:0E:78:78:34:62:A7:9F:45:C2:54:FD:E6:8B; see report for more information) The input sample is signed with a certificate issued by "CN=SSL.com Root Certification Authority RSA, O=SSL Corporation, L=Houston, ST=Texas, C=US" (SHA1: B7:AB:33:08:D1:EA:44:77:BA:14:80:12:5A:6F:BD:A9:36:49:0C:BB; see report for more information) The input sample is signed with a certificate issued by "CN=SSL.com Root Certification Authority RSA, O=SSL Corporation, L=Houston, ST=Texas, C=US" (SHA1: BC:1E:0F:F3:66:EE:AD:57:F8:72:62:2A:0A:59:03:70:6B:74:20:F4; see report for more information) The input sample is signed with a certificate issued by "CN=SSL.com Code Signing Intermediate CA RSA R1, O=SSL Corp, L=Houston, ST=Texas, C=US" (SHA1: 21:3E:66:98:E8:B0:96:49:34:90:8D:DA:36:1E:08:5C:E4:D0:E1:02; see report for more information)6b:Te1a,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "2FA_Code_Engine.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "2FA_Code_Engine.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "2FA_Code_Engine.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "2FA_Code_Engine.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002220.00000000.302577.7CF85000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000002.304750.79614000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004400.00000002.304750.79614000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp")6c:T577e,"2FA Code Engine.msi" has type "Composite Document File V2 Document Little Endian Os: Windows Version 10.0 MSI Installer Security: 0 Code page: 1252 Revision Number: {D6205F73-666A-405E-8302-A64F26CDADC7} Number of Words: 10 Subject: 2FA Code Engine Author: Notonlycode Name of Creating Application: 2FA Code Engine (Evaluation Installer) Template: x64;1033 Comments: 2FA Code Engine (Evaluation Installer) Title: Installation Database Keywords: Installer MSI Database Create Time/Date: Fri Sep 18 02:48:01 2026 Last Saved Time/Date: Fri Sep 18 02:48:01 2026 Last Printed: Fri Sep 18 02:48:01 2026 Number of Pages: 450"- Location: [%APPDATA%\Notonlycode\2FA Code Engine 93.11.1\install\2FA Code Engine.msi]- [targetUID: 00000000-00007864] "e2ab07a9-6db2-4b59-beae-075096067543.dmp" has type "Mini DuMP crash report 16 streams Thu Oct 15 21:50:14 2026 0x61965 type"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Crashpad\reports\e2ab07a9-6db2-4b59-beae-075096067543.dmp]- [targetUID: 00000000-00004400] "2FA Code Engine1.cab" has type "Unknown"- Location: [%APPDATA%\Notonlycode\2FA Code Engine 93.11.1\install\2FA Code Engine1.cab]- [targetUID: 00000000-00007864] "MSI7AC5.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\MSI7AC5.tmp]- [targetUID: 00000000-00007864] "data_1" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\DawnWebGPUCache\data_1]- [targetUID: 00000000-00005224] "index" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\DawnGraphiteCache\index]- [targetUID: 00000000-00006628] "index" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\GPUCache\index]- [targetUID: 00000000-00006628] "index" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\DawnWebGPUCache\index]- [targetUID: 00000000-00006628] "index" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\ShaderCache\index]- [targetUID: 00000000-00006628] "Web Data" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 3 database pages 108 cookie 0x42 schema 4 UTF-8 version-valid-for 3"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Web Data]- [targetUID: 00000000-00005224] "History" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 2 database pages 50 cookie 0x2a schema 4 UTF-8 version-valid-for 2"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\History]- [targetUID: 00000000-00005224] "EdgeJourneys.db-wal" has type "SQLite Write-Ahead Log version 3007000"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\EdgeJourneys\EdgeJourneys.db-wal]- [targetUID: 00000000-00005224] "DIPS-wal" has type "SQLite Write-Ahead Log version 3007000"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\DIPS-wal]- [targetUID: 00000000-00005224] "Network Action Predictor" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 2 database pages 13 cookie 0x6 schema 4 UTF-8 version-valid-for 2"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network Action Predictor]- [targetUID: 00000000-00005224] "db" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 2 database pages 11 cookie 0x8 schema 4 UTF-8 version-valid-for 2"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Shared Dictionary\db]- [targetUID: 00000000-00006628] "Login Data For Account" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 21 cookie 0xc schema 4 UTF-8 version-valid-for 1"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Login Data For Account]- [targetUID: 00000000-00005224] "Reporting and NEL" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 4 database pages 9 cookie 0x4 schema 4 UTF-8 version-valid-for 4"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\Reporting and NEL]- [targetUID: 00000000-00006628] "Trust Tokens" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 2 database pages 9 cookie 0x5 schema 4 UTF-8 version-valid-for 2"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\Trust Tokens]- [targetUID: 00000000-00006628] "ExtensionActivityEdge" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 1 database pages 8 cookie 0x7 schema 4 UTF-8 version-valid-for 1"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\ExtensionActivityEdge]- [targetUID: 00000000-00005224] "Vpn Tokens" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 2 database pages 7 cookie 0x4 schema 4 UTF-8 version-valid-for 2"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Vpn Tokens]- [targetUID: 00000000-00005224] "BrowsingTopicsSiteData" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 1 database pages 7 cookie 0x4 schema 4 UTF-8 version-valid-for 1"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\BrowsingTopicsSiteData]- [targetUID: 00000000-00005224] "Safe Browsing Cookies" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 7 database pages 5 cookie 0x5 schema 4 UTF-8 version-valid-for 7"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies]- [targetUID: 00000000-00006628] "Top Sites" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 1 database pages 5 cookie 0x2 schema 4 UTF-8 version-valid-for 1"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Top Sites]- [targetUID: 00000000-00005224] "ServerCertificate" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 1 database pages 5 cookie 0x2 schema 4 UTF-8 version-valid-for 1"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\ServerCertificate]- [targetUID: 00000000-00005224] "Favicons" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 10 cookie 0x8 schema 4 UTF-8 version-valid-for 1"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Favicons]- [targetUID: 00000000-00005224] "EdgeJourneys.db" has type "SQLite 3.x database last written using SQLite version 3050004 page size 16384 writer version 2 read version 2 file counter 1 database pages 1 cookie 0 schema 0 unknown 0 encoding version-valid-for 1"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\EdgeJourneys\EdgeJourneys.db]- [targetUID: 00000000-00005224] "heavy_ad_intervention_opt_out.db" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 2 database pages 4 cookie 0x2 schema 4 UTF-8 version-valid-for 2"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\heavy_ad_intervention_opt_out.db]- [targetUID: 00000000-00005224] "sslkey.txt" has type "Unknown"- Location: [%TEMP%\sslkey.txt]- [targetUID: 00000000-00006628] "Edge-Local-State-Tmp-ada0f613-b9ed-486d-904a-8ffb36f2a88b.tmp" has type "JSON text data"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Edge-Local-State-Tmp-ada0f613-b9ed-486d-904a-8ffb36f2a88b.tmp]- [targetUID: 00000000-00005224] "91344438-3207-4d8a-9d5d-a2e977597f0b.tmp" has type "JSON text data"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\91344438-3207-4d8a-9d5d-a2e977597f0b.tmp]- [targetUID: 00000000-00005224] "data_2" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\GPUCache\data_2]- [targetUID: 00000000-00005224] "data_3" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\ShaderCache\data_3]- [targetUID: 00000000-00005224] "data_0" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\GPUCache\data_0]- [targetUID: 00000000-00005224] "590acc37-4811-4445-aa4b-eeab148b9016.tmp" has type "JSON text data"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\590acc37-4811-4445-aa4b-eeab148b9016.tmp]- [targetUID: 00000000-00005224] "877c0fad-fc65-4ffc-8304-6d23f9faa8cd.tmp" has type "JSON text data"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\877c0fad-fc65-4ffc-8304-6d23f9faa8cd.tmp]- [targetUID: 00000000-00005224] "Edge-Local-State-Tmp-aaaba18f-ad04-4a7a-a667-4952a8367dfc.tmp" has type "JSON text data"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Edge-Local-State-Tmp-aaaba18f-ad04-4a7a-a667-4952a8367dfc.tmp]- [targetUID: 00000000-00005224] "DIPS" has type "SQLite 3.x database last written using SQLite version 3050004 writer version 2 read version 2 file counter 1 database pages 1 cookie 0 schema 0 unknown 0 encoding version-valid-for 1"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\DIPS]- [targetUID: 00000000-00005224] "000003.log" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\shared_proto_db\000003.log]- [targetUID: 00000000-00005224] "Edge-Local-State-Tmp-5fa6f309-a801-4465-abed-e15d4d7cca78.tmp" has type "JSON text data"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Edge-Local-State-Tmp-5fa6f309-a801-4465-abed-e15d4d7cca78.tmp]- [targetUID: 00000000-00005224] "Edge-Local-State-Tmp-f49aaa2a-3679-494c-9d31-566a7614d0df.tmp" has type "JSON text data"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Edge-Local-State-Tmp-f49aaa2a-3679-494c-9d31-566a7614d0df.tmp]- [targetUID: 00000000-00005224] "Edge-Local-State-Tmp-c7700705-7278-4621-8d98-0101023c7ffc.tmp" has type "JSON text data"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Edge-Local-State-Tmp-c7700705-7278-4621-8d98-0101023c7ffc.tmp]- [targetUID: 00000000-00005224] "5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres" has type "Unknown"- Location: [%LOCALAPPDATA%\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres]- [targetUID: 00000000-00005224] "8ae9f0c30ea1668425d0f7d6255d597ead710776.tbres" has type "Unknown"- Location: [%LOCALAPPDATA%\Microsoft\TokenBroker\Cache\8ae9f0c30ea1668425d0f7d6255d597ead710776.tbres]- [targetUID: 00000000-00005224] "Edge-Local-State-Tmp-70350048-5b2d-4143-85a5-ab9d674c9d92.tmp" has type "JSON text data"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Edge-Local-State-Tmp-70350048-5b2d-4143-85a5-ab9d674c9d92.tmp]- [targetUID: 00000000-00005224] "watson_metadata" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Crashpad\watson_metadata]- [targetUID: 00000000-00004400] "000003.log" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\shared_proto_db\metadata\000003.log]- [targetUID: 00000000-00005224] "SharedStorage-journal" has type "SQLite Rollback Journal"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\SharedStorage-journal]- [targetUID: 00000000-00005224] "DIPS-journal" has type "SQLite Rollback Journal"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\DIPS-journal]- [targetUID: 00000000-00005224] "EdgeJourneys.db-journal" has type "SQLite Rollback Journal"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\EdgeJourneys\EdgeJourneys.db-journal]- [targetUID: 00000000-00005224] "26c92cf6-3300-41ab-a984-7e34c75c4207.tmp" has type "JSON text data"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\26c92cf6-3300-41ab-a984-7e34c75c4207.tmp]- [targetUID: 00000000-00005224] "LOG" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Site Characteristics Database\LOG]- [targetUID: 00000000-00005224] "LOG" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\shared_proto_db\metadata\LOG]- [targetUID: 00000000-00005224] "LOG" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Sync Data\LevelDB\LOG]- [targetUID: 00000000-00005224] "LOG" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension Scripts\LOG]- [targetUID: 00000000-00005224] "LOG" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\shared_proto_db\LOG]- [targetUID: 00000000-00005224] "LOG" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension Rules\LOG]- [targetUID: 00000000-00005224] "LOG" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension State\LOG]- [targetUID: 00000000-00005224] "settings.dat" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Crashpad\settings.dat]- [targetUID: 00000000-00005224] "16c6c9790eb4e7c1_0" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Code Cache\js\16c6c9790eb4e7c1_0]- [targetUID: 00000000-00005224] "1afe9cacc9803fd2_0" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Code Cache\js\1afe9cacc9803fd2_0]- [targetUID: 00000000-00005224] "README" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\README]- [targetUID: 00000000-00005224] "000003.log" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension State\000003.log]- [targetUID: 00000000-00005224] "metadata" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Crashpad\metadata]- [targetUID: 00000000-00004400] "b68ab906-43c1-48a9-8199-3e2b27e338e6.tmp" has type "JSON text data"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\b68ab906-43c1-48a9-8199-3e2b27e338e6.tmp]- [targetUID: 00000000-00006628] "Variations" has type "JSON text data"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Variations]- [targetUID: 00000000-00005224] "000003.log" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Sync Data\LevelDB\000003.log]- [targetUID: 00000000-00005224] "favorites_diagnostic.log" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\favorites_diagnostic.log]- [targetUID: 00000000-00005224] "2c6793b3-1e32-4919-946b-e65c657c0c19.tmp" has type "JSON text data"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\2c6793b3-1e32-4919-946b-e65c657c0c19.tmp]- [targetUID: 00000000-00006628] "temp-index" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index]- [targetUID: 00000000-00006628] "temp-index" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Code Cache\wasm\index-dir\temp-index]- [targetUID: 00000000-00006628] "temp-index" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Shared Dictionary\cache\index-dir\temp-index]- [targetUID: 00000000-00006628] "MANIFEST-000001" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Site Characteristics Database\MANIFEST-000001]- [targetUID: 00000000-00005224] "000003.log" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Site Characteristics Database\000003.log]- [targetUID: 00000000-00005224] "4da9de47-855f-4c03-bc4f-003f15510514.tmp" has type "JSON text data"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\4da9de47-855f-4c03-bc4f-003f15510514.tmp]- [targetUID: 00000000-00006628] "000003.log" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension Rules\000003.log]- [targetUID: 00000000-00005224] "index" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Code Cache\js\index]- [targetUID: 00000000-00006628] "throttle_store.dat" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Crashpad\throttle_store.dat]- [targetUID: 00000000-00005224] "000001.dbtmp" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\shared_proto_db\000001.dbtmp]- [targetUID: 00000000-00005224] "Last Version" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Last Version]- [targetUID: 00000000-00005224] "96a9b59d-f7ca-4b07-a825-1ac09477c17d.tmp" has type "JSON text data"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\component_crx_cache\96a9b59d-f7ca-4b07-a825-1ac09477c17d.tmp]- [targetUID: 00000000-00005224] "c3d37513-63cb-4a63-97ae-9fc059fb37d9.tmp" has type "JSON text data"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\c3d37513-63cb-4a63-97ae-9fc059fb37d9.tmp]- [targetUID: 00000000-00005224] "a19009cc-e1e8-48a2-a0b5-0bca836f6aed.tmp" has type "JSON text data"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\a19009cc-e1e8-48a2-a0b5-0bca836f6aed.tmp]- [targetUID: 00000000-00006628] "MSI7F6A.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\MSI7F6A.tmp]- [targetUID: 00000000-00007864] "MSI7E60.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\MSI7E60.tmp]- [targetUID: 00000000-00007864] "data_1" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\GPUCache\data_1]- [targetUID: 00000000-00005224] "data_1" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\DawnGraphiteCache\data_1]- [targetUID: 00000000-00005224] "data_1" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\ShaderCache\data_1]- [targetUID: 00000000-00005224] "Login Data" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 21 cookie 0xc schema 4 UTF-8 version-valid-for 1"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Login Data]- [targetUID: 00000000-00005224] "Cookies" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 7 database pages 5 cookie 0x5 schema 4 UTF-8 version-valid-for 7"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\Cookies]- [targetUID: 00000000-00006628] "data_2" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\ShaderCache\data_2]- [targetUID: 00000000-00005224] "data_2" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\DawnGraphiteCache\data_2]- [targetUID: 00000000-00005224] "data_0" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\DawnWebGPUCache\data_0]- [targetUID: 00000000-00005224] "data_0" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\DawnGraphiteCache\data_0]- [targetUID: 00000000-00005224] "data_3" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\GPUCache\data_3]- [targetUID: 00000000-00005224] "data_3" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\DawnGraphiteCache\data_3]- [targetUID: 00000000-00005224] "data_3" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\DawnWebGPUCache\data_3]- [targetUID: 00000000-00005224] "data_2" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\DawnWebGPUCache\data_2]- [targetUID: 00000000-00005224] "data_0" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\ShaderCache\data_0]- [targetUID: 00000000-00005224] "SharedStorage" has type "SQLite 3.x database last written using SQLite version 3050004 writer version 2 read version 2 file counter 1 database pages 1 cookie 0 schema 0 unknown 0 encoding version-valid-for 1"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\SharedStorage]- [targetUID: 00000000-00005224] "MANIFEST-000001" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001]- [targetUID: 00000000-00005224] "MANIFEST-000001" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension State\MANIFEST-000001]- [targetUID: 00000000-00005224] "MANIFEST-000001" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension Scripts\MANIFEST-000001]- [targetUID: 00000000-00005224] "MANIFEST-000001" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension Rules\MANIFEST-000001]- [targetUID: 00000000-00005224] "MANIFEST-000001" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\shared_proto_db\MANIFEST-000001]- [targetUID: 00000000-00005224] "MANIFEST-000001" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001]- [targetUID: 00000000-00005224] "000003.log" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension Scripts\000003.log]- [targetUID: 00000000-00005224] "index" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Code Cache\wasm\index]- [targetUID: 00000000-00006628] "index" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Shared Dictionary\cache\index]- [targetUID: 00000000-00006628] "000001.dbtmp" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp]- [targetUID: 00000000-00005224] "000001.dbtmp" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension Scripts\000001.dbtmp]- [targetUID: 00000000-00005224] "000001.dbtmp" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension Rules\000001.dbtmp]- [targetUID: 00000000-00005224] "000001.dbtmp" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Site Characteristics Database\000001.dbtmp]- [targetUID: 00000000-00005224] "000001.dbtmp" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Extension State\000001.dbtmp]- [targetUID: 00000000-00005224] "000001.dbtmp" has type "Unknown"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp]- [targetUID: 00000000-00005224] "773c2107-5329-4a59-9962-2b83031bea9b.tmp" has type "JSON text data"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\773c2107-5329-4a59-9962-2b83031bea9b.tmp]- [targetUID: 00000000-00006628] "74fca1bf-042f-45d9-b80a-6a884bfa483b.tmp" has type "JSON text data"- Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\74fca1bf-042f-45d9-b80a-6a884bfa483b.tmp]- [targetUID: 00000000-00006628]6d:Tea1,"MSI7AC5.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections" - Location: [%TEMP%\MSI7AC5.tmp] "Edge-Local-State-Tmp-ada0f613-b9ed-486d-904a-8ffb36f2a88b.tmp" has type "JSON text data" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Edge-Local-State-Tmp-ada0f613-b9ed-486d-904a-8ffb36f2a88b.tmp] "91344438-3207-4d8a-9d5d-a2e977597f0b.tmp" has type "JSON text data" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\91344438-3207-4d8a-9d5d-a2e977597f0b.tmp] "590acc37-4811-4445-aa4b-eeab148b9016.tmp" has type "JSON text data" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\590acc37-4811-4445-aa4b-eeab148b9016.tmp] "877c0fad-fc65-4ffc-8304-6d23f9faa8cd.tmp" has type "JSON text data" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\877c0fad-fc65-4ffc-8304-6d23f9faa8cd.tmp] "Edge-Local-State-Tmp-aaaba18f-ad04-4a7a-a667-4952a8367dfc.tmp" has type "JSON text data" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Edge-Local-State-Tmp-aaaba18f-ad04-4a7a-a667-4952a8367dfc.tmp] "Edge-Local-State-Tmp-5fa6f309-a801-4465-abed-e15d4d7cca78.tmp" has type "JSON text data" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Edge-Local-State-Tmp-5fa6f309-a801-4465-abed-e15d4d7cca78.tmp] "Edge-Local-State-Tmp-f49aaa2a-3679-494c-9d31-566a7614d0df.tmp" has type "JSON text data" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Edge-Local-State-Tmp-f49aaa2a-3679-494c-9d31-566a7614d0df.tmp] "Edge-Local-State-Tmp-c7700705-7278-4621-8d98-0101023c7ffc.tmp" has type "JSON text data" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Edge-Local-State-Tmp-c7700705-7278-4621-8d98-0101023c7ffc.tmp] "Edge-Local-State-Tmp-70350048-5b2d-4143-85a5-ab9d674c9d92.tmp" has type "JSON text data" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Edge-Local-State-Tmp-70350048-5b2d-4143-85a5-ab9d674c9d92.tmp] "26c92cf6-3300-41ab-a984-7e34c75c4207.tmp" has type "JSON text data" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\26c92cf6-3300-41ab-a984-7e34c75c4207.tmp] "b68ab906-43c1-48a9-8199-3e2b27e338e6.tmp" has type "JSON text data" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\b68ab906-43c1-48a9-8199-3e2b27e338e6.tmp] "2c6793b3-1e32-4919-946b-e65c657c0c19.tmp" has type "JSON text data" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\2c6793b3-1e32-4919-946b-e65c657c0c19.tmp] "4da9de47-855f-4c03-bc4f-003f15510514.tmp" has type "JSON text data" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\4da9de47-855f-4c03-bc4f-003f15510514.tmp] "96a9b59d-f7ca-4b07-a825-1ac09477c17d.tmp" has type "JSON text data" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\component_crx_cache\96a9b59d-f7ca-4b07-a825-1ac09477c17d.tmp] "c3d37513-63cb-4a63-97ae-9fc059fb37d9.tmp" has type "JSON text data" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\c3d37513-63cb-4a63-97ae-9fc059fb37d9.tmp] "a19009cc-e1e8-48a2-a0b5-0bca836f6aed.tmp" has type "JSON text data" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\a19009cc-e1e8-48a2-a0b5-0bca836f6aed.tmp] "MSI7F6A.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections" - Location: [%TEMP%\MSI7F6A.tmp] "MSI7E60.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections" - Location: [%TEMP%\MSI7E60.tmp] "773c2107-5329-4a59-9962-2b83031bea9b.tmp" has type "JSON text data" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\773c2107-5329-4a59-9962-2b83031bea9b.tmp] "74fca1bf-042f-45d9-b80a-6a884bfa483b.tmp" has type "JSON text data" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\74fca1bf-042f-45d9-b80a-6a884bfa483b.tmp]6e:T73f,"2FA_Code_Engine.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "2FA_Code_Engine.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") "2FA_Code_Engine.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\INSTALLER"; Key: ""; Value: "") "2FA_Code_Engine.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\LEVELOBJECTS"; Key: ""; Value: "") "2FA_Code_Engine.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "2FA_Code_Engine.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\0\PATHS"; Key: ""; Value: "") "2FA_Code_Engine.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\0\HASHES"; Key: ""; Value: "") "2FA_Code_Engine.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\0\URLZONES"; Key: ""; Value: "") "2FA_Code_Engine.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\4096\PATHS"; Key: ""; Value: "") "2FA_Code_Engine.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\4096\HASHES"; Key: ""; Value: "") "2FA_Code_Engine.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\4096\URLZONES"; Key: ""; Value: "") "2FA_Code_Engine.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\65536\PATHS"; Key: ""; Value: "") "2FA_Code_Engine.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\65536\HASHES"; Key: ""; Value: "")6f:T4ef,"2FA_Code_Engine.exe" queries basic process information of the "C:\2FA_Code_Engine.exe" (UID: 7864) "2FA_Code_Engine.exe" queries basic process information of the "C:\Windows\SysWOW64\msiexec.exe" (UID: 7864) "msiexec.exe" queries basic process information of the "C:\Windows\System32\msiexec.exe" (UID: 6032) "msiexec.exe" queries basic process information of the "C:\Windows\SysWOW64\msiexec.exe" (UID: 6032) "msiexec.exe" queries basic process information of the "C:\Windows\Installer\MSI972D.tmp" (UID: 6032) "MsiExec.exe" queries basic process information of the "C:\Windows\SysWOW64\msiexec.exe" (UID: 2664) "msiexec.exe" queries basic process information of the "C:\Windows\SysWOW64\msiexec.exe" (UID: 5964) "MsiExec.exe" queries basic process information of the "C:\Windows\SysWOW64\msiexec.exe" (UID: 2108) "MSI972D.tmp" queries basic process information of the "C:\Windows\Installer\MSI972D.tmp" (UID: 7612) "2FA Code Engine.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Notonlycode\2FA Code Engine\2FA Code Engine.exe" (UID: 5740) "2FA Code Engine.exe" queries basic process information of the "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (UID: 5740)70:Te1b,"2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "EBADF775-48AA-4BF3-8F8E-EC68D113C98E"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "1AFF6089-E863-4D36-BDFD-3581F07440BE"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F0558438-F56A-5987-47DA-040CA75AEF05"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "9A2EDB8F-5883-499F-ACED-6E4B69D43DDF"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "28DCC28B-3E31-527B-EFD6-B4CC4D73D157"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "A3064FC9-4D22-54C9-0003-1F90594554D3"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP"; Key: "RULECOUNT"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: "COM+ENABLED"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{000C101C-0000-0000-C000-000000000046}"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{000C101C-0000-0000-C000-000000000046}"; Key: ""; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXSXSHASHCOUNT"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPX"; Key: "ALLOWDEVELOPMENTWITHOUTDEVLICENSE"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODELUNLOCK"; Key: "ALLOWDEVELOPMENTWITHOUTDEVLICENSE"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\APPCOMPAT"; Key: "RAISEACTIVATIONAUTHENTICATIONLEVEL"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\APPCOMPAT"; Key: "RAISEDEFAULTAUTHNLEVEL"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "DEFAULTACCESSPERMISSION"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "ANONYMOUSAPPCONTAINERIMPERSONATIONLEVELCHECK"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "EVERYONEINCLUDESANONYMOUS"; Value: "")71:T54a,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Able to detect sandbox environment via user account Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to retrieve information set for devices (API string) Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Calls an API typically used to find device information Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Contains ability to detect virtual environment Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Makes a code branch decision directly after an API that is environment aware72:T44b,"2FA_Code_Engine.exe" trying to touch file "C:\windows\temp\VxSSL32.dll" "2FA_Code_Engine.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "2FA_Code_Engine.exe" trying to touch file "C:\FLTLIB.DLL" "2FA_Code_Engine.exe" trying to touch file "C:\WINDOWS\SysWOW64\FLTLIB.DLL" "2FA_Code_Engine.exe" trying to touch file "C:\Windows\SysWOW64\fltLib.dll" "2FA_Code_Engine.exe" trying to touch file "C:\MSVCP140.dll" "2FA_Code_Engine.exe" trying to touch file "C:\WINDOWS\SysWOW64\MSVCP140.dll" "2FA_Code_Engine.exe" trying to touch file "C:\Windows\SysWOW64\msvcp140.dll" "2FA_Code_Engine.exe" trying to touch file "C:\VCRUNTIME140.dll" "2FA_Code_Engine.exe" trying to touch file "C:\WINDOWS\SysWOW64\VCRUNTIME140.dll" "2FA_Code_Engine.exe" trying to touch file "C:\Windows\SysWOW64\vcruntime140.dll" "2FA_Code_Engine.exe" trying to touch file "C:\WINDOWS\SysWOW64\IMM32.DLL" "2FA_Code_Engine.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "2FA_Code_Engine.exe" trying to touch file "C:\2FA_Code_Engine.exe" "2FA_Code_Engine.exe" trying to touch file "\Global??\FltMgrMsg"73:T793,"2FA_Code_Engine.exe" trying to access non-existent file "C:\FLTLIB.DLL" "2FA_Code_Engine.exe" trying to access non-existent file "C:\MSVCP140.dll" "2FA_Code_Engine.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "2FA_Code_Engine.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "2FA_Code_Engine.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "2FA_Code_Engine.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\TSAPPCMP.DLL" "2FA_Code_Engine.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "2FA_Code_Engine.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "2FA_Code_Engine.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "2FA_Code_Engine.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "2FA_Code_Engine.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "msiexec.exe" trying to access non-existent file "C:\WINDOWS\system32\TSAPPCMP.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "MsiExec.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "MsiExec.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "msiexec.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "msiexec.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\TSAPPCMP.DLL" "msiexec.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll"74:T58d,"2FA_Code_Engine.exe" trying to access non-existent file "C:\resources.pri" "2FA_Code_Engine.exe" trying to access non-existent file "C:\App.xbf" "2FA_Code_Engine.exe" trying to access non-existent file "C:\2FA_Code_Engine.exe.Local\" "2FA_Code_Engine.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Notonlycode" "2FA_Code_Engine.exe" trying to access non-existent file "C:\Windows\SystemResources\msi.dll.mun" "2FA_Code_Engine.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\MsiMsg.dll.mui" "2FA_Code_Engine.exe" trying to access non-existent file "C:\Windows\SysWOW64\AppLocker\MDM" "2FA_Code_Engine.exe" trying to access non-existent file "C:\Windows\SystemResources\sxs.DLL.mun" "2FA_Code_Engine.exe" trying to access non-existent file "C:\Windows\SysWOW64\ar-SA\sxs.DLL.mui" "2FA_Code_Engine.exe" trying to access non-existent file "C:\Windows\System32\ar-SA\sxs.DLL.mui" "2FA_Code_Engine.exe" trying to access non-existent file "C:\Windows\SysWOW64\bg-BG\sxs.DLL.mui" "2FA_Code_Engine.exe" trying to access non-existent file "C:\Windows\System32\bg-BG\sxs.DLL.mui" "2FA_Code_Engine.exe" trying to access non-existent file "C:\Windows\SysWOW64\ca-ES\sxs.DLL.mui" "2FA_Code_Engine.exe" trying to access non-existent file "C:\Windows\System32\ca-ES\sxs.DLL.mui" "2FA_Code_Engine.exe" trying to access non-existent file "C:\Windows\SysWOW64\cs-CZ\sxs.DLL.mui"75:T580,"msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Crashpad\throttle_store.dat" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Crashpad\settings.dat" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\Site Characteristics Database\000001.dbtmp" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\Extension Rules\000001.dbtmp" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\shared_proto_db\metadata\000003.log" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\shared_proto_db\000001.dbtmp" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\Site Characteristics Database\000003.log" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Default\Sync Data\LevelDB\000003.log"76:T101b,Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "2FA_Code_Engine.exe") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "2FA_Code_Engine.exe") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "2FA_Code_Engine.exe") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "2FA_Code_Engine.exe") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "2FA_Code_Engine.exe") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "2FA_Code_Engine.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004400-00000C2C-2900202454") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004400-00000C2C-2900278600") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00004400-00000C2C-2900278855") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004400-00000C2C-2900278855") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004400-00000C2C-2900278855") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00004400-00000C2C-2900279514") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004400-00000C2C-2900279514") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004400-00000C2C-2901130347") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004400-00000C2C-2901130460") Found reference to API "WSASendTo" (Indicator: "WSASend"; Source: "00000000-00006628-00000C2C-2858397428") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00006628-00000C2C-2858398036") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00006628-00000C2C-2858497470") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "2FA_Code_Engine.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")77:Tbc6,Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; File: "2FA_Code_Engine.exe") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; File: "2FA_Code_Engine.exe") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; File: "2FA_Code_Engine.exe") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; File: "2FA_Code_Engine.exe") Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "ImpersonateNamedPipeClient" (Indicator: "ImpersonateNamedPipeClient"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "::GetNamedPipeClientProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "GetNamedPipeClientProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "GetNamedPipeServerProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "ImpersonateNamedPipeClient" (Indicator: "ImpersonateNamedPipeClient"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "::GetNamedPipeClientProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")78:Tebe,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")79:T570,Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "2FA_Code_Engine.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "2FA_Code_Engine.exe") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "2FA_Code_Engine.exe") Found reference to API "a protocol buffer. Use the 'bytes' type if you intend to send raw bytes." (Indicator: " send "; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "forged shutdown request, got:" (Indicator: " shutdown "; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "--url=URL send crash reports to this Breakpad server URL," (Indicator: " send "; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "a protocol buffer. Use the 'bytes' type if you intend to send raw bytes." (Indicator: " send "; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp") Found reference to API "forged shutdown request, got:" (Indicator: " shutdown "; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "--url=URL send crash reports to this Breakpad server URL," (Indicator: " send "; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")7a:T4ed7,Pattern match: "http://schemas.microsoft.com/winfx/2006/xaml/presentation" Pattern match: "oft.com/expression/blend/2008" Pattern match: "http://schemas.microsoft.com/winfx/2" Pattern match: "http://schemas.microsoft.com/winfx/2006/xaml" Pattern match: "hemas.microsoft.com/winfx/2006/xaml" Pattern match: "http://schemas.microsoft.com/winfx/2006/xaml/presentationxmlns:x=http://schemas.microsoft.com/winfx/2006/xamlxmlns:d=http://schemas.microsoft.com/expression/blend/2008xmlns:mc=http://schemas.openxmlformats.org/markup-compatibility/2006mc:ignorable=" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "dev.mysql.com" Pattern match: "http://wails.localhost/2fa" Pattern match: "www.office.com/office;https://www.office.com/" Pattern match: "https://*excel.officeapps.live.com/*,https://*onenote.officeapps.live.com/*,https://*powerpoint.officeapps.live.com/*,https://*word-edit.officeapps.live.com/*,https://*excel.officeapps.live.com.mcas.ms/*,https://*onenote.officeapps.live.com.mcas." Pattern match: "http://[*.]wails.localhost,*:{last_modified:13436574478078737,setting:{}}},cookies:{},direct_sockets:{},direct_sockets_private_network_access:{},display_media_system_audio:{},disruptive_notification_permissions:{},durable_storage:{},edg" Pattern match: "http://wails.localhost/iylnjd#" Pattern match: "http://wails.localhost/+-k?jj" Heuristic match: "pub.futsalbandung.org" Heuristic match: "config.edge.skype.com" Pattern match: "https://watson.telemetry.microsoft.com" Heuristic match: "msedge.ec" Heuristic match: "..\..\chrome\app\chrome_exe_main_win.cc" Heuristic match: "..\..\chrome\app\main_dll_loader_win.cc" Heuristic match: "..\..\chrome\common\win\edge_delay_load_notify_hook.cc" Heuristic match: "..\..\chrome\app\exit_code_watcher_win.cc" Heuristic match: "..\..\chrome\common\default_browser_channel_util_wcos.cc" Heuristic match: "!(e..\..\third_party\abseil-cpp\absl\base\internal\throw_delegate.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\strings\internal\cord_rep_btree.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\synchronization\internal\win32_waiter.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\synchronization\mutex.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\base\internal\low_level_alloc.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\log\internal\log_sink_set.cc" Heuristic match: "..\..\third_party\perfetto\src\protozero\field.cc" Heuristic match: "..\..\third_party\perfetto\src\protozero\scattered_heap_buffer.cc" Heuristic match: "..\..\third_party\perfetto\src\protozero\static_buffer.cc" Heuristic match: "?..\..\third_party\perfetto\src\base\time.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\event_context.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\internal\tracing_muxer_fake.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\null_trace_writer.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\shared_memory_abi.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\shared_memory_arbiter_impl.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\trace_writer_impl.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\edge_watson_uploader\string_table_util.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\edge_watson_uploader\throttle_store.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\edge_watson_uploader\watson_http_uploader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\edge_watson_uploader\watson_metadata.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\edge_watson_uploader\watson_report.cc" Pattern match: "https://nw-umwatson.events.data.microsoft.com/telemetry.request" Heuristic match: "..\..\third_party\crashpad\crashpad\edge_watson_uploader\secondary_data_collectors\file_collector_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\edge_watson_uploader\thread_stack_hash_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\edge_watson_uploader\watson_wer_uploader.cc" Heuristic match: "gcc..\..\third_party\crashpad\crashpad\edge_watson_uploader\win\device_ticket.cc" Pattern match: "https://crashpad.chromium.org/" Pattern match: "https://crashpad.chromium.org/bug/new" Heuristic match: "blink.net" Heuristic match: "..\..\base\win\windows_version.cc" Heuristic match: "..\..\base\win\win_util.cc" Heuristic match: "..\..\base\win\resource_exhaustion.cc" Heuristic match: "..\..\base\win\registry.cc" Heuristic match: "..\..\base\time\time_win.cc" Heuristic match: "..\..\base\threading\platform_thread_win.cc" Heuristic match: "..\..\base\system\sys_info_win.cc" Heuristic match: "..\..\base\synchronization\waitable_event_win.cc" Heuristic match: "..\..\base\synchronization\condition_variable_win.cc" Heuristic match: "..\..\base\profiler\suspendable_thread_delegate_win.cc" Heuristic match: "..\..\base\process\launch_win.cc" Heuristic match: "..\..\base\native_library_win.cc" Heuristic match: "..\..\base\win\message_window.cc" Heuristic match: "..\..\base\message_loop\message_pump_win.cc" Heuristic match: "..\..\base\files\memory_mapped_file_win.cc" Heuristic match: "..\..\base\files\file_win.cc" Heuristic match: "..\..\base\win\security_util.cc" Heuristic match: "..\..\base\files\file_util_win.cc" Heuristic match: "..\..\base\files\file_enumerator_win.cc" Heuristic match: "..\..\base\file_version_info_win.cc" Heuristic match: "..\..\base\path_service.cc" Heuristic match: "..\..\base\values.cc" Heuristic match: "..\..\base\threading\thread.cc" Heuristic match: "c..\..\base\threading\scoped_blocking_call_internal.cc" Heuristic match: "..\..\base\task\thread_pool\task_tracker.cc" Heuristic match: "..\..\base\task\thread_pool\sequence.cc" Heuristic match: "..\..\base\task\thread_pool\delayed_task_manager.cc" Heuristic match: "..\..\base\task\sequence_manager\work_tracker.cc" Heuristic match: "..\..\base\task\sequence_manager\work_queue.cc" Heuristic match: "..\..\base\task\sequence_manager\task_queue_impl.cc" Heuristic match: "..\..\base\task\execution_fence.cc" Heuristic match: "..\..\base\synchronization\waitable_event.cc" Heuristic match: "0123456789abcdef..\..\base\run_loop.cc" Heuristic match: "..\..\base\profiler\thread_group_profiler.cc" Heuristic match: "..\..\base\profiler\stack_sampling_profiler.cc" Heuristic match: "..\..\base\metrics\statistics_recorder.cc" Heuristic match: "..\..\base\metrics\sparse_histogram.cc" Heuristic match: "..\..\base\metrics\persistent_memory_allocator.cc" Heuristic match: "..\..\base\metrics\histogram.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\edge_minidumpwritedump_util.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\edge_watson\memory_csv.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\edge_watson\edge_browser_session_csv.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\scoped_handle.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\process_info.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\initial_client_data.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\filesystem_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\file_io_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\directory_reader_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\file_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\file_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\file_io.cc" Heuristic match: "..\..\third_party\protobuf\src\google\protobuf\wire_format_lite.cc" Heuristic match: "..\..\third_party\protobuf\src\google\protobuf\repeated_field.cc" Heuristic match: "..\..\third_party\protobuf\src\google\protobuf\message_lite.cc" Heuristic match: "..\..\third_party\protobuf\src\google\protobuf\io\zero_copy_stream_impl_lite.cc" Heuristic match: "..\..\third_party\protobuf\src\google\protobuf\io\zero_copy_stream.cc" Heuristic match: "..\..\third_party\protobuf\src\google\protobuf\arena.cc" Heuristic match: "..\..\mojo\public\cpp\system\simple_watcher.cc" Heuristic match: "..\..\mojo\public\c\system\thunks.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\client\crash_report_database_win.cc" Heuristic match: "..\..\base\win\edge_osconsent.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\client\settings.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\client\crash_report_database.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\module_version.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\net\http_transport_win.cc" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Heuristic match: "..\..\third_party\zlib\google\zip_writer.cc" Heuristic match: "..\..\third_party\zlib\google\zip.cc" Heuristic match: "..\..\base\win\edge_trace_logging\trace_logging.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\client\prune_crash_reports.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\thread\thread_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\synchronization\semaphore_win.cc" Heuristic match: "@..\..\third_party\crashpad\crashpad\util\win\scoped_local_alloc.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\registration_protocol_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\exception_handler_server.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\scoped_set_event.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\session_end_watcher.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\misc\paths_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\scoped_process_suspend.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\critical_section_with_debug_info.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\client\crashpad_client_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\win\edge_minidumpwritedump_with_crashpad_info.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\win\crash_report_exception_handler.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\handler_main.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\user_stream_data_source.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\minidump_to_upload_parameters.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\file_seeker.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\edge_watson_report_upload.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_writable.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_rva_list_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_writer_util.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_string_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_memory_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_thread_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_module_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_unloaded_module_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_handle_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\edge_minidump_thread_info_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\edge_minidump_thread_names_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_file_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_simple_string_dictionary_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_module_crashpad_info_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_context_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_byte_array_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_annotation_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\system_snapshot_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\process\process_memory.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\process\process_memory_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\process_snapshot_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\process_reader_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\process\process_memory_range.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\process_subrange_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\pe_image_resource_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\pe_image_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\pe_image_annotations_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\module_snapshot_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\exception_snapshot_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\cpu_context_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\crashpad_types\crashpad_info_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\minidump\process_snapshot_minidump.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\minidump\module_snapshot_minidump.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\minidump\minidump_string_list_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\minidump\minidump_simple_string_dictionary_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\minidump\minidump_annotation_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\memory_snapshot.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\capture_memory.cc" Heuristic match: "..\..\components\gwp_asan\crash_handler\crash_handler.cc" Heuristic match: "..\..\components\gwp_asan\common\allocator_state.cc" Heuristic match: "..\..\sandbox\win\src\sandbox_policy_base.cc" Heuristic match: "..\..\sandbox\win\src\process_mitigations.cc" Heuristic match: "..\..\sandbox\win\src\broker_services.cc" Heuristic match: "virtualcamera.ax" Heuristic match: "ycwebcamerasource.ax" Heuristic match: "..\..\components\edge_appxpack\pwahelper\handlers\pinning.cc" Heuristic match: "..\..\components\edge_appxpack\pwahelper\pwahelper.cc" Heuristic match: "..\..\components\edge_appxpack\pwahelper\pwahelper_host.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\container\internal\raw_hash_set.cc" Heuristic match: "..\..\mojo\core\channel.cc" Heuristic match: "..\..\mojo\core\ipcz_driver\mojo_trap.cc" Heuristic match: "..\..\mojo\core\ipcz_driver\transport.cc" Heuristic match: "..\..\mojo\core\platform_handle_in_transit.cc" Heuristic match: "..\..\mojo\core\channel_win.cc" Heuristic match: "..\..\components\edge_appxpack\pwahelper\web_app_widgets\winrt_widgets_platform.cc" Heuristic match: "..\..\components\edge_shell\windows_storage.cc" Heuristic match: "..\..\base\win\object_watcher.cc" Heuristic match: ".a..\..\base\time\time_win.cc" Heuristic match: "..\..\base\synchronization\waitable_event_watcher_win.cc" Heuristic match: "..\..\base\threading\scoped_blocking_call_internal.cc" Heuristic match: "..\..\base\task\thread_pool\thread_group_impl.cc" Heuristic match: "..\..\base\task\thread_pool\pooled_task_runner_delegate.cc" Heuristic match: "..\..\base\task\thread_pool\pooled_single_thread_task_runner_manager.cc" Heuristic match: "..\..\base\run_loop.cc" Heuristic match: "a..\..\base\profiler\thread_group_profiler.cc" Heuristic match: "..\..\base\profiler\stack_sampler.cc" Heuristic match: "..\..\base\metrics\field_trial_params.cc" Pattern match: "extensions.database.open/0x" Heuristic match: "..\..\base\trace_event\process_memory_dump.cc" Heuristic match: "..\..\third_party\boringssl\src\crypto\mem.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\scoped_local_alloc.cc" Heuristic match: "..\..\url\gurl.cc" Heuristic match: "..\..\mojo\public\cpp\platform\named_platform_channel_win.cc" Heuristic match: "..\..\mojo\public\cpp\platform\platform_channel.cc" Heuristic match: "..\..\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc" Heuristic match: "..\..\mojo\public\cpp\bindings\lib\connector.cc" Heuristic match: "..\..\mojo\public\cpp\bindings\lib\multiplex_router.cc" Heuristic match: "..\..\mojo\public\cpp\bindings\lib\validation_errors.cc" Heuristic match: "..\..\mojo\public\cpp\bindings\lib\validation_context.cc" Heuristic match: "..\..\mojo\public\cpp\bindings\lib\scoped_interface_endpoint_handle.cc" Heuristic match: "..\..\mojo\public\cpp\bindings\connection_group.cc" Heuristic match: "..\..\mojo\public\cpp\platform\platform_channel_server_win.cc" Heuristic match: "..\..\mojo\public\cpp\platform\platform_channel_server.cc" Heuristic match: "..\..\mojo\public\cpp\system\invitation.cc" Heuristic match: "..\..\mojo\public\cpp\system\handle_signal_tracker.cc" Heuristic match: "..\..\base\trace_event\trace_log.cc" Heuristic match: "..\..\net\base\net_errors_win.cc" Heuristic match: "..\..\net\socket\tcp_socket_win.cc" Heuristic match: "..\..\third_party\edge_store_service\edge_store_service_platform.cc" Heuristic match: "ft.com" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://www.microsoft.com0" Heuristic match: "onedsblobvmssprdeus03.eastus.cloudapp.azure.com" Pattern match: "www.microsoft.com/mitmproxy-487007270818109937193375387014449110337186509494.crl0" Pattern match: "www.digicert.com1" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1!0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Heuristic match: "ba.mo" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "http://wails.localhost/" Heuristic match: "urce_win.cc" Heuristic match: "moolahmedia.com" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.microsoft.com/pki/crl/products/miccert" Pattern match: "www.microsoft.c" Pattern match: "http://www.microsoft.com/pki/" Heuristic match: "identity_combined_status.ad" Heuristic match: "edge_primary_account_info.id" Heuristic match: "network_primary_browser.network_usage.ie" Pattern match: "https://fs.microsoft.com/fs/windows/config.json" Pattern match: "https://fs.microsoft.com/fs/windows/config.json,config,0" Pattern match: "https://login.live.com"7b:T424,Contains base62 string in header "0xa560979152cd0584a1902271b0B0FD1" in header "GET /0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/faq HTTP/1.1Host: pub.futsalbandung.orgUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base62 string in header "0xEb5D490443cDEd405360745C027B4d8" in header "GET /0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/faq HTTP/1.1Host: pub.futsalbandung.orgUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base62 string in header "0xa560979152cd0584a1902271b0B0FD1" in header "GET /0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/config HTTP/1.1Host: pub.futsalbandung.orgUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base62 string in header "0xEb5D490443cDEd405360745C027B4d8" in header "GET /0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/config HTTP/1.1Host: pub.futsalbandung.orgUser-Agent: Go-http-client/1.1Accept-Encoding: gzip"7c:T441,Observed import api "NetGetDCName" which can "return the name of the primary domain controller (PDC)." [Source: MSI7AC5.tmp] Observed import api "NetGroupGetInfo" which can "retrieve information about a particular global group in the security database." [Source: MSI7AC5.tmp] Observed import api "NetLocalGroupGetInfo" which can "retrieve information about a particular local group account on a server." [Source: MSI7AC5.tmp] Observed import api "NetQueryDisplayInformation" which can "return user account, computer, or group account information. Call this function to quickly enumerate account information for display in user interfaces." [Source: MSI7AC5.tmp] Observed import api "NetUserEnum" which can "retrieve information about all user accounts on a server." [Source: MSI7AC5.tmp] Observed import api "NetUserGetInfo" which can "retrieve information about a particular user account on a server." [Source: MSI7AC5.tmp] Observed import api "NetUserModalsGet" which can "retrieve global information for all users and global groups in the security database." [Source: MSI7AC5.tmp]7d:T8b2,file/memory contains long string with (Indicator: "--user-data-dir"; File: "msedgewebview2.exe") Found string "--user-data-dir=" (Indicator: "--user-data-dir"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000002.304750.00080000.00000004.mdmp") Found string "--user-data-dir=C:\Users\HAPUBWS\AppData\Roaming\2FA Code Engine.exe\EBWebView" (Indicator: "--user-data-dir"; Source: "00000000-00004400.00000002.304750.00060000.00000004.mdmp, 00000000-00004400.00000002.304750.6622D000.00000004.mdmp, 00000000-00004400.00000003.305316.00004000.00000004.mdmp, 00000000-00004400.00000003.305316.00144000.00000004.mdmp, 00000000-00004400.00000003.305316.6622D000.00000004.mdmp") file/memory contains long string with (Indicator: "--user-data-dir"; Source: "00000000-00004400.00000003.305316.0011C000.00000004.mdmp") Found string "--user-data-dir=C:\Users\HAPUBWS\AppData\Roaming\2FA Code Engine.exe\EBWebView" (Indicator: "--user-data-dir"; Source: "00000000-00005224.00000000.300792.00018000.00000004.mdmp, 00000000-00005224.00000001.302711.00004000.00000004.mdmp, 00000000-00005224.00000001.302711.00018000.00000004.mdmp, 00000000-00005224.00000001.302711.000EC000.00000004.mdmp, 00000000-00005224.00000001.302711.000F4000.00000004.mdmp, 00000000-00005224.00000001.302711.00A98000.00000004.mdmp, 00000000-00005224.00000001.302711.64B00000.00000004.mdmp, 00000000-00005224.00000001.302711.69600000.00000004.mdmp, 00000000-00005224.00000002.304634.00004000.00000004.mdmp, 00000000-00005224.00000002.304634.00018000.00000004.mdmp, 00000000-00005224.00000002.304634.000F4000.00000004.mdmp, 00000000-00005224.00000002.304634.64B00000.00000004.mdmp, 00000000-00005224.00000003.305202.00004000.00000004.mdmp, 00000000-00005224.00000003.305202.00018000.00000004.mdmp, 00000000-00005224.00000003.305202.000EC000.00000004.mdmp, 00000000-00005224.00000003.305202.00A98000.00000004.mdmp, 00000000-00005224.00000003.305202.69600000.00000004.mdmp") file/memory contains long string with (Indicator: "--user-data-dir"; Source: "00000000-00005224.00000001.302711.00004000.00000004.mdmp, 00000000-00005224.00000002.304634.00004000.00000004.mdmp, 00000000-00005224.00000003.305202.00004000.00000004.mdmp")7e:T94b,Found registry query API: "RegOpenKeyTransactedW" in file "2FA_Code_Engine.exe" Found registry query API: "RegOpenKeyExW" in file "2FA_Code_Engine.exe" Found registry query API: "RegQueryValueExW" in file "2FA_Code_Engine.exe" Found registry query API: "RegQueryInfoKeyW" in file "2FA_Code_Engine.exe" Found registry query API: "RegEnumKeyExW" in file "2FA_Code_Engine.exe" Found registry query API: "RegEnumValueW" in file "2FA_Code_Engine.exe" Found registry query API: "RegOpenKeyW" in file "2FA_Code_Engine.exe" Found registry query API: "RegOpenKeyExA" in file "2FA_Code_Engine.exe" Found registry query API: "RegEnumValueA" in file "2FA_Code_Engine.exe" Found registry query API: "RegOpenKeyA" in file "2FA_Code_Engine.exe" Found registry query API: "RegQueryValueExA" in file "2FA_Code_Engine.exe" Found registry query API: "RegGetValueW" in "00000000-00003932.00000000.303065.1458D000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00003932.00000000.303065.1458D000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00003932.00000000.303065.1458D000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00003932.00000000.303065.1458D000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp" Found registry query API: "NtQueryValueKey" in "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00005224.00000000.300792.1458D000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp"7f:Tdbb,Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "2FA_Code_Engine.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "2FA_Code_Engine.exe") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; File: "2FA_Code_Engine.exe") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; File: "2FA_Code_Engine.exe") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "2FA_Code_Engine.exe") Found reference to API "NetQueryDisplayInformation" (Indicator: "NetQueryDisplayInformation"; File: "2FA_Code_Engine.exe") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; File: "2FA_Code_Engine.exe") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; File: "2FA_Code_Engine.exe") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "::GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "::WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtQueryInformationProcess incorrect size" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "::NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "::NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "::GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "::WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "NtQueryObject-type_info_length" (Indicator: "NtQueryObject"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp")80:Ta9e,"2FA_Code_Engine.exe" called "FindFirstFileW" with parameter C:\2FA_Code_Engine.exe.local (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindFirstFileW" with parameter \\?\%APPDATA%\Notonlycode\2FA Code Engine 93.11.1\install\ (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindFirstFileW" with parameter \\?\%APPDATA%\Notonlycode\2FA Code Engine 93.11.1\install\2FA Code Engine.msi (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00007864) "2FA_Code_Engine.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007864)81:T1441,Found string "/aespassword" (Indicator: "aes"; File: "2FA_Code_Engine.exe") Found string "AES Decrypt" (Indicator: "aes"; File: "2FA_Code_Engine.exe") file/memory contains long string with (Indicator: "aes"; File: "2FA_Code_Engine.exe") Found string "Setup package was encrypted using AES 256 algorithm. To continue the setup process, you should provide the password needed to decrypt the package." (Indicator: "aes"; File: "2FA_Code_Engine.exe") Found string "{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}" (Indicator: "aes"; File: "b68ab906-43c1-48a9-8199-3e2b27e338e6.tmp") Found string "{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}" (Indicator: "aes"; File: "2c6793b3-1e32-4919-946b-e65c657c0c19.tmp") Found string "Vector Permutation AES for x86_64/SSSE3, Mike Hamburg (Stanford University)" (Indicator: "aes"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found string "AES for Intel AES-NI, CRYPTOGAMS by " (Indicator: "aes"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found string "AES-NI GCM module for x86_64, CRYPTOGAMS by " (Indicator: "aes"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found string "ChaCha20 for x86_64, CRYPTOGAMS by " (Indicator: "chacha"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found string "SymGetModuleBase64 FAILED" (Indicator: "base64"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found string "SymGetModuleBase64" (Indicator: "base64"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found string "Vector Permutation AES for x86_64/SSSE3, Mike Hamburg (Stanford University)" (Indicator: "aes"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found string "AES for Intel AES-NI, CRYPTOGAMS by " (Indicator: "aes"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found string "AES-NI GCM module for x86_64, CRYPTOGAMS by " (Indicator: "aes"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found string "ChaCha20 for x86_64, CRYPTOGAMS by " (Indicator: "chacha"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00004400.00000002.304750.66285000.00000004.mdmp, 00000000-00004400.00000002.304750.662C1000.00000004.mdmp, 00000000-00004400.00000003.305316.66285000.00000004.mdmp, 00000000-00004400.00000003.305316.662C1000.00000004.mdmp") Found string "TLS_AES_256_GCM_SHA384" (Indicator: "aes"; Source: "00000000-00004400.00000002.304750.66285000.00000004.mdmp, 00000000-00004400.00000002.304750.6629D000.00000004.mdmp, 00000000-00004400.00000003.305316.66285000.00000004.mdmp, 00000000-00004400.00000003.305316.6629D000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004400.00000002.304750.662D4000.00000004.mdmp, 00000000-00004400.00000003.305316.662D4000.00000004.mdmp") Found string "ECDSA/SHA384" (Indicator: "ecdsa"; Source: "00000000-00004400.00000002.304750.662F6000.00000004.mdmp, 00000000-00004400.00000002.304750.68300000.00000004.mdmp, 00000000-00004400.00000002.304750.6831B000.00000004.mdmp, 00000000-00004400.00000003.305316.662F6000.00000004.mdmp, 00000000-00004400.00000003.305316.68300000.00000004.mdmp, 00000000-00004400.00000003.305316.6831B000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004400.00000002.304750.662F6000.00000004.mdmp, 00000000-00004400.00000003.305316.662F6000.00000004.mdmp") Found string "os_crypt.encrypted_key" (Indicator: ".encrypt"; Source: "00000000-00005224.00000000.300792.00178000.00000004.mdmp, 00000000-00005224.00000000.300792.0018C000.00000004.mdmp, 00000000-00005224.00000001.302711.00004000.00000004.mdmp, 00000000-00005224.00000001.302711.00178000.00000004.mdmp, 00000000-00005224.00000001.302711.0018C000.00000004.mdmp, 00000000-00005224.00000002.304634.00004000.00000004.mdmp, 00000000-00005224.00000002.304634.00178000.00000004.mdmp, 00000000-00005224.00000002.304634.0018C000.00000004.mdmp, 00000000-00005224.00000003.305202.00004000.00000004.mdmp, 00000000-00005224.00000003.305202.00178000.00000004.mdmp") Found string "Vector Permutation AES for x86_64/SSSE3, Mike Hamburg (Stanford University)" (Indicator: "aes"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp") Found string "AES for Intel AES-NI, CRYPTOGAMS by " (Indicator: "aes"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp") Found string "AES-NI GCM module for x86_64, CRYPTOGAMS by " (Indicator: "aes"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp")82:Taa1,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "2FA_Code_Engine.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "2FA_Code_Engine.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "2FA_Code_Engine.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "FindFirstFileExFromAppW" (Indicator: "FindFirstFile"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "FindFirstFileEx" (Indicator: "FindFirstFile"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "FindFirstFileExFromAppW" (Indicator: "FindFirstFile"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "FindFirstFileEx" (Indicator: "FindFirstFile"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "FindFirstFileExFromAppW" (Indicator: "FindFirstFile"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "FindFirstFileEx" (Indicator: "FindFirstFile"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp")83:Tcdb,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "2FA_Code_Engine.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "2FA_Code_Engine.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "2FA_Code_Engine.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "2FA_Code_Engine.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "2FA_Code_Engine.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "2FA_Code_Engine.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "2FA_Code_Engine.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "2FA_Code_Engine.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "2FA_Code_Engine.exe") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "2FA_Code_Engine.exe") Found reference to API "CreateToolhelp32Snapshot failed" (Indicator: "CreateToolhelp32Snapshot"; File: "2FA_Code_Engine.exe") Found reference to API "Process32First failed" (Indicator: "Process32First"; File: "2FA_Code_Engine.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002220.00000000.302577.7CF85000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002220.00000000.302577.7CF85000.00000002.mdmp") Found reference to API "__crtGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtQueryInformationProcess incorrect size" (Indicator: "QueryInformationProcess"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "::NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp")84:Ta30,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "2FA_Code_Engine.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "2FA_Code_Engine.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "2FA_Code_Engine.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000002.304750.79614000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "__vcrt_GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004400.00000002.304750.79614000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp")85:T43b,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "2FA_Code_Engine.exe") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002220.00000000.302577.7CF85000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000002.304750.79614000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp")86:Tdd6,Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "2FA_Code_Engine.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "2FA_Code_Engine.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "2FA_Code_Engine.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "2FA_Code_Engine.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "2FA_Code_Engine.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "2FA_Code_Engine.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "2FA_Code_Engine.exe") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "2FA_Code_Engine.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "2FA_Code_Engine.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "2FA_Code_Engine.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "2FA_Code_Engine.exe") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; File: "2FA_Code_Engine.exe") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "2FA_Code_Engine.exe") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "__crtGetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "GetFileAttributes" (Indicator: "GetFileAttributes"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetFileAttributesExFromAppW" (Indicator: "GetFileAttributes"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "AttemptToNotifyRunningChrome:GetCurrentDirectory failed" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetFileVersionInfoSize:" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetFileVersionInfoSize:" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetFileVersionInfo:" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp")87:T9cf,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "2FA_Code_Engine.exe") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "2FA_Code_Engine.exe") Found reference to API "GetModuleFileName" (Indicator: "GetModuleFileName"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "K32GetModuleFileNameExA" (Indicator: "GetModuleFileName"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000002.304750.79614000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "__vcrt_GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004400.00000002.304750.79614000.00000002.mdmp") Found reference to API "GetModuleFileName" (Indicator: "GetModuleFileName"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "K32GetModuleFileNameExA" (Indicator: "GetModuleFileName"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")88:T54d,Found reference to API "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; File: "2FA_Code_Engine.exe") Found reference to API "GetEnvironmentVariableA failed with code" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetEnvironmentVariableA" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "GetEnvironmentVariableA failed with code" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "GetEnvironmentVariableA" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp")89:T12b2,Found string "User name and password for proxy server were received from command line and used." (Indicator: "password"; File: "2FA_Code_Engine.exe") Found string "/proxypassword" (Indicator: "password"; File: "2FA_Code_Engine.exe") Found string "/password" (Indicator: "password"; File: "2FA_Code_Engine.exe") Found string "/aespassword" (Indicator: "password"; File: "2FA_Code_Engine.exe") Found string "Show password" (Indicator: "password"; File: "2FA_Code_Engine.exe") file/memory contains long string with (Indicator: "password"; File: "2FA_Code_Engine.exe") Found string "Connect to %sNThe server %s at %s requires a username and password. Please enter them below." (Indicator: "password"; File: "2FA_Code_Engine.exe") Found string "Setup package was encrypted using AES 256 algorithm. To continue the setup process, you should provide the password needed to decrypt the package." (Indicator: "password"; File: "2FA_Code_Engine.exe") Found string "passwords" (Indicator: "password"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found string "password_manager" (Indicator: "password"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found string "passwords" (Indicator: "password"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found string "password_manager" (Indicator: "password"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found string "passwords/manual_filling_controller/0x?" (Indicator: "password"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found string "password_hash_data_list" (Indicator: "password"; Source: "00000000-00004400.00000003.305316.00144000.00000004.mdmp") Found string "local.password_hash_data_list" (Indicator: "password"; Source: "00000000-00005224.00000000.300792.00044000.00000004.mdmp, 00000000-00005224.00000001.302711.00044000.00000004.mdmp, 00000000-00005224.00000001.302711.00AE8000.00000004.mdmp, 00000000-00005224.00000002.304634.00044000.00000004.mdmp, 00000000-00005224.00000002.304634.00AE8000.00000004.mdmp, 00000000-00005224.00000003.305202.00AE8000.00000004.mdmp") Found string "new_device_fre.safari_password_import_result_status" (Indicator: "password"; Source: "00000000-00005224.00000000.300792.00044000.00000004.mdmp, 00000000-00005224.00000001.302711.00044000.00000004.mdmp, 00000000-00005224.00000002.304634.00044000.00000004.mdmp") Found string "password_manager.os_password_last_changed" (Indicator: "password"; Source: "00000000-00005224.00000000.300792.00154000.00000004.mdmp, 00000000-00005224.00000003.305202.00154000.00000004.mdmp") Found string "password_manager.os_password_blank" (Indicator: "password"; Source: "00000000-00005224.00000000.300792.00154000.00000004.mdmp, 00000000-00005224.00000003.305202.00154000.00000004.mdmp") Found string "password_manager.is_biometric_avaliable" (Indicator: "password"; Source: "00000000-00005224.00000000.300792.00154000.00000004.mdmp, 00000000-00005224.00000003.305202.00154000.00000004.mdmp") Found string "password_manager.had_biometrics_available" (Indicator: "password"; Source: "00000000-00005224.00000000.300792.00154000.00000004.mdmp, 00000000-00005224.00000003.305202.00154000.00000004.mdmp") Found string "profile.edge_password_private_outlook_email_toggle_state" (Indicator: "password"; Source: "00000000-00005224.00000000.300792.00178000.00000004.mdmp, 00000000-00005224.00000001.302711.00068000.00000004.mdmp, 00000000-00005224.00000001.302711.00178000.00000004.mdmp, 00000000-00005224.00000002.304634.00068000.00000004.mdmp, 00000000-00005224.00000002.304634.00178000.00000004.mdmp, 00000000-00005224.00000003.305202.00068000.00000004.mdmp, 00000000-00005224.00000003.305202.00178000.00000004.mdmp") Found string "profile.edge_password_private_outlook_email" (Indicator: "password"; Source: "00000000-00005224.00000000.300792.0018C000.00000004.mdmp, 00000000-00005224.00000001.302711.0018C000.00000004.mdmp, 00000000-00005224.00000001.302711.001B0000.00000004.mdmp, 00000000-00005224.00000002.304634.0018C000.00000004.mdmp") Found string "passwords" (Indicator: "password"; Source: "00000000-00005224.00000000.300792.00404000.00000004.mdmp, 00000000-00005224.00000000.300792.00410000.00000004.mdmp, 00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.00404000.00000004.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp") Found string "password_manager" (Indicator: "password"; Source: "00000000-00005224.00000000.300792.00404000.00000004.mdmp, 00000000-00005224.00000000.300792.00410000.00000004.mdmp, 00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.00404000.00000004.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp")8a:T24b4,Found string "\Device\HarddiskVolume3\Windows\SysWOW64\msiexec.exe" (Indicator: "\Device\"; Source: "00000000-00007864-00000BC0-2829016688") Found string "\Device\HarddiskVolume3\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Indicator: "\Device\"; Source: "00000000-00005740-00000BC0-2838073410") Found string "\Device\DeviceApi" (Indicator: "\Device\"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found string "\Device\KsecDD" (Indicator: "\Device\"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004400.00000000.300911.68000000.00000004.mdmp, 00000000-00004400.00000001.302832.68000000.00000004.mdmp, 00000000-00004400.00000002.304750.0003C000.00000004.mdmp, 00000000-00004400.00000002.304750.66213000.00000004.mdmp, 00000000-00004400.00000002.304750.6622D000.00000004.mdmp, 00000000-00004400.00000002.304750.68000000.00000004.mdmp, 00000000-00004400.00000003.305316.0003C000.00000004.mdmp, 00000000-00004400.00000003.305316.66213000.00000004.mdmp, 00000000-00004400.00000003.305316.6622D000.00000004.mdmp, 00000000-00004400.00000003.305316.68000000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004400.00000000.300911.68000000.00000004.mdmp, 00000000-00004400.00000001.302832.68000000.00000004.mdmp, 00000000-00004400.00000002.304750.0003C000.00000004.mdmp, 00000000-00004400.00000002.304750.66213000.00000004.mdmp, 00000000-00004400.00000002.304750.6622D000.00000004.mdmp, 00000000-00004400.00000002.304750.68000000.00000004.mdmp, 00000000-00004400.00000003.305316.0003C000.00000004.mdmp, 00000000-00004400.00000003.305316.66213000.00000004.mdmp, 00000000-00004400.00000003.305316.6622D000.00000004.mdmp, 00000000-00004400.00000003.305316.68000000.00000004.mdmp") Found string "\Microsoft\PolicyManager\current\Device\System" (Indicator: "\Device\"; Source: "00000000-00004400.00000003.305316.68000000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005224.00000000.300792.00008000.00000004.mdmp, 00000000-00005224.00000000.300792.00044000.00000004.mdmp, 00000000-00005224.00000000.300792.00054000.00000004.mdmp, 00000000-00005224.00000000.300792.63800000.00000004.mdmp, 00000000-00005224.00000001.302711.00044000.00000004.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.00904000.00000004.mdmp, 00000000-00005224.00000001.302711.61ABC000.00000004.mdmp, 00000000-00005224.00000001.302711.63800000.00000004.mdmp, 00000000-00005224.00000001.302711.64B13000.00000004.mdmp, 00000000-00005224.00000001.302711.69600000.00000004.mdmp, 00000000-00005224.00000002.304634.00044000.00000004.mdmp, 00000000-00005224.00000002.304634.63800000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00904000.00000004.mdmp, 00000000-00005224.00000003.305202.61ABC000.00000004.mdmp, 00000000-00005224.00000003.305202.64B13000.00000004.mdmp, 00000000-00005224.00000003.305202.69600000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005224.00000000.300792.00008000.00000004.mdmp, 00000000-00005224.00000000.300792.00044000.00000004.mdmp, 00000000-00005224.00000000.300792.00054000.00000004.mdmp, 00000000-00005224.00000000.300792.63800000.00000004.mdmp, 00000000-00005224.00000001.302711.00044000.00000004.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.00904000.00000004.mdmp, 00000000-00005224.00000001.302711.61ABC000.00000004.mdmp, 00000000-00005224.00000001.302711.63800000.00000004.mdmp, 00000000-00005224.00000001.302711.64B13000.00000004.mdmp, 00000000-00005224.00000001.302711.69600000.00000004.mdmp, 00000000-00005224.00000002.304634.00044000.00000004.mdmp, 00000000-00005224.00000002.304634.63800000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00904000.00000004.mdmp, 00000000-00005224.00000003.305202.61ABC000.00000004.mdmp, 00000000-00005224.00000003.305202.64B13000.00000004.mdmp, 00000000-00005224.00000003.305202.69600000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\windows.storage.dll" (Indicator: "\Device\"; Source: "00000000-00005224.00000000.300792.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Temp\VxSSL64.dll" (Indicator: "\Device\"; Source: "00000000-00005224.00000000.300792.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\ws2_32.dll" (Indicator: "\Device\"; Source: "00000000-00005224.00000000.300792.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\win32u.dll" (Indicator: "\Device\"; Source: "00000000-00005224.00000000.300792.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\user32.dll" (Indicator: "\Device\"; Source: "00000000-00005224.00000000.300792.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\gdi32.dll" (Indicator: "\Device\"; Source: "00000000-00005224.00000000.300792.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\gdi32full.dll" (Indicator: "\Device\"; Source: "00000000-00005224.00000000.300792.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\msvcp_win.dll" (Indicator: "\Device\"; Source: "00000000-00005224.00000000.300792.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\fltLib.dll" (Indicator: "\Device\"; Source: "00000000-00005224.00000000.300792.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\imm32.dll" (Indicator: "\Device\"; Source: "00000000-00005224.00000000.300792.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\advapi32.dll" (Indicator: "\Device\"; Source: "00000000-00005224.00000000.300792.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\msvcrt.dll" (Indicator: "\Device\"; Source: "00000000-00005224.00000000.300792.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\sechost.dll" (Indicator: "\Device\"; Source: "00000000-00005224.00000000.300792.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\ole32.dll" (Indicator: "\Device\"; Source: "00000000-00005224.00000000.300792.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\oleaut32.dll" (Indicator: "\Device\"; Source: "00000000-00005224.00000000.300792.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\shlwapi.dll" (Indicator: "\Device\"; Source: "00000000-00005224.00000000.300792.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\cryptsp.dll" (Indicator: "\Device\"; Source: "00000000-00005224.00000000.300792.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\version.dll" (Indicator: "\Device\"; Source: "00000000-00005224.00000000.300792.00054000.00000004.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp")8b:Tade,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "2FA_Code_Engine.exe") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "2FA_Code_Engine.exe") Found reference to API "DeleteFileAfterReboot" (Indicator: "DeleteFile"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "DoDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "RemoveDirectory" (Indicator: "RemoveDirectory"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "DeleteFileWithDispositionFlags" (Indicator: "DeleteFile"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "DoDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "RemoveDirectory" (Indicator: "RemoveDirectory"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "DeleteFileAfterReboot" (Indicator: "DeleteFile"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "DoDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "RemoveDirectory" (Indicator: "RemoveDirectory"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")8c:T66a,Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "2FA_Code_Engine.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "2FA_Code_Engine.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "2FA_Code_Engine.exe") Found reference to API "::AdjustTokenPrivileges() failed!. LastError=" (Indicator: "AdjustTokenPrivileges"; File: "2FA_Code_Engine.exe") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; File: "2FA_Code_Engine.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")8d:T71d,Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "2FA_Code_Engine.exe") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")8e:Tff1,Found reference to API "::InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "::UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size) succeeded, expected failure" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicy failed with Policy:" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicy" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "::InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "::UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size) succeeded, expected failure" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicy" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "::InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "::UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size) succeeded, expected failure" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicy failed with Policy:" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicy" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")8f:Tdb5,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "2FA_Code_Engine.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "2FA_Code_Engine.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "2FA_Code_Engine.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "2FA_Code_Engine.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "2FA_Code_Engine.exe") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "2FA_Code_Engine.exe") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "2FA_Code_Engine.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "2FA_Code_Engine.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "2FA_Code_Engine.exe") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "2FA_Code_Engine.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "2FA_Code_Engine.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "2FA_Code_Engine.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "2FA_Code_Engine.exe") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "2FA_Code_Engine.exe") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "2FA_Code_Engine.exe") Found reference to API "CheckTokenCapability" (Indicator: "CheckTokenCapability"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "AccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "AddMandatoryAce" (Indicator: "AddMandatoryAce"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "BuildExplicitAccessWithNameW" (Indicator: "BuildExplicitAccessWithName"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateRestrictedToken" (Indicator: "CreateRestrictedToken"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp")90:Ta09,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "2FA_Code_Engine.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "2FA_Code_Engine.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "2FA_Code_Engine.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002220.00000000.302577.7CF85000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003476.00000000.301913.69261000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000002.304750.79614000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp")91:T74a,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: MSI7AC5.tmp] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: MSI7AC5.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: MSI7AC5.tmp] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: MSI7AC5.tmp] Observed import api "GetSidIdentifierAuthority" which can "return a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: MSI7AC5.tmp] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: MSI7AC5.tmp] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: MSI7AC5.tmp] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: MSI7AC5.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: MSI7AC5.tmp] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: MSI7AC5.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: MSI7AC5.tmp] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: MSI7AC5.tmp]92:Tab1,"2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSWOW64\MSIEXEC.EXE"; Value: "") "2FA_Code_Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "2FA Code Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\PROGRAM FILES (X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\144.0.3719.115\MSEDGEWEBVIEW2.EXE"; Value: ""), "2FA Code Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: ""), "2FA Code Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: ""), "2FA Code Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: ""), "2FA Code Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: ""), "2FA Code Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: ""), "2FA Code Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: ""), "2FA Code Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: ""), "2FA Code Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: ""), "2FA Code Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: ""), "2FA Code Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: ""), "2FA Code Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: ""), "2FA Code Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: ""), "2FA Code Engine.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "")93:T4a1d,"2FA Code Engine.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\6B\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\CI.DLL,-100"; Value: "Isolated User Mode (IUM)"), "2FA Code Engine.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\6B\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\CI.DLL -101"; Value: "Enclave"), "2FA Code Engine.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\6B\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\DNSAPI.DLL -103"; Value: "Domain Name System (DNS) Server Trust"), "2FA Code Engine.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\6B\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\FVEUI.DLL -843"; Value: "BitLocker Drive Encryption"), "2FA Code Engine.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\6B\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\FVEUI.DLL -844"; Value: "BitLocker Data Recovery Agent"), "2FA Code Engine.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\6B\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\WUAUENG.DLL -400"; Value: "Windows Update"), "2FA Code Engine.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\6B\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE -124"; Value: "Document Encryption"), "2FA Code Engine.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\6B\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\NGCRECOVERY.DLL -100"; Value: "Windows Hello Recovery Key Encryption"), "2FA Code Engine.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "AB190000000000000400040001001B020200000000B31C020152B601020909020212F80002388F020285C70102E8C20103A63A0203CBE40103F91B02043E8E02045F9A0204931A0104AF630104DADC0105DE850205F9E70106C42802079A1902088D4201089E1902095E2F0209A336010A6B6C010BE8C5010BF99C020C3131020CE9C2000D28C7010D7879000D7E3E020D7E4F020DD3F9000E091A020E303E020E9F67020F168C01101755021043E800104C8E02112969021142C20011AB3D0212E5F800130A360213951B0213E9780014FD160215E07E0216D134021793380117C06F0117DE370118208A02186C1E0219C0E2001A2D42021AE8EC011BF60B001C955C001D3083021D3BC5011D5819021E451E021EC330021ED770011F34CC011F626C021F6C76022018F200213AC30121777A00223BED0122A7730123116E01237AF80123ABE90123CC4F01246B460124ACC70024C18B0125023802254F6E01262B9401264BA801267F9D022834190228A11B012919DA0129450101297DA90129861F0229CE33022AC7DE002B2499002BD8E5012C9F7A022CA603022D22DA012D5838012E1EF0012E4A1C022E6974012E7714022F39D5002F4CE5012FA8FF0131484F003257A400329F7A0232D1A70032D45F0133FB2A0233FE38023542CC0135602102361EE10139A7C20139AFDE013A99D9013B8031023CB352003D121F023D218F023DC47F023E1CB7013E3383003E5BED01403D670140A28E0141A8760041BC3A02420D510242264A0042B3AE0042C54D02435EBA0143AB210144A4C401454ED30045668A024677300146AB2E02483BDB0148C24F0048F9A60049CBA30149DA1B0249EAB7004AAA81004AC433024ADEE1014B2A91014B6EE3014B7207024BF474024C15AA014C41B4004C9E02024CC84B014D3ED9014E50C2014F14C2004FA53302508F00025276930253467301536A3A02538AAD015408340254302F0254B7DC0054DFE20155DB8C0155E6E101560A850057426B01577AF801578A1B0257AD120158021202589E270258BB5C025953940059C43C025A0189025A0289025A0A83025A2C80015AE213025AF783025B1203025C3598015E83D7015EF05F025F83500261D42A0261D98C0162DC300262EF34026396770063EC740263FD310264054E0264C9260164D4190164F42B0265C4850265ED1D0267ABEE0167BA6B0268130102682C90006957EA0169592A0269CC4F016A3683026A61E8016A7365016A95E2016BF42B026C0B76026C137F026C6F66026D2390026DEE2C026E4538027052E20170A32C0271014902718C9A02726E4A0072A2420172CD990173422F0274A3A30175A37E007691CF0177D52F0277F98F0178159600785DD30179F99C027A5B7C027C82C9017CBAFC017D904A017DBBD6017E1044017E3732027E5030027EEE89027F16AA017F88CA00800184028106950081B0690281B942028227730082409702825B8A0282FB2A02833AC50183F16000844D260184D7780284E11E0284E6830085311B028550AE0085E34102861BDE01867B060186ECB6018754990287D5140287DE830087F0250187FC380288818702890CE901892F830289DC8B018A8093008AFAE3008BEEF2008BFD6E018C1D88028C8F94028E78A2008E90C6018ED891018FEAF9019123D30091C335029259160092603302928271009369C70093CA3D0293CDFD0193CE8C019439F701945AE001945B270294A15B0195126E01959F33019697E30196A26E0197F6C40098C7F10198D7780299429B02996776029A0B73019B4A72029C429B029C4D22029CE0A8009D9D92009E1E90019F8230029F8314029FF47702A1236602A19D2A01A2050600A2065D02A2961002A3998D02A3C4E200A3C88302A3E8DD01A4580200A4778D02A4AEE901A5092E02A5ADCF00A644A600A6951D01A6E9B300A736A800A7B8AD00A7C23301A7E23E02A8EA4E02AAB1FC01AAF63F02AB9FC901ABF42B02AC4D1C02AC54F900AC79D901AC930202AD2DB801AD73BF00AE4D5702AEE69101AF086501AF9C0202B09E9702B0F13802B2376E01B2827902B2BAFC01B3732002B3742D02B392FB00B4D7C501B51B6701B5661202B7750C02B7E23E02B8C37F02B91AF300B9B92A02B9FA7702BB51DD01BB8E1602BB8E8B00BBF42B02BC6EB400BCD22A01BD388F00BEAF8A02BF674602BFDC4602C0079A00C03A8E02C046AD00C1BCF101C2151602C2610B01C2DEE401C2FD7C02C33EA300C36D8100C399F300C535C900C561EA01C58D9002C5EA1602C6331902C75DD700C85C5902C8B83902C9389700CA072E02CA23B700CB533302CB74DA00CC495600CCEFEF00CDBA8302CE99E001CEE23E02CF1C0402CF74AA00CFF36501D0175600D0B00802D1D2A700D2C12702D2CF9D02D2E67302D2ED3702D3140C02D3826100D3834B01D3E88D00D4489A01D4A04002D5398801D5F78602D6231F02D6EF5802D737C501D7D2C501D7E86C02D8E79C01D940E901D997E001DA0B7301DA38C801DB7A1402DB87DD01DBE23E02DBE56F02DC451502DC5C2B02DD1B1901DE0F8702DE692702DF294302E0093602E01FA101E0BC0102E1417E02E16D9901E17E8C00E193B001E1E3D801E21B5600E2BC8802E2DB2C02E4402701E469C900E4EF1B02E5BD5C01E5E03902E6109902E63E2B0DE66C8100E6BD3902E7A3E901E7A4D900E7E23E02E88E2401E98C0A01E9D36601E9EA3402EB3B9402EB7FDF01EB8D3302EB908D02EC63C501EC95E101ECBC3602EDAA2E02EE165502EE5F9902EE930202EEAF9B02EFD67202F0694F02F07F0B02F0B91402F0E0B600F133E901F13A9102F1728102F17D5F00F1AD3D01F1FC6000F20E9302F2B4FA00F2FFA501F308DB00F3492A02F3658E02F3894001F3B82102F458EC01F4EA9502F5500D01F577C201F62D3102F6F12B02F7125E00F7D36F00F7EC8302F7ED6A00F8C13D02F9DFA101FA667802FAFB8402FB8CC601FC3A4701FC75BA01FD148602FDB0D900FDDFE501FE784F02FE8D5E02FEDC8C01FEE26301FF10DD01FF3400023900060000000DEAFC0110BE880212F7C70113F7C7011A6F93021BA02E02212E4D0225C5010228614B022E240F022EDD89023C6AF901410189024BFC6D0251B2340261057C0261367A0263CB2E0269B992026A23E20170FC8802786C6D0279DE98027E018902877B32028B2894028EE3780299345802996776029E306B02A1866302A6749502AFA32E02B0D58102B5235202B6F13B02B7F15002BB635C02C1239D01C3445D02C8D15D02CF6C8502CFF42B02D88C3F02DBB95D02DCEF8E02DFD47602E2077F02E4718902EA5B9402EBAC7502EDF38E02EF007702F02A7402F0E23E02F7CC9002FC998D020700400100001ED770014B11B4006041AE00682C9000A5ADCF00A6951D01CE99E0010100420100009E1E9001010043010000C0EC7C0000"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT\EXTENSIONS.SETTINGS"; Key: "DGIKLKFKLLIKCANFONKCABMBDFMGLEAG"; Value: "77C97D257E96B03EED5C5C33D3994D9AF9F534950FC946B6F13E382E92DB8BDB"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT\EXTENSIONS.SETTINGS"; Key: "MHJFBMDGCFJBBPAEOJOFOHOEFGIEHJAI"; Value: "F192ABA6C1DA48EEC35F4E204F09F1AC69A54C16E81AE9599426835555BED152"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "SCHEDULE_TO_FLUSH_TO_DISK"; Value: "5A66209ADCC776B3A9DD24AD57323FCC7F0449DAAD3E5C9B2C56E7388659031A"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\BLBEACON"; Key: "FAILED_COUNT"; Value: "0000000000"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\BLBEACON"; Key: "STATE"; Value: "0200000000"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\THIRDPARTY"; Key: "STATUSCODES"; Value: ""), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\THIRDPARTY"; Key: "STATUSCODES"; Value: "0100000000"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\BLBEACON"; Key: "STATE"; Value: "0100000000"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEUPDATE\CLIENTSTATE\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"; Key: "DR"; Value: "3100000000"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\STABILITYMETRICS"; Key: "USER_EXPERIENCE_METRICS.STABILITY.EXITED_CLEANLY"; Value: "0000000000"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW"; Key: "USAGESTATSINSAMPLE"; Value: "0100000000"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "EXTENSIONS.INSTALL.INITIALPROVIDERNAME"; Value: "2E3187650A978333AD6DD7485DA01608110399987BCCE307AB1B43AD00F23EAE"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "SCHEDULE_TO_FLUSH_TO_DISK"; Value: "B5B6DB4F5CED6E7DB7628E0F2E445E1D2BE9BCA5CDCA798C97EC203D333CAC92"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "EXTENSIONS.UI.DEVELOPER_MODE"; Value: "2A4E13FC7F02831CE123C600510D90FBDEEFA0685C8EEFF8426F8F1FD7B6CE74"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "GOOGLE.SERVICES.LAST_SIGNED_IN_USERNAME"; Value: "94DB0A296BEC6C659A6E3A616A85326E869DCFAF40848085E4A6DE2BD4F5B81A"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "EXTENSIONS.INSTALL.INITIALLIST"; Value: "440A7D22CC5078056EAA2C152E56AB3C90B5A318D1303FBF127C953CB50D6189"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "ENTERPRISE_SIGNIN.POLICY_RECOVERY_TOKEN"; Value: "7B958104500F8BEB8708E1281E64464B743D5C18CEA31FBD73F8E98708899CAD"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEUPDATE\CLIENTSTATE\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"; Key: "LASTRUN"; Value: "13436574467826887"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\BLBEACON"; Key: "VERSION"; Value: "144.0.3719.115"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTSTATEMEDIUM\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"; Key: "USAGESTATS"; Value: "0000000000"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTSTATEMEDIUM\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"; Key: "URLSTATS"; Value: "0000000000"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\PROPERTY"; Key: "0018C018348995C7"; Value: "0100000001000000D08C9DDF0115D1118C7A00C04FC297EB0100000035F14449F6191141A9054C8B820A361E0000000002000000000010660000000100002000000031D90E5CE5043F7B428BBF81306D0B751B4181A2891816FBA084D5F1D618E534000000000E80000000020000200000009262FD6CE0CE53879B05CEF2E585BECCAA2D2984A238F5450FB307DEA89CC06680000000C2AB1D33D493E971590F05CF676B62BDB1A846B8C9DEB91C4F70B1EB2FAF0656753AC958DA34E87C0B91AFFADCE93160385F0A1AADAB571B16A905927CD67365B5E397194FF30C7665EC1D2CDBCFDCE14929E3E25796E34842EAEFCA551832AE9B638633815DB6DC5BD3C9EE300C31A31A0CCF0110212DEF369BF225DF60B51840000000A132B008955DDCCA34CEC658774FAC5EDE6C7458E1CCACBF783E3664F6A63FE5ACEDFABDBFBE83C5AB5C979C0F0DE5EF5A1E343C8767C61845A4A8B70E703B0A00"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\TOKEN\{67082621-8D18-4333-9C64-10DE93676363}"; Key: "DEVICETICKET"; Value: "0100000001000000D08C9DDF0115D1118C7A00C04FC297EB0100000035F14449F6191141A9054C8B820A361E00000000020000000000106600000001000020000000906FFFED51A280B305FD37B77F55954EBB80F5FE67E19020CB56F2E0C9180838000000000E800000000200002000000091E28C939B79573566483F68EF1B7F866F767571647A7610547C013127A93259C00C0000866D67AAADD60FA1A21DCBD8CB6720B9DDE0E9672F447344B489975CB5D09552CC1380A8E9D0B311BC1587F588AAD395BAD7F3619E0E4A841EA57A16890CE52F77B562BFC830BA7206E911107C7BF23A40065CAA8B43E04B553EE2698078696FA4896B4CA45B486FE07A43D9C4576E3A236E611918C28B9425DA497C4A869682F919CB1BD604151B2FCD510F22171FD3FC079E44E358C5902DA288C392A9DDDF319C9CD06CE470BA7AFD1C10813D9C6D671816A4F1015F4A7A679FD3C18692703C28238E849F9E75E55F4923A5829DE9E2EE3C70A2A4982FA269D3D363DC4171C551FD5FEEE64642606C78DBBA51190029F7A5E471C99FA1D059C0D299BC7D93337054086146EB523C4D0F28888E17D4A0AAD336F7268A2EEBDA6BC8361C4988B1F8E591FEE8A91F1B6A36DBDFD18240D51EA784205E768A1A4DA31ED504500553B664493E799F286B9F4F8341A67E29EC50AFAFDD52A94DCF61210529394EE817EE33E18D2109287267012852C1A5FCA1D88F39ADB7E7D1EC2F46DA4E40FC7D901D653699EAC67CF7C366E60218A2CBD7FC38445CF6D932F6673F7860B0F98CF0FD945988283B739E6BE95C77977558BAB7C8D74F5FB6495235B6902ED08A1F980002B5F13E28C8F59A2F70F862E21DD055FBD19A0740DC28F43A78331E38F4C46AEC7DD314CEDA0A1A7078AD9D638AE1CDA3FEC716344BB5C81AEB982E20A848BF6F1B2B236683328F61081C0F263F6B7352B019D0AACE06E2FE69F371E28CA4BF370727BDFC6CD991168BB2A1202E38BBFA8471A7AC2C848CC053E42C3BD2C53AC769FE3F70B67FA73E1F2DB7BE86F6058979FE9CA1857FFB86079DEA23B670C2B323F32A89F8604A2904B034DCCD242E3E0797B55EDB98C9FBE025BD8F14CA15FDD08E7090D40455FD156530EF767A995FA1721C323AD6095C3C164BEA1B18E27CFDFD4EC95A3E232C81C65D28E0913B47383ADDA8311E6DACAA1CC3ACD328CC9DD8347D4F185746AC907ED73743C192AFDA82E9F2CA4B68883AAFAFD8B17CAD0EE3C0B802A48B1A4A2F33C133233512E215C7DEB79580BCEB1D24650640D70029A53D13E1866BA6139C6CFA6089C501E74BAC6531A09D942CCBE4AE74485F1B9FA424049B89D4C58C32231CD96EBE5FDF72B8AF2A0F3F2C808A0CCFAE4E3142A8BA945068856AD61603BA3630BC7812E75099F16F64CE77D5E5180A3007701D1E7B9504B4E7A5EF95C31EBB5F72A51FB914A499EB25CC6451DAA36B1C3C503B42CE881F184A1AD70F476858A3D92BD8110B00EA73D5F8479DC01844F90C201748E0D750CCF31DF777597EC309A1AC3655504CED10B80BE9949D8FE5696E137B41720F5778CA245CCAD9DDBB14AD79B0FAA99D61714775E4993F82DB884E9A2AA658F026FE7F32BB4729385BE7F88994B14D328757F0F9C3A76F4910C8E753AC2507399A0D7A4C087DE5AC468E926A853B96FB54032DEE3BBB7884B3BDA49D4158CE08D2AE51DE5A0937AA9F5F81E855C14B1D8F1C74861EC7BF008B537E8C9982B61E1F19E77F33DFEC03053129D401EB27C57C7FC42B5FA2F06B9D08C32105C0FC5E53722CF110D06DAD0AEC91560F04B815417020D403E27B4044C1A26535082F77ED87856A76C3002271F44F0599825E00095B23091CC025A235D35C3A65CFB623AE87EDA01BD1661258B40F5A42A300ECD5CBA0B80F344DF1B8C5CEDAAC57D20CA0BECD989A9752CB58D0D00C22A2992F5FB78DA87C53FE71136EA7EC601D20BE2433FF2C9F74FC6BCD5E0FE73DCE6719C8997380FAE7E3F6E2A1041B7A8472B3015B2EA49CE7E665F63DEA066381EDEAC7BEC6964229BC96BA6EE8DBBEEC39EC42EC231691E435E6750CACF3C48D23F8FA498E76E60AE01778E8772AF412056AF8D75E7170D6D8445CB1A3FA2794BCB74277D6E97732840B34DE9B8A5C6E25A5E3C432BB389E5792D39A872467F0D5CEDDF0826C98D45485C384EE576C1A91B2F6F758593C440F85BA6EC66325A8201E3D1E5BF3CF7043F3F306E0767BEC01286F238CC22D9492D6DED9DDC5BCC1EA5032D94155941AE11369C69A7D161BF6DADF86AD646CCE096679C08C0ED59401261E5B1F4C0C5F02DA41833C1C281BCD36F6F1853421C24AB977E3562D03D6D1F61E4041D60E1C25CD4C37F9A25A6C64CA9772990F359C065845A8F29307282A501DCA8E42A0A8BB7F750388B83DD66EEA30D5213BAED9FEEA67EBDDDDBD027C05CFC6611E874E06D4CF15D4553CD138853141CB4189644BFDC26E798E83B6F8C6520E4B27E874567379E6A9F0884A86FCF3BC92FCBD798DD7AF929322F6C2BC219F0E6C32D1D49FB16212399EB1335DAD1278042F12D6A2AFA4821472348FD397E7E009991E5427C02A35B12BCB901AD4CED227C7FD57D78AD8DEFCBCAEDEBE669CC54C1BB1D75EF71AA097AB99254F3EB6077BCD3AE1A667C6050F1479DE99D52E16E6F455B9D4B66D96635F33FE247442B64208943886BCD716335A44802EF1FCFE4B144F817B17797ACF2D88FC07AE7DDB39F3CF66E36C40BD59503A07DDAAEB714C89797666FD78BEF3D9DB6A2429E100468245D6A26C886D15B1B93638237332417E678F1622CDE1FD699F3D9B29C16AF915DD4605305EDBE5F9D18734FF6F77343051D8BAE40818F49010FC3316837572A7672AB424AE20AF44FA92BA0825A2609287A82A590A1F5B2A0B5536AAD852CC856EC1285BC62DACC5071C4A3560C1D41DFDCD459AC5AF867C6D91BA31245256B6961048A6EC8308EBBB6CEDAE1872A33E5E93C8CCA7E3C211C4622DC0526551091FD739557BB61D03823DC84CB46011781222ADD48FADD474441976D5288047A7C9B57BEE958DED56E17AE48813BCE2646A5E9E41355232CC0893BBAFC1826E8F94A39A817C989AD77EE613A441947A32E88C52995DA32AB76DCEAA047F258FD75E62430F0DAC9E5775EE5A25A9509BF542F0B8D7808A3E1E7F267BCFC87F6623A5F8C8C9170ED427FD57096BCCE42F9392230B6945FA9603EC7F4DDD4947247FB8BB414651D67DEFFB0DCF9B1E33B086064669C56254C5AA54909A7EBCFEC8F1A1F07EAFFEC82CA9B491B2238CEF80214AFF01B9E2F88ECCD0A052DC3B1FD6ECAA4AC48D70492C1DFE5300D662FA6120D780141769DF4AD59210BF314C0A7CBC6C7B331A6B01596647E5786545F6CECE23B2E3BAC34F895653FB059E0DE7CADA4749EB0A128766500DDA2771616DAD9BA299B27BC4750E1E6BF31C2166E5A39F350F0C89D4398F4B9D2F0F9BF94C69DB2D59883D8970F401CB588850E9DDFD134AC7F771549BB3D4AA3D4B244E722D484353F5E1DBFDF501D7313A40A4CA8F945B2B0947275823A14D40145C4505CBB642D92B72F762093757E9ECDE959DA53370917C249B5B6D5BC93536D894F7941E7881DE467884F446EC73D702A1CFE6A51FD3D68EF95BB949B851AEA8FF651C4C42A669F0ED65A514381ED926B02CF264B9EC145CE7AE37DC4D424067E9EE9CE40D74B23B90331210C8CB5E3831664ABB04F94E13C91561FE3B4F20966EE12D9EAA46F24DF7E7DA77C7251DF081A54251F1BBB2EFBEE87FC9BF961F6D681253E740DD8E823CDDDCB34F5839F3B2E179A66494435C982362E68745A9EDFAE833F6600E1145BBFDD5B89B68837E985175116D7C13EA56DA67F66C8A6E8E7F03A3B77FB8823E0F05EE83862F2305E3D8458B71364FD095464084FFB44B3AB03212E81CA3155FA5E7BE3DF322BA47B8722BEF271B984AA0D7D38DAE356040296B1988007F09E6EDCE2CFA249F26A9C02943EB240D4EAD8A3F9719ECEB94D9127402CDE51742CBB9D9AE1507E2249D984E1F57A4E9FC06D8B4C40C01D9888C27D4B5AA97F770DB9FBFBE21EEC8A0242EF6DA68D6B76CAD448F3E77FC136A32D22054C6A5E6DBD49E1532287C7D0A9C1594C88423D1E4D4D932A5EC4D076F75461C1C64D65790017D5D6409AF9D36CBD6A990BA65409726841D95B6208BF8775C12C16281AD678BBC5F75FEF915B9AB24C80CAE83E2AF882F9B6ECAFF604450ACF1DCA1AC73006CD2F7759222BFA1A4520F15262442F88078E00689DBDF001E53473B509B94178BF8C42C2281D78AD4E9FF90BD5E3A18797B1D273CB757D3B9E1C6EFCF80EA38AF8B2F026265B37919239E66EC1CCC4D902933331C6A6A56B218CDFF24CEB49FAF474BCF718FFDB98255EE367323AB2B34D735DDFD584BFBCA8FF2537031AAC4560B20FCC0BAF722504342C9720E0207B4A3CFF0AF358BC59A4650D7FAD1BE9A5E416ADEC8AACC39D02DE16CD5E2182596A3FE16C7ADA05E93C22EFCD4D28441099F01BB279FD430FCC28BE7CD16FB78F4153E7281AFCB1763EC4A7F9BB0F7F7BB718BF3FB30869F8B09334C0E4BD838EB87AA688B0CDA26BB799F9610F2FCC91DFD05389413F6340AC556DD93E2F32F735BD47F7A51F09A5F9B840EC3AED00AE0DD204A1D04BCEAD21B636BB52CFEE471A03A97B87A5F81FE7482D009E4110754F581695BF06CEBF64DBA668EAF4DE1504A06FA787AA72D4C87A813014FFA9B91DA43B55DD24850D47B225F810A8D34773440A2E14CD45CC777166B93A178EE10DDA09A40000000628F0A3149563DEE8194EB5187AD05C34F9BDB98E709CD0577308E2CA395BB04D4896EF3F9546210F8E6E308B2E1A097F2D1A7D90D2B0FFC59EFC7305E2782E700"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\TOKEN\{67082621-8D18-4333-9C64-10DE93676363}"; Key: "DEVICEID"; Value: "0018C018348995C7"), "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\TOKEN\{67082621-8D18-4333-9C64-10DE93676363}"; Key: "APPLICATIONFLAGS"; Value: "0100000000")94:T42e,Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; File: "2FA_Code_Engine.exe") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp")95:Te7c,Dropped file: "2FA Code Engine.msi" - Location: [%APPDATA%\Notonlycode\2FA Code Engine 93.11.1\install\2FA Code Engine.msi]- [targetUID: 00000000-00007864] Dropped file: "e2ab07a9-6db2-4b59-beae-075096067543.dmp" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Crashpad\reports\e2ab07a9-6db2-4b59-beae-075096067543.dmp]- [targetUID: 00000000-00004400] Dropped file: "2FA Code Engine1.cab" - Location: [%APPDATA%\Notonlycode\2FA Code Engine 93.11.1\install\2FA Code Engine1.cab]- [targetUID: 00000000-00007864] Dropped file: "data_1" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\DawnWebGPUCache\data_1]- [targetUID: 00000000-00005224] Dropped file: "index" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\DawnGraphiteCache\index]- [targetUID: 00000000-00006628] Dropped file: "index" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\GPUCache\index]- [targetUID: 00000000-00006628] Dropped file: "index" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\DawnWebGPUCache\index]- [targetUID: 00000000-00006628] Dropped file: "index" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\ShaderCache\index]- [targetUID: 00000000-00006628] Dropped file: "Web Data" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Web Data]- [targetUID: 00000000-00005224] Dropped file: "History" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\History]- [targetUID: 00000000-00005224] Dropped file: "EdgeJourneys.db-wal" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\EdgeJourneys\EdgeJourneys.db-wal]- [targetUID: 00000000-00005224] Dropped file: "DIPS-wal" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\DIPS-wal]- [targetUID: 00000000-00005224] Dropped file: "Network Action Predictor" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network Action Predictor]- [targetUID: 00000000-00005224] Dropped file: "db" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Shared Dictionary\db]- [targetUID: 00000000-00006628] Dropped file: "Login Data For Account" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Login Data For Account]- [targetUID: 00000000-00005224] Dropped file: "Reporting and NEL" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\Reporting and NEL]- [targetUID: 00000000-00006628] Dropped file: "Trust Tokens" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Network\Trust Tokens]- [targetUID: 00000000-00006628] Dropped file: "ExtensionActivityEdge" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\ExtensionActivityEdge]- [targetUID: 00000000-00005224] Dropped file: "Vpn Tokens" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Vpn Tokens]- [targetUID: 00000000-00005224] Dropped file: "BrowsingTopicsSiteData" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\BrowsingTopicsSiteData]- [targetUID: 00000000-00005224] Dropped file: "Safe Browsing Cookies" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies]- [targetUID: 00000000-00006628] Dropped file: "Top Sites" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Top Sites]- [targetUID: 00000000-00005224] Dropped file: "ServerCertificate" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\ServerCertificate]- [targetUID: 00000000-00005224] Dropped file: "Favicons" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\Favicons]- [targetUID: 00000000-00005224] Dropped file: "EdgeJourneys.db" - Location: [%APPDATA%\2FA Code Engine.exe\EBWebView\Default\EdgeJourneys\EdgeJourneys.db]- [targetUID: 00000000-00005224]96:T9e8,Found string "GetSystemTimePreciseAsFileTime" (Source: 2FA_Code_Engine.exe, API is part of module: KERNELBASE.DLL) Found string "CorExitProcess" (Source: 2FA_Code_Engine.exe, API is part of module: MSCOREEI.DLL) Found string "EnumSystemLocalesEx" (Source: 2FA_Code_Engine.exe, API is part of module: KERNELBASE.DLL) Found string "GetDateFormatEx" (Source: 2FA_Code_Engine.exe, API is part of module: KERNELBASE.DLL) Found string "GetTimeFormatEx" (Source: 2FA_Code_Engine.exe, API is part of module: KERNELBASE.DLL) Found string "GetUserDefaultLocaleName" (Source: 2FA_Code_Engine.exe, API is part of module: KERNELBASE.DLL) Found string "IsValidLocaleName" (Source: 2FA_Code_Engine.exe, API is part of module: KERNELBASE.DLL) Found string "LCIDToLocaleName" (Source: 2FA_Code_Engine.exe, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: 2FA_Code_Engine.exe, API is part of module: KERNELBASE.DLL) Found string "RoInitialize" (Source: 2FA_Code_Engine.exe, API is part of module: COMBASE.DLL) Found string "RoUninitialize" (Source: 2FA_Code_Engine.exe, API is part of module: COMBASE.DLL) Found string "AppPolicyGetProcessTerminationMethod" (Source: 2FA_Code_Engine.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "AppPolicyGetThreadInitializationType" (Source: 2FA_Code_Engine.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "log10" (Source: 2FA_Code_Engine.exe, API is part of module: MSVCRT.DLL) Found string "atan2" (Source: 2FA_Code_Engine.exe, API is part of module: MSVCRT.DLL) Found string "floor" (Source: 2FA_Code_Engine.exe, API is part of module: MSVCRT.DLL) Found string "ldexp" (Source: 2FA_Code_Engine.exe, API is part of module: MSVCRT.DLL) Found string "frexp" (Source: 2FA_Code_Engine.exe, API is part of module: MSVCRT.DLL) Found string "RoGetActivationFactory" (Source: 2FA_Code_Engine.exe, API is part of module: COMBASE.DLL) Found string "CoIncrementMTAUsage" (Source: 2FA_Code_Engine.exe, API is part of module: COMBASE.DLL) Found string "DllGetActivationFactory" (Source: 2FA_Code_Engine.exe, API is part of module: WINTYPES.DLL) Found string "RoOriginateLanguageException" (Source: 2FA_Code_Engine.exe, API is part of module: COMBASE.DLL) Found string "GetWindowTheme" (Source: 2FA_Code_Engine.exe, API is part of module: UXTHEME.DLL) Found string "SetWindowTheme" (Source: 2FA_Code_Engine.exe, API is part of module: UXTHEME.DLL) Found string "DrawThemeBackground" (Source: 2FA_Code_Engine.exe, API is part of module: UXTHEME.DLL)97:T7cb,Found string "Dbghelp.dll" (Indicator: "dbghelp.dll"; File: "2FA_Code_Engine.exe") Found string "dbghelp.dll" (Indicator: "dbghelp.dll"; File: "2FA_Code_Engine.exe") Found string "dbghelp.dll" (Indicator: "dbghelp.dll"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found string "Library dbghelp.dll is not loaded" (Indicator: "dbghelp.dll"; Source: "00000000-00003932.00000000.303065.1458D000.00000002.mdmp") Found string "dbghelp.dll" (Indicator: "dbghelp.dll"; Source: "00000000-00004400.00000000.300911.5CF32000.00000002.mdmp") Found string "C:\WINDOWS\SYSTEM32\dbghelp.dll" (Indicator: "dbghelp.dll"; Source: "00000000-00004400.00000002.304750.0003C000.00000004.mdmp, 00000000-00004400.00000002.304750.00080000.00000004.mdmp, 00000000-00004400.00000002.304750.6831B000.00000004.mdmp, 00000000-00004400.00000002.304750.68C69000.00000004.mdmp, 00000000-00004400.00000003.305316.6831B000.00000004.mdmp") Found string "\??\C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\144.0.3719.115\dbghelp.dll" (Indicator: "dbghelp.dll"; Source: "00000000-00004400.00000002.304750.662D4000.00000004.mdmp") Found string "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\dbghelp.dll" (Indicator: "dbghelp.dll"; Source: "00000000-00004400.00000002.304750.662D4000.00000004.mdmp, 00000000-00004400.00000003.305316.662D4000.00000004.mdmp") Found string "C:\Windows\System32\dbghelp.dll" (Indicator: "dbghelp.dll"; Source: "00000000-00004400.00000002.304750.68C69000.00000004.mdmp") Found string "m32\dbghelp.dll" (Indicator: "dbghelp.dll"; Source: "00000000-00004400.00000003.305316.00080000.00000004.mdmp") Found string "dbghelp.dll" (Indicator: "dbghelp.dll"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp") Found string "Library dbghelp.dll is not loaded" (Indicator: "dbghelp.dll"; Source: "00000000-00005224.00000000.300792.1458D000.00000002.mdmp")98:Ta9e,"msedgewebview2.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "8ae9f0c30ea1668425d0f7d6255d597ead710776" "cbBinary": "20" "dwFlags": "1073741836" "pcchString": "29000000"} "msedgewebview2.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "8ae9f0c30ea1668425d0f7d6255d597ead710776" "cbBinary": "20" "dwFlags": "1073741836" "pcchString": "29000000"} "msedgewebview2.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "8ae9f0c30ea1668425d0f7d6255d597ead710776" "cbBinary": "20" "dwFlags": "1073741836" "pszString": "8ae9f0c30ea1668425d0f7d6255d597ead710776" "pcchString": "28000000"} "msedgewebview2.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "8ae9f0c30ea1668425d0f7d6255d597ead710776" "cbBinary": "20" "dwFlags": "1073741836" "pszString": "8ae9f0c30ea1668425d0f7d6255d597ead710776" "pcchString": "28000000"} "msedgewebview2.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "cbBinary": "20" "dwFlags": "1073741836" "pcchString": "29000000"} "msedgewebview2.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "cbBinary": "20" "dwFlags": "1073741836" "pcchString": "29000000"} "msedgewebview2.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "cbBinary": "20" "dwFlags": "1073741836" "pszString": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "pcchString": "28000000"} "msedgewebview2.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "cbBinary": "20" "dwFlags": "1073741836" "pszString": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "pcchString": "28000000"} "msedgewebview2.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "Z*pX" "cbBinary": "20" "dwFlags": "1073741836" "pcchString": "29000000"} "msedgewebview2.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "Z*pX" "cbBinary": "20" "dwFlags": "1073741836" "pcchString": "29000000"} "msedgewebview2.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "Z*pX" "cbBinary": "20" "dwFlags": "1073741836" "pszString": "5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b" "pcchString": "28000000"} "msedgewebview2.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "Z*pX" "cbBinary": "20" "dwFlags": "1073741836" "pszString": "5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b" "pcchString": "28000000"} "msedgewebview2.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "ab1e781e118b61049965e4363c6d9de47fbed751" "cbBinary": "20" "dwFlags": "1073741836" "pcchString": "29000000"}99:T879,"2FA_Code_Engine.exe" opened "C:\resources.pri" with delete access "2FA_Code_Engine.exe" opened "C:\App.xbf" with delete access "2FA_Code_Engine.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\shi7A66.tmp" with delete access "2FA_Code_Engine.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\MSI7AC5.tmp" with delete access "2FA_Code_Engine.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\MSI7E60.tmp" with delete access "2FA_Code_Engine.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\MSI7F6A.tmp" with delete access "2FA_Code_Engine.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Notonlycode\2FA Code Engine 93.11.1\install\holder0.aiph" with delete access "2FA_Code_Engine.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Notonlycode\2FA Code Engine 93.11.1\install\2FA Code Engine.msi" with delete access "2FA_Code_Engine.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Notonlycode\2FA Code Engine 93.11.1\install\2FA Code Engine1.cab" with delete access "2FA_Code_Engine.exe" opened "C:\resources.pri.back" with delete access "2FA_Code_Engine.exe" opened "C:\App.xbf.back" with delete access "msiexec.exe" opened "Z:\MSI783fd.tmp" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\BrowserMetrics\BrowserMetrics-6AD149FC-1468.pma" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\BrowserMetrics-spare.pma" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Local State" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\Edge-Local-State-Tmp-70350048-5b2d-4143-85a5-ab9d674c9d92.tmp" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\ShaderCache\index" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\ShaderCache\data_0" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\2FA Code Engine.exe\EBWebView\ShaderCache\data_1" with delete access9a:T472,GetTickCount IsDebuggerPresent FindResourceExW DeleteFileW FindResourceW LoadLibraryExA OpenProcess LoadLibraryW WriteFile GetModuleFileNameA VirtualProtect GetCommandLineW GetSystemDirectoryW CreateThread CopyFileW GetModuleHandleW GetDriveTypeW ReadProcessMemory GetFileSizeEx ExitThread LoadLibraryA GetModuleHandleExW Sleep GetTempPathW GetModuleHandleA Process32NextW OutputDebugStringW GetFileAttributesW GetFileSize CreateDirectoryW ConnectNamedPipe GetProcAddress CreateProcessW FindFirstFileW CopyFileExW GetCommandLineA GetStartupInfoW CreateFileW GetTempFileNameW LoadLibraryExW UnhandledExceptionFilter FindNextFileW GetSystemInfo SleepConditionVariableSRW VirtualAlloc LockResource GetModuleFileNameW CreateToolhelp32Snapshot Process32FirstW TerminateProcess FindFirstFileExW RegOpenKeyExW SetSecurityDescriptorDacl RegCloseKey RegCreateKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW LookupAccountNameW StartServiceW ChangeServiceConfig2W OpenProcessToken RegOpenKeyW GetFileAttributesExW ShellExecuteW ShellExecuteExW GetWindowThreadProcessId WSAStartup9b:T8aa,"2FA_Code_Engine.exe" wrote 000011C0 bytes to a remote process "C:\Windows\SysWOW64\msiexec.exe" (Handle: 1420) "2FA_Code_Engine.exe" wrote 00000008 bytes to a remote process "C:\Windows\SysWOW64\msiexec.exe" (Handle: 1420) "2FA_Code_Engine.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\msiexec.exe" (Handle: 1420) "2FA Code Engine.exe" wrote 000011C0 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 1080) "2FA Code Engine.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 1080) "msedgewebview2.exe" wrote 000011C0 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 524) "msedgewebview2.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 524) "msedgewebview2.exe" wrote 000011C0 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 2072) "msedgewebview2.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 2072) "msedgewebview2.exe" wrote 00000170 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 2072) "msedgewebview2.exe" wrote 0000002C bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 2072) "msedgewebview2.exe" wrote 00000010 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 2072) "msedgewebview2.exe" wrote 00000020 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 2072) "msedgewebview2.exe" wrote 000000E8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 2072)9c:T751,"msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYCRL") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYCRL"; Key: "LOGINURL") "msedgewebview2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\APPDATA\APPID=ECD6B820-32C2-49B6-98A6-444530E5A77A&CLIENTID=ECD6B820-32C2-49B6-98A6-444530E5A77A") "msedgewebview2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\APPDATA\APPID=ECD6B820-32C2-49B6-98A6-444530E5A77A&CLIENTID=ECD6B820-32C2-49B6-98A6-444530E5A77A"; Key: "FIRSTPARTY") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYCRL\TRACE") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYCRL"; Key: "SERVICEENVIRONMENT") "msedgewebview2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\TOKEN\{67082621-8D18-4333-9C64-10DE93676363}") "msedgewebview2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\TOKEN\{67082621-8D18-4333-9C64-10DE93676363}"; Key: "APPLICATIONFLAGS") "msedgewebview2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\TOKEN\{67082621-8D18-4333-9C64-10DE93676363}"; Key: "DEVICEID") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYCRL\CLOCKDATA"; Key: "TICKCOUNT") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYCRL\CLOCKDATA"; Key: "CLOCKTIMESECONDS") "msedgewebview2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\PROPERTY") "msedgewebview2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\PROPERTY"; Key: "00180017009BEC0A") "msedgewebview2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\TOKEN\{67082621-8D18-4333-9C64-10DE93676363}"; Key: "DEVICETICKET") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYCRL"; Key: "GLOBALDEVICEUPDATETIME") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYCRL"; Key: "CLOCKSKEW")9d:T33d6,Spawned process "2FA_Code_Engine.exe" (UID: 00000000-00007864) Spawned process "MSI972D.tmp" with commandline "/DontWait /dir "%LOCALAPPDATA%\\Notonlycode\\2FA Code Engine\\" "%LOCALAPPDATA%\\Notonlycode\\2FA Code Engine\\2FA Code Engine.exe"" (UID: 00000000-00007612) Spawned process "2FA Code Engine.exe" (UID: 00000000-00005740) Spawned process "msedgewebview2.exe" with commandline "--embedded-browser-webview=1 --webview-exe-name="2FA Code Engine.exe" --webview-exe-version=93.11.1 --user-data-dir="%APPDATA%\\2FA Code Engine.exe\\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=5740.952.7889707601427223284 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4" (UID: 00000000-00005224) Spawned process "msedgewebview2.exe" with commandline "--type=crashpad-handler "--user-data-dir=%APPDATA%\\2FA Code Engine.exe\\EBWebView" /prefetch:4 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4 --monitor-self-annotation=ptype=crashpad-handler "--database=%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=144.0.7559.133 "--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=144.0.3719.115 --initial-client-data=0x1ec,0x1f0,0x1f4,0x1cc,0x1fc,0x7ffe5d012c98,0x7ffe5d012ca4,0x7ffe5d012cb0" (UID: 00000000-00004400) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\2FA Code Engine.exe\\EBWebView" --webview-exe-name="2FA Code Engine.exe" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1560,i,7135221318738348128,17153472583956656550,262144 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1916 /prefetch:2 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4" (UID: 00000000-00002584) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="%APPDATA%\\2FA Code Engine.exe\\EBWebView" --webview-exe-name="2FA Code Engine.exe" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --startup-read-main-dll --metrics-shmem-handle=2188,i,10029634921436890177,12213248626881894889,524288 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2192 /prefetch:11 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4" (UID: 00000000-00006628) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="%APPDATA%\\2FA Code Engine.exe\\EBWebView" --webview-exe-name="2FA Code Engine.exe" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --startup-read-main-dll --metrics-shmem-handle=2320,i,4449242312814079140,14670654105106157457,524288 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2336 /prefetch:13 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4" (UID: 00000000-00007300) Spawned process "msedgewebview2.exe" with commandline "--type=renderer --noerrdialogs --user-data-dir="%APPDATA%\\2FA Code Engine.exe\\EBWebView" --webview-exe-name="2FA Code Engine.exe" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--expose-gc --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1792096162439330 --launch-time-ticks=4706633067 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3528,i,948724515679154959,2113731586124519774,2097152 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3536 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4 /prefetch:1" (UID: 00000000-00006072) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\2FA Code Engine.exe\\EBWebView" --webview-exe-name="2FA Code Engine.exe" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --skip-read-main-dll --metrics-shmem-handle=3588,i,1396378995022175724,7932194887759781919,262144 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2124 /prefetch:2 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4" (UID: 00000000-00006356) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="%APPDATA%\\2FA Code Engine.exe\\EBWebView" --webview-exe-name="2FA Code Engine.exe" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --skip-read-main-dll --metrics-shmem-handle=2328,i,7838783191710588682,5462908635907611202,524288 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3008 /prefetch:13 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4" (UID: 00000000-00002196) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\2FA Code Engine.exe\\EBWebView" --webview-exe-name="2FA Code Engine.exe" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --skip-read-main-dll --metrics-shmem-handle=3972,i,2420863170057958433,2580433206524639466,262144 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=2080 /prefetch:2 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4" (UID: 00000000-00003476) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="%APPDATA%\\2FA Code Engine.exe\\EBWebView" --webview-exe-name="2FA Code Engine.exe" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --skip-read-main-dll --metrics-shmem-handle=2320,i,8203678854322192269,18076336309383939207,524288 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=2652 /prefetch:13 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4" (UID: 00000000-00005412) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\2FA Code Engine.exe\\EBWebView" --webview-exe-name="2FA Code Engine.exe" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --skip-read-main-dll --metrics-shmem-handle=2152,i,4561646623240771927,3397197724944642047,262144 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4100 /prefetch:2 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4" (UID: 00000000-00007204) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="%APPDATA%\\2FA Code Engine.exe\\EBWebView" --webview-exe-name="2FA Code Engine.exe" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --skip-read-main-dll --metrics-shmem-handle=2328,i,9120693241969524970,6174647175900877566,524288 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=2652 /prefetch:13 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4" (UID: 00000000-00002132) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\2FA Code Engine.exe\\EBWebView" --webview-exe-name="2FA Code Engine.exe" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --skip-read-main-dll --metrics-shmem-handle=4496,i,9757061989068158769,1907043909376031204,262144 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4460 /prefetch:2 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4" (UID: 00000000-00002220) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="%APPDATA%\\2FA Code Engine.exe\\EBWebView" --webview-exe-name="2FA Code Engine.exe" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --skip-read-main-dll --metrics-shmem-handle=2320,i,11815893434193215517,16844125244836349847,524288 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=2576 /prefetch:13 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4" (UID: 00000000-00001904) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\2FA Code Engine.exe\\EBWebView" --webview-exe-name="2FA Code Engine.exe" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --skip-read-main-dll --metrics-shmem-handle=4648,i,9522653075563452907,11453059068208672766,262144 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4640 /prefetch:2 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4" (UID: 00000000-00005752) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="%APPDATA%\\2FA Code Engine.exe\\EBWebView" --webview-exe-name="2FA Code Engine.exe" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --skip-read-main-dll --metrics-shmem-handle=2328,i,540686530873696741,17350240333834508214,524288 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=2064 /prefetch:13 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4" (UID: 00000000-00003932)9e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAMzMzAAAAAAAAAAAAAAAAMzMzMzMAAAAAAAAAAAAAAzMzMzMzMAAAAAAAAAAAAzMzMzMzMzMwAAAAAAAAADMzMzMzMzMzMzAAAAAAADMzMzMzMzMzMzMzAAAAAAMzMzMzMzMzMzMzMzAAAAAzMzMzMzMzMzMzMzMzAAAAMzMzMzMzMzMzMzMzMzAAAzMzMzMzMzMzMzMzMzMwAAMzMzMzMzMzMzMzMzMzMwADMzMzMzMzMzMzMzMzMzMAAzMzMzMzMzMzMzMzMzMzMAMzMzMzMzMzMzMzMzMzMzMDMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMbGzMzO7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7uDu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAO7u7u7u7u7u7u7u7u7u4ADu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAA7u7u7u7u7u7u7u7u7gAAAAAO7u7u7u7u7u7u4AAAAAAAAADu7u7u7u7uAAAAAAAAAAAAAA7u7u7gAAAAAAAAD/+P///+B///+AH///AA///AAD//gAAf/wAAD/4AAAf8AAAD+AAAAfgAAAH4AAAA8AAAAPAAAAAwAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAwAAAA8AAAAPAAAADwAAAA+AAAAP4AAAf/wAA///gB////D//w==9f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAMzMzAAAAAAAAAAAAAAAAMzMzMzMAAAAAAAAAAAAAAzMzMzMzMAAAAAAAAAAAAzMzMzMzMzMwAAAAAAAAADMzMzMzMzMzMzAAAAAAADMzMzMzMzMzMzMzAAAAAAMzMzMzMzMzMzMzMzAAAAAzMzMzMzMzMzMzMzMzAAAAMzMzMzMzMzMzMzMzMzAAAzMzMzMzMzMzMzMzMzMwAAMzMzMzMzMzMzMzMzMzMwADMzMzMzMzMzMzMzMzMzMAAzMzMzMzMzMzMzMzMzMzMAMzMzMzMzMzMzMzMzMzMzMDMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMbGzMzO7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7uDu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAO7u7u7u7u7u7u7u7u7u4ADu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAA7u7u7u7u7u7u7u7u7gAAAAAO7u7u7u7u7u7u4AAAAAAAAADu7u7u7u7uAAAAAAAAAAAAAA7u7u7gAAAAAAAAD/+P///+B///+AH///AA///AAD//gAAf/wAAD/4AAAf8AAAD+AAAAfgAAAH4AAAA8AAAAPAAAAAwAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAwAAAA8AAAAPAAAADwAAAA+AAAAP4AAAf/wAA///gB////D//w==a0:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAMzMzAAAAAAAAAAAAAAAAMzMzMzMAAAAAAAAAAAAAAzMzMzMzMAAAAAAAAAAAAzMzMzMzMzMwAAAAAAAAADMzMzMzMzMzMzAAAAAAADMzMzMzMzMzMzMzAAAAAAMzMzMzMzMzMzMzMzAAAAAzMzMzMzMzMzMzMzMzAAAAMzMzMzMzMzMzMzMzMzAAAzMzMzMzMzMzMzMzMzMwAAMzMzMzMzMzMzMzMzMzMwADMzMzMzMzMzMzMzMzMzMAAzMzMzMzMzMzMzMzMzMzMAMzMzMzMzMzMzMzMzMzMzMDMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMbGzMzO7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7uDu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAO7u7u7u7u7u7u7u7u7u4ADu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAA7u7u7u7u7u7u7u7u7gAAAAAO7u7u7u7u7u7u4AAAAAAAAADu7u7u7u7uAAAAAAAAAAAAAA7u7u7gAAAAAAAAD/+P///+B///+AH///AA///AAD//gAAf/wAAD/4AAAf8AAAD+AAAAfgAAAH4AAAA8AAAAPAAAAAwAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAwAAAA8AAAAPAAAADwAAAA+AAAAP4AAAf/wAA///gB////D//w==a1:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAMzMzAAAAAAAAAAAAAAAAMzMzMzMAAAAAAAAAAAAAAzMzMzMzMAAAAAAAAAAAAzMzMzMzMzMwAAAAAAAAADMzMzMzMzMzMzAAAAAAADMzMzMzMzMzMzMzAAAAAAMzMzMzMzMzMzMzMzAAAAAzMzMzMzMzMzMzMzMzAAAAMzMzMzMzMzMzMzMzMzAAAzMzMzMzMzMzMzMzMzMwAAMzMzMzMzMzMzMzMzMzMwADMzMzMzMzMzMzMzMzMzMAAzMzMzMzMzMzMzMzMzMzMAMzMzMzMzMzMzMzMzMzMzMDMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMbGzMzO7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7uDu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAO7u7u7u7u7u7u7u7u7u4ADu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAA7u7u7u7u7u7u7u7u7gAAAAAO7u7u7u7u7u7u4AAAAAAAAADu7u7u7u7uAAAAAAAAAAAAAA7u7u7gAAAAAAAAD/+P///+B///+AH///AA///AAD//gAAf/wAAD/4AAAf8AAAD+AAAAfgAAAH4AAAA8AAAAPAAAAAwAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAwAAAA8AAAAPAAAADwAAAA+AAAAP4AAAf/wAA///gB////D//w==a2:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAMzMzAAAAAAAAAAAAAAAAMzMzMzMAAAAAAAAAAAAAAzMzMzMzMAAAAAAAAAAAAzMzMzMzMzMwAAAAAAAAADMzMzMzMzMzMzAAAAAAADMzMzMzMzMzMzMzAAAAAAMzMzMzMzMzMzMzMzAAAAAzMzMzMzMzMzMzMzMzAAAAMzMzMzMzMzMzMzMzMzAAAzMzMzMzMzMzMzMzMzMwAAMzMzMzMzMzMzMzMzMzMwADMzMzMzMzMzMzMzMzMzMAAzMzMzMzMzMzMzMzMzMzMAMzMzMzMzMzMzMzMzMzMzMDMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMbGzMzO7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7uDu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAO7u7u7u7u7u7u7u7u7u4ADu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAA7u7u7u7u7u7u7u7u7gAAAAAO7u7u7u7u7u7u4AAAAAAAAADu7u7u7u7uAAAAAAAAAAAAAA7u7u7gAAAAAAAAD/+P///+B///+AH///AA///AAD//gAAf/wAAD/4AAAf8AAAD+AAAAfgAAAH4AAAA8AAAAPAAAAAwAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAwAAAA8AAAAPAAAADwAAAA+AAAAP4AAAf/wAA///gB////D//w==a3:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAMzMzAAAAAAAAAAAAAAAAMzMzMzMAAAAAAAAAAAAAAzMzMzMzMAAAAAAAAAAAAzMzMzMzMzMwAAAAAAAAADMzMzMzMzMzMzAAAAAAADMzMzMzMzMzMzMzAAAAAAMzMzMzMzMzMzMzMzAAAAAzMzMzMzMzMzMzMzMzAAAAMzMzMzMzMzMzMzMzMzAAAzMzMzMzMzMzMzMzMzMwAAMzMzMzMzMzMzMzMzMzMwADMzMzMzMzMzMzMzMzMzMAAzMzMzMzMzMzMzMzMzMzMAMzMzMzMzMzMzMzMzMzMzMDMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMbGzMzO7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7uDu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAO7u7u7u7u7u7u7u7u7u4ADu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAA7u7u7u7u7u7u7u7u7gAAAAAO7u7u7u7u7u7u4AAAAAAAAADu7u7u7u7uAAAAAAAAAAAAAA7u7u7gAAAAAAAAD/+P///+B///+AH///AA///AAD//gAAf/wAAD/4AAAf8AAAD+AAAAfgAAAH4AAAA8AAAAPAAAAAwAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAwAAAA8AAAAPAAAADwAAAA+AAAAP4AAAf/wAA///gB////D//w==a4:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAMzMzAAAAAAAAAAAAAAAAMzMzMzMAAAAAAAAAAAAAAzMzMzMzMAAAAAAAAAAAAzMzMzMzMzMwAAAAAAAAADMzMzMzMzMzMzAAAAAAADMzMzMzMzMzMzMzAAAAAAMzMzMzMzMzMzMzMzAAAAAzMzMzMzMzMzMzMzMzAAAAMzMzMzMzMzMzMzMzMzAAAzMzMzMzMzMzMzMzMzMwAAMzMzMzMzMzMzMzMzMzMwADMzMzMzMzMzMzMzMzMzMAAzMzMzMzMzMzMzMzMzMzMAMzMzMzMzMzMzMzMzMzMzMDMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMbGzMzO7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7uDu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAO7u7u7u7u7u7u7u7u7u4ADu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAA7u7u7u7u7u7u7u7u7gAAAAAO7u7u7u7u7u7u4AAAAAAAAADu7u7u7u7uAAAAAAAAAAAAAA7u7u7gAAAAAAAAD/+P///+B///+AH///AA///AAD//gAAf/wAAD/4AAAf8AAAD+AAAAfgAAAH4AAAA8AAAAPAAAAAwAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAwAAAA8AAAAPAAAADwAAAA+AAAAP4AAAf/wAA///gB////D//w==a5:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAMzMzAAAAAAAAAAAAAAAAMzMzMzMAAAAAAAAAAAAAAzMzMzMzMAAAAAAAAAAAAzMzMzMzMzMwAAAAAAAAADMzMzMzMzMzMzAAAAAAADMzMzMzMzMzMzMzAAAAAAMzMzMzMzMzMzMzMzAAAAAzMzMzMzMzMzMzMzMzAAAAMzMzMzMzMzMzMzMzMzAAAzMzMzMzMzMzMzMzMzMwAAMzMzMzMzMzMzMzMzMzMwADMzMzMzMzMzMzMzMzMzMAAzMzMzMzMzMzMzMzMzMzMAMzMzMzMzMzMzMzMzMzMzMDMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMbGzMzO7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7uDu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAO7u7u7u7u7u7u7u7u7u4ADu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAA7u7u7u7u7u7u7u7u7gAAAAAO7u7u7u7u7u7u4AAAAAAAAADu7u7u7u7uAAAAAAAAAAAAAA7u7u7gAAAAAAAAD/+P///+B///+AH///AA///AAD//gAAf/wAAD/4AAAf8AAAD+AAAAfgAAAH4AAAA8AAAAPAAAAAwAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAwAAAA8AAAAPAAAADwAAAA+AAAAP4AAAf/wAA///gB////D//w==a6:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAMzMzAAAAAAAAAAAAAAAAMzMzMzMAAAAAAAAAAAAAAzMzMzMzMAAAAAAAAAAAAzMzMzMzMzMwAAAAAAAAADMzMzMzMzMzMzAAAAAAADMzMzMzMzMzMzMzAAAAAAMzMzMzMzMzMzMzMzAAAAAzMzMzMzMzMzMzMzMzAAAAMzMzMzMzMzMzMzMzMzAAAzMzMzMzMzMzMzMzMzMwAAMzMzMzMzMzMzMzMzMzMwADMzMzMzMzMzMzMzMzMzMAAzMzMzMzMzMzMzMzMzMzMAMzMzMzMzMzMzMzMzMzMzMDMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMbGzMzO7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7uDu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAO7u7u7u7u7u7u7u7u7u4ADu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAA7u7u7u7u7u7u7u7u7gAAAAAO7u7u7u7u7u7u4AAAAAAAAADu7u7u7u7uAAAAAAAAAAAAAA7u7u7gAAAAAAAAD/+P///+B///+AH///AA///AAD//gAAf/wAAD/4AAAf8AAAD+AAAAfgAAAH4AAAA8AAAAPAAAAAwAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAwAAAA8AAAAPAAAADwAAAA+AAAAP4AAAf/wAA///gB////D//w==a7:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAMzMzAAAAAAAAAAAAAAAAMzMzMzMAAAAAAAAAAAAAAzMzMzMzMAAAAAAAAAAAAzMzMzMzMzMwAAAAAAAAADMzMzMzMzMzMzAAAAAAADMzMzMzMzMzMzMzAAAAAAMzMzMzMzMzMzMzMzAAAAAzMzMzMzMzMzMzMzMzAAAAMzMzMzMzMzMzMzMzMzAAAzMzMzMzMzMzMzMzMzMwAAMzMzMzMzMzMzMzMzMzMwADMzMzMzMzMzMzMzMzMzMAAzMzMzMzMzMzMzMzMzMzMAMzMzMzMzMzMzMzMzMzMzMDMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMbGzMzO7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7uDu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAO7u7u7u7u7u7u7u7u7u4ADu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAA7u7u7u7u7u7u7u7u7gAAAAAO7u7u7u7u7u7u4AAAAAAAAADu7u7u7u7uAAAAAAAAAAAAAA7u7u7gAAAAAAAAD/+P///+B///+AH///AA///AAD//gAAf/wAAD/4AAAf8AAAD+AAAAfgAAAH4AAAA8AAAAPAAAAAwAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAwAAAA8AAAAPAAAADwAAAA+AAAAP4AAAf/wAA///gB////D//w==a8:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAMzMzAAAAAAAAAAAAAAAAMzMzMzMAAAAAAAAAAAAAAzMzMzMzMAAAAAAAAAAAAzMzMzMzMzMwAAAAAAAAADMzMzMzMzMzMzAAAAAAADMzMzMzMzMzMzMzAAAAAAMzMzMzMzMzMzMzMzAAAAAzMzMzMzMzMzMzMzMzAAAAMzMzMzMzMzMzMzMzMzAAAzMzMzMzMzMzMzMzMzMwAAMzMzMzMzMzMzMzMzMzMwADMzMzMzMzMzMzMzMzMzMAAzMzMzMzMzMzMzMzMzMzMAMzMzMzMzMzMzMzMzMzMzMDMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMbGzMzO7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7uDu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAO7u7u7u7u7u7u7u7u7u4ADu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAA7u7u7u7u7u7u7u7u7gAAAAAO7u7u7u7u7u7u4AAAAAAAAADu7u7u7u7uAAAAAAAAAAAAAA7u7u7gAAAAAAAAD/+P///+B///+AH///AA///AAD//gAAf/wAAD/4AAAf8AAAD+AAAAfgAAAH4AAAA8AAAAPAAAAAwAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAwAAAA8AAAAPAAAADwAAAA+AAAAP4AAAf/wAA///gB////D//w==a9:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAMzMzAAAAAAAAAAAAAAAAMzMzMzMAAAAAAAAAAAAAAzMzMzMzMAAAAAAAAAAAAzMzMzMzMzMwAAAAAAAAADMzMzMzMzMzMzAAAAAAADMzMzMzMzMzMzMzAAAAAAMzMzMzMzMzMzMzMzAAAAAzMzMzMzMzMzMzMzMzAAAAMzMzMzMzMzMzMzMzMzAAAzMzMzMzMzMzMzMzMzMwAAMzMzMzMzMzMzMzMzMzMwADMzMzMzMzMzMzMzMzMzMAAzMzMzMzMzMzMzMzMzMzMAMzMzMzMzMzMzMzMzMzMzMDMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMbGzMzO7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7uDu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAO7u7u7u7u7u7u7u7u7u4ADu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAA7u7u7u7u7u7u7u7u7gAAAAAO7u7u7u7u7u7u4AAAAAAAAADu7u7u7u7uAAAAAAAAAAAAAA7u7u7gAAAAAAAAD/+P///+B///+AH///AA///AAD//gAAf/wAAD/4AAAf8AAAD+AAAAfgAAAH4AAAA8AAAAPAAAAAwAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAwAAAA8AAAAPAAAADwAAAA+AAAAP4AAAf/wAA///gB////D//w==aa:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAMzMzAAAAAAAAAAAAAAAAMzMzMzMAAAAAAAAAAAAAAzMzMzMzMAAAAAAAAAAAAzMzMzMzMzMwAAAAAAAAADMzMzMzMzMzMzAAAAAAADMzMzMzMzMzMzMzAAAAAAMzMzMzMzMzMzMzMzAAAAAzMzMzMzMzMzMzMzMzAAAAMzMzMzMzMzMzMzMzMzAAAzMzMzMzMzMzMzMzMzMwAAMzMzMzMzMzMzMzMzMzMwADMzMzMzMzMzMzMzMzMzMAAzMzMzMzMzMzMzMzMzMzMAMzMzMzMzMzMzMzMzMzMzMDMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMbGzMzO7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7uDu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAO7u7u7u7u7u7u7u7u7u4ADu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAA7u7u7u7u7u7u7u7u7gAAAAAO7u7u7u7u7u7u4AAAAAAAAADu7u7u7u7uAAAAAAAAAAAAAA7u7u7gAAAAAAAAD/+P///+B///+AH///AA///AAD//gAAf/wAAD/4AAAf8AAAD+AAAAfgAAAH4AAAA8AAAAPAAAAAwAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAwAAAA8AAAAPAAAADwAAAA+AAAAP4AAAf/wAA///gB////D//w==ab:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAMzMzAAAAAAAAAAAAAAAAMzMzMzMAAAAAAAAAAAAAAzMzMzMzMAAAAAAAAAAAAzMzMzMzMzMwAAAAAAAAADMzMzMzMzMzMzAAAAAAADMzMzMzMzMzMzMzAAAAAAMzMzMzMzMzMzMzMzAAAAAzMzMzMzMzMzMzMzMzAAAAMzMzMzMzMzMzMzMzMzAAAzMzMzMzMzMzMzMzMzMwAAMzMzMzMzMzMzMzMzMzMwADMzMzMzMzMzMzMzMzMzMAAzMzMzMzMzMzMzMzMzMzMAMzMzMzMzMzMzMzMzMzMzMDMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMbGzMzO7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7uDu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAO7u7u7u7u7u7u7u7u7u4ADu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAA7u7u7u7u7u7u7u7u7gAAAAAO7u7u7u7u7u7u4AAAAAAAAADu7u7u7u7uAAAAAAAAAAAAAA7u7u7gAAAAAAAAD/+P///+B///+AH///AA///AAD//gAAf/wAAD/4AAAf8AAAD+AAAAfgAAAH4AAAA8AAAAPAAAAAwAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAwAAAA8AAAAPAAAADwAAAA+AAAAP4AAAf/wAA///gB////D//w==ac:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAMzMzAAAAAAAAAAAAAAAAMzMzMzMAAAAAAAAAAAAAAzMzMzMzMAAAAAAAAAAAAzMzMzMzMzMwAAAAAAAAADMzMzMzMzMzMzAAAAAAADMzMzMzMzMzMzMzAAAAAAMzMzMzMzMzMzMzMzAAAAAzMzMzMzMzMzMzMzMzAAAAMzMzMzMzMzMzMzMzMzAAAzMzMzMzMzMzMzMzMzMwAAMzMzMzMzMzMzMzMzMzMwADMzMzMzMzMzMzMzMzMzMAAzMzMzMzMzMzMzMzMzMzMAMzMzMzMzMzMzMzMzMzMzMDMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMbGzMzO7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7uDu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAO7u7u7u7u7u7u7u7u7u4ADu7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7gAA7u7u7u7u7u7u7u7u7gAAAAAO7u7u7u7u7u7u4AAAAAAAAADu7u7u7u7uAAAAAAAAAAAAAA7u7u7gAAAAAAAAD/+P///+B///+AH///AA///AAD//gAAf/wAAD/4AAAf8AAAD+AAAAfgAAAH4AAAA8AAAAPAAAAAwAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAwAAAA8AAAAPAAAADwAAAA+AAAAP4AAAf/wAA///gB////D//w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":35,"unified_at_epoch_ms":1792112575912,"unified_at":"2026-10-16T01:02:55.912Z","metadata":{"hashes":{"sha256":"e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","sha1":"adbe7f96b8dab9160cfc3e0056005c6d5a99ab23","md5":"0d5c47ebc408855d8a71ad321ef1da14","sha512":"c9550dbda4dd6315e54e2db2f64479b52c11c4a81dabdd82ad61524da0afaee6215a3c117b9b73886d2f4d297121c39816c2c0372581f338b4a6ff4b601c79aa","ssdeep":"393216:NAJ5hg5KE7QW0ySN/i6GCwPFnx+wsoke+jC2RFt3TM5Kj:iJ5hg5KDW0ySN/i7CJIR2ntTt","ssdeep_chunks":["393216:NAJ5hg5","393216:AJ5hg5K","393216:J5hg5KE","393216:5hg5KE7","393216:hg5KE7Q","393216:g5KE7QW","393216:5KE7QW0","393216:KE7QW0y","393216:E7QW0yS","393216:7QW0ySN","393216:QW0ySN/","393216:W0ySN/i","393216:0ySN/i6","393216:ySN/i6G","393216:SN/i6GC","393216:N/i6GCw","393216:/i6GCwP","393216:i6GCwPF","393216:6GCwPFn","393216:GCwPFnx","393216:CwPFnx+","393216:wPFnx+w","393216:PFnx+ws","393216:Fnx+wso","393216:nx+wsok","393216:x+wsoke","393216:+wsoke+","393216:wsoke+j","393216:soke+jC","393216:oke+jC2","393216:ke+jC2R","393216:e+jC2RF","393216:+jC2RFt","393216:jC2RFt3","393216:C2RFt3T","393216:2RFt3TM","393216:RFt3TM5","393216:Ft3TM5K","393216:t3TM5Kj","786432:NAJ5hg5","786432:AJ5hg5K","786432:J5hg5KE","786432:5hg5KE7","786432:hg5KE7Q","786432:g5KE7QW","786432:5KE7QW0","786432:KE7QW0y","786432:E7QW0yS","786432:7QW0ySN","786432:QW0ySN/","786432:W0ySN/i","786432:0ySN/i6","786432:ySN/i6G","786432:SN/i6GC","786432:N/i6GCw","786432:/i6GCwP","786432:i6GCwPF","786432:6GCwPFn","786432:GCwPFnx","786432:CwPFnx+","786432:wPFnx+w","786432:PFnx+ws","786432:Fnx+wso","786432:nx+wsok","786432:x+wsoke","786432:+wsoke+","786432:wsoke+j","786432:soke+jC","786432:oke+jC2","786432:ke+jC2R","786432:e+jC2RF","786432:+jC2RFt","786432:jC2RFt3","786432:C2RFt3T","786432:2RFt3TM","786432:RFt3TM5","786432:Ft3TM5K","786432:t3TM5Kj","393216:iJ5hg5K","393216:J5hg5KD","393216:5hg5KDW","393216:hg5KDW0","393216:g5KDW0y","393216:5KDW0yS","393216:KDW0ySN","393216:DW0ySN/","393216:0ySN/i7","393216:ySN/i7C","393216:SN/i7CJ","393216:N/i7CJI","393216:/i7CJIR","393216:i7CJIR2","393216:7CJIR2n","393216:CJIR2nt","393216:JIR2ntT","393216:IR2ntTt"],"imphash":"c457c3a53f518626ccd02bd56edd9752","pehash":"a5c59e988195f3e56dd6a9f0ef010f221d7553ee"},"file_info":{"file_name":"2FA Code Engine.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":13726016,"entropy":7.36,"compile_timestamp":"2026-09-01T11:38:43","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792092339000,"last_seen":1792112496000,"last_multi_scan":1792112496000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":7,"import_count":0,"export_count":0,"embedded_file_count":10,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":2995882,"raw_size":2996224},{"name":".rdata","virtual_address":"0x2dd000","virtual_size":773366,"raw_size":773632},{"name":".data","virtual_address":"0x39a000","virtual_size":60244,"raw_size":14336},{"name":".didat","virtual_address":"0x3a9000","virtual_size":1832,"raw_size":2048},{"name":".fptable","virtual_address":"0x3aa000","virtual_size":128,"raw_size":512},{"name":".rsrc","virtual_address":"0x3ab000","virtual_size":566152,"raw_size":566272},{"name":".reloc","virtual_address":"0x436000","virtual_size":196576,"raw_size":196608}],"section_names":[".text",".rdata",".data",".didat",".fptable",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"suspicious","score":35,"tags":["suspicious"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":113},"sandbox_signatures":{"informative_count":324,"suspicious_count":15,"malicious_count":4,"total":343},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Able to use GrayString API for text rendering"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"PE file contains large number of import functions"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Execution","technique":"Software Deployment Tools","attack_id":"T1072","attack_id_wiki":"https://attack.mitre.org/techniques/T1072","identifiers":[{"type":"informative","value":"Contains reference to software packages activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to impersonate a named-pipe client application (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","identifiers":[{"type":"informative","value":"Able to access password managers"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to verify if file exist on disk"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Found registry location string related to BIOS"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Queries volatile registry keys"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to retrieve the local machine's name"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API used to retrieve process information"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to retrieve name of the domain controller for the current domain (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Imports windows networking-related APIs"},{"type":"informative","value":"Able to access Windows networking-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to retrieve list of TCP/UDP endpoints (API string)"},{"type":"informative","value":"Contains ability to retrieve IPv4 TCP connection table (API string)"},{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"},{"type":"informative","value":"Imports network management related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"},{"type":"informative","value":"Contains ability enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"Cloud Groups","attack_id":"T1069.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/003","identifiers":[{"type":"informative","value":"May be able to execute Exchange Online Remote PowerShell Modulee"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to detect sandbox environment via user account"},{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to retrieve information set for devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Identified known pipe name"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to move file or directory"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"},{"type":"malicious","value":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Queries list of installed browsers"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"References bcrypt module and functions (used for encryption/decryption)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Calls an API used to change the configuration parameters of a service"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"References hosts file in file/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"suspicious","value":"Calls an API typically used to convert data from binary to string"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Stealth","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Stealth","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Stealth","technique":"Msiexec","attack_id":"T1218.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/007","identifiers":[{"type":"informative","value":"Detected msiexec.exe process execution"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains ability to uninstall applications (Powershell command string)"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Defense Impairment","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a valid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"--no-upload-gzip don't use gzip compression when uploading\" (Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found string \"--no-upload-gzip don't use gzip compression when uploading\" (Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"Found reference string \"NetLocalGroupGetInfo\" (Indicator: \"netlocalgroupgetinfo\"; File: \"2FA_Code_Engine.exe\")\n Found reference string \"NetGroupGetInfo\" (Indicator: \"netgroupgetinfo\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteServices\" (File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"2FA_Code_Engine.exe\" called \"RemoveDirectoryW\" with parameter \\\\?\\%APPDATA%\\Notonlycode\\2FA Code Engine 93.11.1\\install (UID: 00000000-00007864)\n \"2FA_Code_Engine.exe\" called \"RemoveDirectoryW\" with parameter \\\\?\\%APPDATA%\\Notonlycode\\2FA Code Engine 93.11.1 (UID: 00000000-00007864)\n \"2FA_Code_Engine.exe\" called \"RemoveDirectoryW\" with parameter \\\\?\\%APPDATA%\\Notonlycode (UID: 00000000-00007864)\n \"msedgewebview2.exe\" called \"RemoveDirectoryW\" with parameter %APPDATA%\\2FA Code Engine.exe\\EBWebView\\ProvenanceData (UID: 00000000-00005224)\n \"msedgewebview2.exe\" called \"RemoveDirectoryW\" with parameter %APPDATA%\\2FA Code Engine.exe\\EBWebView\\ProvenanceDataTensors (UID: 00000000-00005224)\n \"msedgewebview2.exe\" called \"RemoveDirectoryW\" with parameter %APPDATA%\\2FA Code Engine.exe\\EBWebView\\BrowserMetrics (UID: 00000000-00005224)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability enumerate permission groups in the domain","description":"Observed api used in \"NETAPI32.dll\" [Source: MSI7AC5.tmp]","origin":"Static Parser","mitre_attack_id":"T1069.002","relevance":1,"id":"static-224","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate a named-pipe client application (API string)","description":"Found reference to API \"ImpersonateNamedPipeClient\" (Indicator: \"ImpersonateNamedPipeClient\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"ImpersonateNamedPipeClient\" (Indicator: \"ImpersonateNamedPipeClient\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-165","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"RegOverridePredefKey\" (Indicator: \"RegOverridePredefKey\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenService failed error code:\" (Indicator: \"OpenService\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"Failed to OpenService. Error code:\" (Indicator: \"OpenService\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"2FA_Code_Engine.exe\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"2FA_Code_Engine.exe\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00003476.00000000.301913.69261000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.00054000.00000004.mdmp, 00000000-00005224.00000003.305202.00054000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00004400.00000003.305316.68300000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Detected msiexec.exe process execution","description":"Process \"MsiExec.exe\" with commandline \"-Embedding FA337FD2F14F7C0D5075CEFB69B2C322 C\" (UID: 00000000-00002664)\n\n Process \"msiexec.exe\" with commandline \"/i \"%APPDATA%\\\\Notonlycode\\\\2FA Code Engine 93.11.1\\\\install\\\\2FA Code Engine.msi\" /qn AI_SETUPEXEPATH=C:\\\\2FA_Code_Engine.exe SETUPEXEDIR=C:\\\\ EXE_CMD_LINE=\"/exenoupdates /forcecleanup /wintime 1792094406 \"\" (UID: 00000000-00005964)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding 32887C1A40FCFBA6EAB85C83ABB00F1B\" (UID: 00000000-00002108)\n","origin":"Monitored Target","mitre_attack_id":"T1218.007","relevance":2,"id":"target-152","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"2FA_Code_Engine.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 738C0000\n \"2FA Code Engine.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 87030000\n \"msedgewebview2.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 87030000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"2FA_Code_Engine.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"2FA_Code_Engine.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"msiexec.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"msiexec.exe\" set its error mode to SEM_NOGPFAULTERRORBOX\n \"MsiExec.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2e","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$2f","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"$30","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"msedgewebview2.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007612-25850-45-00682E03\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007612-25850-47-0067E35E\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007612-25850-572-0067ED14\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007612-25850-779-0067EEA5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API NtQueryInformationProcess@NTDLL.DLL at 00000000-00007612-25850-593-0065C9C0\n Found reference to API NtQueryInformationProcess@NTDLL.DLL at 00000000-00007612-25850-1452-0065C8B0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005224-00000C2C-2843053849\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005224-00000C2C-2845887281\")\n Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"00000000-00005224-00000C2C-2845888064\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"00000000-00005224-00000C2C-2849149682\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CertGetNameStringW\" (Indicator: \"CertGetNameStringW\"; File: \"2FA_Code_Engine.exe\")\n Found api reference \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"2FA_Code_Engine.exe\")\n Found api reference \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; Source: \"00000000-00004400.00000002.304750.6622D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00005224-00000C2C-2849487307\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00005224-00000C2C-2849488926\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$31","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$32","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertGetNameStringW\" (Indicator: \"CertGetNameString\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004400.00000002.304750.0003C000.00000004.mdmp, 00000000-00004400.00000002.304750.68C69000.00000004.mdmp, 00000000-00004400.00000003.305316.00100000.00000004.mdmp, 00000000-00004400.00000003.305316.6831B000.00000004.mdmp\")\n Found string \"C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msvcp140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004400.00000002.304750.68C69000.00000004.mdmp\")\n Found string \"(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msvcp140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004400.00000003.305316.0003C000.00000004.mdmp\")\n Found string \"m Files (x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004400.00000003.305316.00080000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$33","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$34","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$35","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect sandbox environment via user account","description":"Found string \"WDAGUtilityAccount\" (File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-9009","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStringsW\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"$36","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"BIOSVersion\" (Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found string \"OSVersionInformation\" (Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found string \"::GetUserNameW\" (Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found string \"::GetUserNameW\" (Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\")\n Found string \"BIOSVersion\" (Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")\n Found string \"OSVersionInformation\" (Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")\n Found string \"::GetUserNameW\" (Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"$37","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"2FA_Code_Engine.exe\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00007864-00000C2C-2819580991\")\n Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\")\n Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (File: \"2FA_Code_Engine.exe\")\n Found string \"EnumServicesStatusW\" (File: \"2FA_Code_Engine.exe\")\n Found string \"QueryServiceStatusEx\" (File: \"2FA_Code_Engine.exe\")\n Found string \"EnumServicesStatusExW\" (Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found string \"EnumServicesStatusExW\" (Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00006628-00000C2C-2858367420\")\n Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information set for devices (API string)","description":"Found reference to API \"setupdigetdeviceregistrypropertyw\" (Indicator: \"setupdigetdeviceregistryproperty\"; Source: \"00000000-00004400.00000003.305316.6831B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the local machine's name","description":"Found reference to API \"getcomputerobjectnamea\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00004400.00000002.304750.6831B000.00000004.mdmp, 00000000-00004400.00000003.305316.662F6000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-743","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"2FA_Code_Engine.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007864)\n \"msedgewebview2.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005224)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"2FA_Code_Engine.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007864)\n \"2FA_Code_Engine.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007864)\n \"2FA_Code_Engine.exe\" called \"GetDiskFreeSpaceExW\" with parameters (UID: 00000000-00007864)\n \"2FA_Code_Engine.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00007864)\n \"2FA_Code_Engine.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00007864)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"2FA_Code_Engine.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007864)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"2FA_Code_Engine.exe\" called \"IsWow64Process\" with parameter \"7864\" - (UID: 00000000-00007864)\n \"msedgewebview2.exe\" called \"IsWow64Process\" with parameter \"5224\" - (UID: 00000000-00005224)\n \"msedgewebview2.exe\" called \"IsWow64Process\" with parameter \"5224\" - (UID: 00000000-00004400)\n \"msedgewebview2.exe\" called \"IsWow64Process\" with parameter \"4400\" - (UID: 00000000-00004400)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"msedgewebview2.exe\" called \"GetWindowTextW\" with parameter \"Untitled\" - (UID: 00000000-00005224)\n \"msedgewebview2.exe\" called \"GetWindowTextW\" with parameter \"about:blank\" - (UID: 00000000-00005224)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"2FA_Code_Engine.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007864)\n \"MSI972D.tmp\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007612)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$40","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"2FA_Code_Engine.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d580000020000000007730000007300426e317400000000feffffff600c0b05000000000000000024ec63000200000010000000c0017300000000000200000000007300010000000800000000000905a4097300e2f42e74a009730030ec6300febaf9760800000000000000080000001c0a142974ee6300da912473000009050800000001000000 (UID: 00000000-00007864)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"2FA_Code_Engine.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00007864)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"2FA_Code_Engine.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007864)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: MSI7AC5.tmp]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindNextFileW@KERNEL32.DLL at 00000000-00007612-25850-137-00659D00\n FindFirstFileW@KERNEL32.DLL at 00000000-00007612-25850-144-0065EF30\n FindNextFileW@KERNEL32.DLL at 00000000-00007612-25850-165-00661F10\n FindFirstFileExW@KERNEL32.DLL at 00000000-00007612-25850-1670-00697DD4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00004400.00000003.305316.6622D000.00000004.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007612-25850-776-0067EF75","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007612-25850-776-0067EF75","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00007612-25850-1763-00695EE9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.DLL at 00000000-00007612-25850-391-0069B040\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00007612-25850-412-0069B26B\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00007612-25850-415-0069ADE0\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00007612-25850-419-0069ABC0\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00007612-25850-422-00694230\n GetUserDefaultLCID@KERNEL32.DLL at 00000000-00007612-25850-875-006942B4\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007612-25850-883-00693D02\n GetUserDefaultLCID@KERNEL32.DLL at 00000000-00007612-25850-913-0069B347\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007612-25850-914-0069AC63\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007612-25850-915-0069AD49\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00007612-25850-916-0069B165\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007612-25850-917-0069ACAE\n GetLocaleInfoEx@KERNEL32.DLL at 00000000-00007612-25850-1354-0067DD04\n GetLocaleInfoEx@KERNEL32.DLL at 00000000-00007612-25850-1466-00669128","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$42","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00007612-25850-118-00658D90\n GetProcessHeap@KERNEL32.DLL at 00000000-00007612-25850-449-00698C80\n OpenProcess@KERNEL32.DLL at 00000000-00007612-25850-589-0065C4C0\n OpenProcess@KERNEL32.DLL at 00000000-00007612-25850-689-0065D490\n OpenProcess@KERNEL32.DLL at 00000000-00007612-25850-690-0065CE20\n OpenProcessToken@ADVAPI32.DLL at 00000000-00007612-25850-693-0065C210\n OpenProcessToken@ADVAPI32.DLL at 00000000-00007612-25850-694-00660810\n OpenProcessToken@ADVAPI32.DLL at 00000000-00007612-25850-739-0065BA60\n OpenProcess@KERNEL32.DLL at 00000000-00007612-25850-1452-0065C8B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk","description":"PathFileExistsW@SHLWAPI.DLL at 00000000-00007612-25850-739-0065BA60","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":1,"id":"stream-124","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to BIOS","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\BIOS\" (Indicator: \"hardware\\description\\system\\bios\") in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp\n Observed string: \"HARDWARE\\DESCRIPTION\\System\\BIOS\" (Indicator: \"hardware\\description\\system\\bios\") in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-350","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"Hardware\\Description\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp\n Observed string: \"Hardware\\Description\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00005224.00000000.300792.1458D000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 00696013h\" at 00000000-00007612-25850-1763-00695EE9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"2FA Code Engine.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"2FA Code Engine.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")\n \"msedgewebview2.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")\n \"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{E122B924-B4ED-4437-BC94-A96B6AA901B6}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$46","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"2FA_Code_Engine.exe\" queried token user identity (UID: 00000000-00007864)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volatile registry keys","description":"\"msedgewebview2.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"msedgewebview2.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\1\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-139","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$47","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"2FA_Code_Engine.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"MSI972D.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"2FA Code Engine.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"msedgewebview2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"2FA Code Engine.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"msedgewebview2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"msedgewebview2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGEWEBVIEW2.EXE\")\n \"msedgewebview2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CHROME.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"ET INFO Observed Telegram Domain (t .me in TLS SNI)\" (SID: 2041933, Rev: 2, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Observed Telegram Domain in TLS SNI (t .me)\" (SID: 2071570, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyTransactedW\" in file \"2FA_Code_Engine.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"2FA_Code_Engine.exe\"\n Found registry modification API: \"RegCreateKeyW\" in file \"2FA_Code_Engine.exe\"\n Found registry modification API: \"RegCreateKeyA\" in file \"2FA_Code_Engine.exe\"\n Found registry modification API: \"RegLoadKeyW\" in file \"2FA_Code_Engine.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"EnumServicesStatusW\" (Indicator: \"EnumServicesStatus\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"2FA_Code_Engine.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"2FA_Code_Engine.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"$48","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Able to use GrayString API for text rendering","description":"Found reference to API \"GrayStringW\" (Indicator: \"GrayStringW\"; Source: \"00000000-00004400.00000003.305316.6622D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-900","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"msedgewebview2.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"2FA_Code_Engine.exe\" called \"CopyFileW\" to copy %WINDIR%\\system32\\wininet.dll to new location %TEMP%\\shi7A66.tmp (UID: 00000000-00007864)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$4b","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"2FA_Code_Engine.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\msiexec.exe\" /i \"%APPDATA%\\Notonlycode\\2FA Code Engine 93.11.1\\install\\2FA Code Engine\" - (UID: 00000000-00007864), \"msedgewebview2.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe\" --type=utility --utility-sub-type=net\" - (UID: 00000000-00005224)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"$4c","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$4d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"$4e","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$4f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"pub.futsalbandung.org\"\n \"t.me\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"149.154.167.99:443\"\n \"172.67.211.241:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\ReleaseAI\\win\\Release\\stubs\\x86\\ExternalUi.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$50","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"Found reference to API \"NetUserAdd\" (Indicator: \"NetUserAdd\"; Source: \"00000000-00004400.00000002.304750.66285000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"SleepConditionVariableSRW at 00000000-00007612-25850-133-0067E349\n Sleep@KERNEL32.DLL at 00000000-00007612-25850-586-0065DE60\n WaitForSingleObject@KERNEL32.DLL at 00000000-00007612-25850-689-0065D490","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 2FA_Code_Engine.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00007612-25850-596-0065C310\n LoadLibraryW@KERNEL32.DLL at 00000000-00007612-25850-742-00657890\n LoadLibraryExW@KERNEL32.DLL at 00000000-00007612-25850-1660-00682AF7\n LoadLibraryExW@KERNEL32.DLL at 00000000-00007612-25850-1731-0069401C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUser\" (Indicator: \"LogonUser\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"MoveFiles\" (Indicator: \"MoveFile\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServices\" (Indicator: \"StartService\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$5b","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: 2FA_Code_Engine.exe)\n Found MoveFileW in import section (Source: MSI7AC5.tmp)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$5d","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"2FA Code Engine.msi\" as clean (type is \"Composite Document File V2 Document Little Endian Os: Windows Version 10.0 MSI Installer Security: 0 Code page: 1252 Revision Number: {D6205F73-666A-405E-8302-A64F26CDADC7} Number of Words: 10 Subject: 2FA Code Engine Author: Notonlycode Name of Creating Application: 2FA Code Engine (Evaluation Installer) Template: x64;1033 Comments: 2FA Code Engine (Evaluation Installer) Title: Installation Database Keywords: Installer MSI Database Create Time/Date: Fri Sep 18 02:48:01 2026 Last Saved Time/Date: Fri Sep 18 02:48:01 2026 Last Printed: Fri Sep 18 02:48:01 2026 Number of Pages: 450\"), Antivirus vendors marked dropped file \"MSI7F6A.tmp\" as clean (type is \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections\"), Antivirus vendors marked dropped file \"MSI7E60.tmp\" as clean (type is \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"2FA_Code_Engine.exe\" failed to load missing module \"%WINDIR%\\SysWOW64\\TSAPPCMP.DLL\" - [base:0; Status:c0000135]\n \"msedgewebview2.exe\" failed to load missing module \"MDMRegistration.dll\" - [base:0; Status:c000000d]\n \"msedgewebview2.exe\" failed to load missing module \"netapi32.dll\" - [base:0; Status:c000000d]\n \"msedgewebview2.exe\" failed to load missing module \"%WINDIR%\\system32\\hevcdecoder.dll\" - [base:0; Status:c0000135]\n \"msedgewebview2.exe\" failed to load missing module \"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\optimization_guide_internal.dll\" - [base:0; Status:c0000135]\n \"msedgewebview2.exe\" failed to load missing module \"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\dbghelp.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"2FA_Code_Engine.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"MSI7AC5.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"appro@openssl.org\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: Crashpad/0.8.0 WinHTTP/10.0.22621.1635 Windows_NT/10.0.22621.1635 (x64)\" (Indicator: \"user-agent: \"; Source: \"00000000-00004400.00000002.304750.68300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$5f","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$60","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$61","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"2FA_Code_Engine.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 731E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"$62","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 5DB20000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"2FA_Code_Engine.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76930000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 91FD0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76930000\n \"msiexec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76930000\n \"MSI972D.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76930000\n \"2FA Code Engine.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 91FD0000\n \"msedgewebview2.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 91FD0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000020422691fe7f0000@ntdll.dll\"\n \"220023000000000040422691fe7f0000@ntdll.dll\"\n \"1000110000000000f8a82868fe7f0000@ntdll.dll\"\n \"0f0010000000000010a92868fe7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"2FA_Code_Engine.exe\" was detected as \"Advanced Installer\" and name: \"Installer\"\n \"2FA_Code_Engine.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"2FA_Code_Engine.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"2FA_Code_Engine.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"MSI7AC5.tmp\" was detected as \"Advanced Installer\" and name: \"Installer\"\n \"MSI7AC5.tmp\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"MSI7AC5.tmp\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"MSI7AC5.tmp\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"May be able to execute Exchange Online Remote PowerShell Modulee","description":"Found reference to API (Indicator: \"\"remove-apppackage -allusers -package '\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API (Indicator: \"remove-appxpackage \"%s\" exit $error.count\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1069.003","relevance":1,"id":"string-770","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"Found string \"powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command \"$host.UI.RawUI.BufferSize = new-object System.Management.Automation.Host.Size(1024,50);\" \"&\"\"%s\"\"\" 2> \"%s\"\" (Indicator: \"New-Object\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$63","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"2FA_Code_Engine.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"MSI7AC5.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"2FA_Code_Engine.exe\" has an executable section named \".text\"\n \"MSI7AC5.tmp\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"KERNEL32.dll\" : \"206\" [Source: 2FA_Code_Engine.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"2FA_Code_Engine.exe\" has an writable section named \".data\"\n \"2FA_Code_Engine.exe\" has an writable section named \".didat\"\n \"2FA_Code_Engine.exe\" has an writable section named \".fptable\"\n \"MSI7AC5.tmp\" has an writable section named \".data\"\n \"MSI7AC5.tmp\" has an writable section named \".didat\"\n \"MSI7AC5.tmp\" has an writable section named \".fptable\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$64","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x2db800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x2db6aa\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\msiexec.exe\" [Source: 00000000-00007864-00000BC0-2829016688]\n Observed system executable string:\"%WINDIR%\\system32\\msiexec.exe\" [Source: 00000000-00007864-00000BC0-2829021057]\n Observed system executable string:\"\"%WINDIR%\\system32\\msiexec.exe\" /i \"%APPDATA%\\Notonlycode\\2FA Code Engine 93.11.1\\install\\2FA Code Engine\" [Source: 00000000-00007864-00000C47-28920980706]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$65","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"pub.futsalbandung.org\"\n \"t.me\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$66","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"msedgewebview2.exe\" searching for class \"Chrome_MessageWindow\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$68","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$69","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$6a","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"2FA_Code_Engine.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"MSI7AC5.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"2FA_Code_Engine.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\shi7A66.tmp\"\n \"2FA_Code_Engine.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MSI7AC5.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains reference to software packages activity (Powershell command string)","description":"Found string \"Remove-AppxPackage \"%s\" exit $error.count\" (Indicator: \"Remove-AppxPackage\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1072","relevance":1,"id":"string-387","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"2FA_Code_Engine.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"msiexec.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$6c","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$6d","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$6e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$6f","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$70","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"2FA_Code_Engine.exe\" reads file \"c:\\2fa_code_engine.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$71","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$72","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"2FA_Code_Engine.exe\" touched file \"C:\\Windows\\Fonts\"\n \"msedgewebview2.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"msedgewebview2.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"msedgewebview2.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk\"\n \"msedgewebview2.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk\"\n \"msedgewebview2.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Microsoft Edge.lnk\"\n \"msedgewebview2.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk\"\n \"msedgewebview2.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk\"\n \"msedgewebview2.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Microsoft Edge.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$73","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$74","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"2FA_Code_Engine.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\notonlycode\\2fa code engine 93.11.1\\install\\2fa code engine.msi\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"$75","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"WNetAddConnection\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"msedgewebview2.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"1da66277470\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"3907\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"msedgewebview2.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1da66277470\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/faq\"\n Found http requests in header \"GET /0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/config\"\n Found http requests in header \"GET /+n_A3yiwNZa5kZmRi\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$76","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$77","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetLocalGroupGetInfo\" (Indicator: \"NetLocalGroupGetInfo\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"NetQueryDisplayInformation\" (Indicator: \"NetQueryDisplayInformation\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"NetUserEnum\" (Indicator: \"NetUserEnum\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"NetGetDCName\" (Indicator: \"NetGetDCName\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"NetUserModalsGet\" (Indicator: \"NetUserModalsGet\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"NetGroupGetInfo\" (Indicator: \"NetGroupGetInfo\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve list of TCP/UDP endpoints (API string)","description":"Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-273","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$78","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$79","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"24.0.0.0\"\n \"0.0.0.0\"\n \"2.5.29.37\"\n \"2.5.29.35\"\n Potential IP \"0.0.0.0\" found in string \"0.0.0.0-devel\"\n \"0.0.0.1\"\n \"192.168.0.2\"\n \"2.5.29.32\"\n \"2.5.4.3\"\n \"2.5.29.15\"\n \"2.5.29.14\"\n \"2.5.29.10\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$7a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"details too long to display","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.0\" (Indicator: \"HTTP/1.0\"; File: \"2FA_Code_Engine.exe\")\n Found string \"3HTTP/1.1 200 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004400.00000002.304750.662C1000.00000004.mdmp, 00000000-00004400.00000003.305316.662C1000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004400.00000002.304750.68300000.00000004.mdmp, 00000000-00004400.00000003.305316.68300000.00000004.mdmp\")\n Found string \"Request HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004400.00000002.304750.68300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/faq HTTP/1.1\nHost: pub.futsalbandung.org\nUser-Agent: Go-http-client/1.1\nAccept-Encoding: gzip\n\n GET /0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/config HTTP/1.1\nHost: pub.futsalbandung.org\nUser-Agent: Go-http-client/1.1\nAccept-Encoding: gzip\n\n GET /+n_A3yiwNZa5kZmRi HTTP/2\nHost: t.me\nUser-Agent: Go-http-client/2.0\nAccept-Encoding: gzip\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$7b","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"pub.futsalbandung.org\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Identified known pipe name","description":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00005224-00000CCE-2841369428\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":3,"id":"string-735","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Imports network management related APIs","description":"$7c","origin":"Static Parser","mitre_attack_id":"T1087.001","relevance":1,"id":"static-85","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking-related APIs","description":"Observed import api \"WNetGetUniversalName\" which can \"take a drive-based path for a network resource and returns an information structure that contains a more universal form of the name\" [Source: MSI7AC5.tmp]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7\n Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"References hosts file in file/memory","description":"Found string \"C:\\WINDOWS\\system32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00005224.00000001.302711.00004000.00000004.mdmp, 00000000-00005224.00000001.302711.00268000.00000004.mdmp, 00000000-00005224.00000002.304634.00004000.00000004.mdmp, 00000000-00005224.00000003.305202.00004000.00000004.mdmp, 00000000-00005224.00000003.305202.00268000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-479","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://pub.futsalbandung.org/0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/faq\n Found HTTPS GET request to https://pub.futsalbandung.org/0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/config\n Found HTTPS GET request to https://t.me/+n_A3yiwNZa5kZmRi","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"pub.futsalbandung.org\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"149.154.167.99\" on port \"443\"\n HTTPS traffic to \"172.67.211.241\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"\n YARA signature for AES encryption matched on process \"00000000-00007864\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00005224\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"CreateWindowStationW\" (Indicator: \"CreateWindowStation\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")\n Found reference to API \"CreateWindowStationW\" (Indicator: \"CreateWindowStation\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"::WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"::WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\")\n Found reference to API \"::WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004400.00000002.304750.66213000.00000004.mdmp, 00000000-00004400.00000003.305316.66213000.00000004.mdmp\")\n Found string \"-+ncalrpc:[OLE7446124C1F4EDA2478F0489A60A3]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004400.00000002.304750.6622D000.00000004.mdmp, 00000000-00004400.00000003.305316.6622D000.00000004.mdmp\")\n Found string \"ncalrpc:[lsapolicylookup]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004400.00000003.305316.6831B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004400.00000002.304750.66213000.00000004.mdmp, 00000000-00004400.00000002.304750.6622D000.00000004.mdmp, 00000000-00004400.00000002.304750.66285000.00000004.mdmp, 00000000-00004400.00000003.305316.66213000.00000004.mdmp, 00000000-00004400.00000003.305316.6622D000.00000004.mdmp, 00000000-00004400.00000003.305316.66285000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00004400.00000002.304750.66285000.00000004.mdmp, 00000000-00004400.00000003.305316.66285000.00000004.mdmp\")\n Found string \"C:\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00004400.00000002.304750.6629D000.00000004.mdmp, 00000000-00004400.00000003.305316.6629D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access password managers","description":"file/memory contains long string with (Indicator: \"1password\"; File: \"Login Data For Account\")","origin":"File/Memory","mitre_attack_id":"T1555.005","relevance":3,"id":"string-10057","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"$7d","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"NetGetDCName\" (Indicator: \"GetDC\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"6586,3184,3025,,RtlGetNtProductType,NTDLL.dll,\"01:19:30.484\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00004400.00000003.305316.68300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 2FA_Code_Engine.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: MSI7AC5.tmp]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$7e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve name of the domain controller for the current domain (API string)","description":"Found domain controller discovery API reference: \"NetGetDCName\" in file \"2FA_Code_Engine.exe\"","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-904","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: 2FA_Code_Engine.exe]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$7f","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"2FA_Code_Engine.exe\" tries to directly access volume data \"A:\"\n \"2FA_Code_Engine.exe\" tries to directly access volume data \"B:\"\n \"2FA_Code_Engine.exe\" tries to directly access volume data \"D:\"\n \"2FA_Code_Engine.exe\" tries to directly access volume data \"E:\"\n \"2FA_Code_Engine.exe\" tries to directly access volume data \"F:\"\n \"2FA_Code_Engine.exe\" tries to directly access volume data \"G:\"\n \"2FA_Code_Engine.exe\" tries to directly access volume data \"H:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"2FA_Code_Engine.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 732A0000\n \"msedgewebview2.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 86A70000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$80","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"2FA_Code_Engine.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"MSI972D.tmp\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"msedgewebview2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"msedgewebview2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"24\"\n \"th32ProcessID\": \"5224\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"2FA_Code_Engine.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007864)\n \"2FA_Code_Engine.exe\" called \"GetDriveTypeW\" with parameter A:\\ (UID: 00000000-00007864)\n \"2FA_Code_Engine.exe\" called \"GetDriveTypeW\" with parameter B:\\ (UID: 00000000-00007864)\n \"2FA_Code_Engine.exe\" called \"GetDriveTypeW\" with parameter D:\\ (UID: 00000000-00007864)\n \"2FA_Code_Engine.exe\" called \"GetDriveTypeW\" with parameter E:\\ (UID: 00000000-00007864)\n \"2FA_Code_Engine.exe\" called \"GetDriveTypeW\" with parameter F:\\ (UID: 00000000-00007864)\n \"2FA_Code_Engine.exe\" called \"GetDriveTypeW\" with parameter G:\\ (UID: 00000000-00007864)\n \"2FA_Code_Engine.exe\" called \"GetDriveTypeW\" with parameter H:\\ (UID: 00000000-00007864)\n \"2FA_Code_Engine.exe\" called \"GetDriveTypeW\" with parameter I:\\ (UID: 00000000-00007864)\n \"2FA_Code_Engine.exe\" called \"GetDriveTypeW\" with parameter J:\\ (UID: 00000000-00007864)\n \"2FA_Code_Engine.exe\" called \"GetDriveTypeW\" with parameter K:\\ (UID: 00000000-00007864)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"2FA_Code_Engine.exe\" called \"GetComputerNameW\" (UID: 00000000-00007864)\n \"msedgewebview2.exe\" called \"GetComputerNameW\" (UID: 00000000-00005224)\n \"msedgewebview2.exe\" called \"GetComputerNameW\" (UID: 00000000-00006628)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"2FA_Code_Engine.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}\n \"msedgewebview2.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"2FA_Code_Engine.exe\" called \"GetUserNameW\" (UID: 00000000-00007864)\n \"2FA_Code_Engine.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"2FA_Code_Engine.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"msedgewebview2.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"msedgewebview2.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"8\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$81","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$82","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$83","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve IPv4 TCP connection table (API string)","description":"Found reference to API \"GetTcpTable\" (Indicator: \"GetTcpTable\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-119","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$84","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$85","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$86","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$87","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"$88","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"__crtGetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003476.00000000.301913.69261000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003476.00000000.301913.69261000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$89","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 2FA_Code_Engine.exe\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 2FA_Code_Engine.exe\n \"Microsoft\\Windows\\CurrentVersion\\App Paths\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"\" (Indicator: \"\"; Source: \"00000000-00004400.00000002.304750.00438000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0003\"; Key: \"PROFILEENUMMODE\")\n \"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0003\"; Key: \"ICMPROFILE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to uninstall applications (Powershell command string)","description":"Found string \"Remove-AppxPackage \"%s\" exit $error.count\" (Indicator: \"Remove-AppxPackage\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-200","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyTransactedW\" in file \"2FA_Code_Engine.exe\"\n Found registry deletion API: \"RegDeleteKeyExW\" in file \"2FA_Code_Engine.exe\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"2FA_Code_Engine.exe\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"2FA_Code_Engine.exe\"\n Found registry deletion API: \"RegDeleteKeyA\" in file \"2FA_Code_Engine.exe\"\n Found registry deletion API: \"RegDeleteValueA\" in file \"2FA_Code_Engine.exe\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\"\n Found registry deletion API: \"NtDeleteKey\" in \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\"\n Found registry deletion API: \"NtDeleteValueKey\" in \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"2FA_Code_Engine.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007864)\n \"msedgewebview2.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005224)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Calls an API used to change the configuration parameters of a service","description":"Observed import api \"ChangeServiceConfig\" which can be \"used to change the configuration parameters of a service\" [Source: MSI7AC5.tmp]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-193","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 2FA_Code_Engine.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: MSI7AC5.tmp]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$8a","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcessWithToken\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$8b","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$8c","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"$8d","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"$8e","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"LsaAddAccountRights\" (Indicator: \"LsaAddAccountRights\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$8f","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00003932.00000000.303065.1458D000.00000002.mdmp\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004400.00000000.300911.5CF32000.00000002.mdmp\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00005224.00000000.300792.00404000.00000004.mdmp\n 00000000-00005224.00000000.300792.1458D000.00000002.mdmp\n 00000000-00005224.00000002.304634.00404000.00000004.mdmp\n 00000000-00005224.00000002.304634.4A482000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$90","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"2FA_Code_Engine.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003932.00000000.303065.1458D000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004400.00000000.300911.5CF32000.00000002.mdmp, 00000000-00004400.00000003.305316.86F32000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005224.00000000.300792.1458D000.00000002.mdmp, 00000000-00005224.00000001.302711.4A127000.00000002.mdmp, 00000000-00005224.00000002.304634.4A482000.00000002.mdmp, 00000000-00005224.00000003.305202.49CE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"2FA Code Engine.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"msedgewebview2.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$91","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"2FA_Code_Engine.exe\" opened \"\\Device\\KsecDD\"\n \"msiexec.exe\" opened \"\\Device\\KsecDD\"\n \"MsiExec.exe\" opened \"\\Device\\KsecDD\"\n \"MSI972D.tmp\" opened \"\\Device\\KsecDD\"\n \"2FA Code Engine.exe\" opened \"\\Device\\KsecDD\"\n \"msedgewebview2.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$92","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$93","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"2FA_Code_Engine.exe\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$94","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00004400.00000002.304750.6831B000.00000004.mdmp, 00000000-00004400.00000003.305316.6831B000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"MSI7AC5.tmp\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections\"- Location: [%TEMP%\\MSI7AC5.tmp]- [targetUID: 00000000-00007864]\n \"MSI7F6A.tmp\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections\"- Location: [%TEMP%\\MSI7F6A.tmp]- [targetUID: 00000000-00007864]\n \"MSI7E60.tmp\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections\"- Location: [%TEMP%\\MSI7E60.tmp]- [targetUID: 00000000-00007864]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$95","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$96","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"2FA_Code_Engine.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"MSI7AC5.tmp\" was detected as \"Borland Delphi 3.0 (???)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"2FA_Code_Engine.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"MSI972D.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"$97","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"msedgewebview2.exe queries ProcessDebugPort (UID: 5224)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to convert data from binary to string","description":"$98","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-230","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%APPDATA%\\Notonlycode\\2FA Code Engine 93.11.1\\install\\2FA Code Engine1.cab\" has high entropy 7.9945","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"suspicious","category":"Cryptographic Related","name":"References bcrypt module and functions (used for encryption/decryption)","description":"Found AES encryption functions \"['BCryptOpenAlgorithmProvider', 'BCryptCloseAlgorithmProvider', 'BCryptGenRandom', 'bcrypt.dll']\" - Source: \"00000000-00005224.00000003.305202.49CE2000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1573","relevance":5,"id":"memorydump-14","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00007612-25850-111-00658740\n LoadResource@KERNEL32.DLL at 00000000-00007612-25850-114-00658600\n FindResourceExW@KERNEL32.DLL at 00000000-00007612-25850-115-00658540","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"msedgewebview2.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini\"\n \"msedgewebview2.exe\" reads file \"C:\\Program Files\\desktop.ini\"\n \"msedgewebview2.exe\" reads file \"C:\\Program Files (x86)\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"MSI7AC5.tmp\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections\"- Location: [%TEMP%\\MSI7AC5.tmp]- [targetUID: 00000000-00007864]\n \"MSI7F6A.tmp\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections\"- Location: [%TEMP%\\MSI7F6A.tmp]- [targetUID: 00000000-00007864]\n \"MSI7E60.tmp\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections\"- Location: [%TEMP%\\MSI7E60.tmp]- [targetUID: 00000000-00007864]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 149.154.167.99 on port 443 is sent without HTTP header\n TCP traffic to 172.67.211.241 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on Chacha20 instruction used in process \"00000000-00005740\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-155","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"msedgewebview2.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\ce1dca8a9cdc2f790f3d2506ef7f093e1f0fd27a.tbres\" for deletion\n \"msedgewebview2.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\de8c8566573dcad173c794780648c7dd382dff10.tbres\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$99","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"MSI7AC5.tmp\" claimed CRC 13738759 while the actual is CRC 1385118","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtQueryInformationProcess@NTDLL.DLL at 00000000-00007612-25850-593-0065C9C0\n NtQueryInformationProcess@NTDLL.DLL at 00000000-00007612-25850-1452-0065C8B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$9a","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"2FA_Code_Engine.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 72960000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$9b","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$9c","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$9d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]}],"intel_graph":{"map":{"Domain:pub.futsalbandung.org":{"type":"Domain","value":"pub.futsalbandung.org"},"Domain:t.me":{"type":"Domain","value":"t.me"},"File:28e4acbcca3f785d7a817aff5e3d0ad6d2489f2b48666b229dd9c24dfd416624":{"type":"File","value":"28e4acbcca3f785d7a817aff5e3d0ad6d2489f2b48666b229dd9c24dfd416624"},"File:40a9673b321f1f6f93c69b36a85a45ca94d42941b8cdbceb972d9fb304b01d6e":{"type":"File","value":"40a9673b321f1f6f93c69b36a85a45ca94d42941b8cdbceb972d9fb304b01d6e"},"File:41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304":{"type":"File","value":"41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304"},"File:43f8d85a9e8c2c4e5b3facb7a4b7e04c6258d7f532ee5db8d3990d8fffb00c4b":{"type":"File","value":"43f8d85a9e8c2c4e5b3facb7a4b7e04c6258d7f532ee5db8d3990d8fffb00c4b"},"File:5c0cc3992a03546436ee52240fed0b7145d111ae726755c43232bc9e05f6eb3b":{"type":"File","value":"5c0cc3992a03546436ee52240fed0b7145d111ae726755c43232bc9e05f6eb3b"},"File:5c9dec1886cc01f5f2307ee1ea87f9b32a4cef0f8f9a2c68beebc558013bedab":{"type":"File","value":"5c9dec1886cc01f5f2307ee1ea87f9b32a4cef0f8f9a2c68beebc558013bedab"},"File:64bfa88c8d4e47ae8e1a23654b17fc68def68d20c8cf55b3e10f509d31ad376b":{"type":"File","value":"64bfa88c8d4e47ae8e1a23654b17fc68def68d20c8cf55b3e10f509d31ad376b"},"File:6a695fd4f2601c695d66b42f5b5130c8b0fbd8a176f516475ee2d38be97339a8":{"type":"File","value":"6a695fd4f2601c695d66b42f5b5130c8b0fbd8a176f516475ee2d38be97339a8"},"File:94753ce0a152b0508798829b2b041377d7f012f4e49dbda52d249424a44e880e":{"type":"File","value":"94753ce0a152b0508798829b2b041377d7f012f4e49dbda52d249424a44e880e"},"File:97276563ed76994895268cbe51b007d140abfbff73c400f21758a719c31b8b92":{"type":"File","value":"97276563ed76994895268cbe51b007d140abfbff73c400f21758a719c31b8b92"},"File:9f569a7e01b53d7d86257aaa7dc6c1f503bcda4c182c386e77d80fc8c606cd86":{"type":"File","value":"9f569a7e01b53d7d86257aaa7dc6c1f503bcda4c182c386e77d80fc8c606cd86"},"File:ad12579c2a22b18a6c24f274d7d0f04c345c5b12719f270607c644922576f6e2":{"type":"File","value":"ad12579c2a22b18a6c24f274d7d0f04c345c5b12719f270607c644922576f6e2"},"File:ad2cae8c8850085c71f03bcaf084db887b7d12b9a95c11bbc4a4488aaad519be":{"type":"File","value":"ad2cae8c8850085c71f03bcaf084db887b7d12b9a95c11bbc4a4488aaad519be"},"File:bbd30ac699ee354eac335dce2daa1c7c3bce445a9b4f43b888b83051d971f1d3":{"type":"File","value":"bbd30ac699ee354eac335dce2daa1c7c3bce445a9b4f43b888b83051d971f1d3"},"File:c5e606355e30127ffaf893ee29b6ff81e1ecc2222688a9b342e5fbf02904b314":{"type":"File","value":"c5e606355e30127ffaf893ee29b6ff81e1ecc2222688a9b342e5fbf02904b314"},"File:d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e":{"type":"File","value":"d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e"},"File:d9aac3b331ab957ded38ea04f671f36f3e916f508bc0ecb584ec66c04e9ab67a":{"type":"File","value":"d9aac3b331ab957ded38ea04f671f36f3e916f508bc0ecb584ec66c04e9ab67a"},"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3":{"type":"File","value":"e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}},"File:e803c38c38fcc8c8527c4acf0a06f71b78ca8eed7189e8466a9405370db1e713":{"type":"File","value":"e803c38c38fcc8c8527c4acf0a06f71b78ca8eed7189e8466a9405370db1e713"},"File:ee2b479bf2f9463b3ceca505294bc852de026868dba45077ba30c2b4b5e5e342":{"type":"File","value":"ee2b479bf2f9463b3ceca505294bc852de026868dba45077ba30c2b4b5e5e342"},"File:fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d":{"type":"File","value":"fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d"},"Ip:149.154.167.99":{"type":"Ip","value":"149.154.167.99"},"Ip:172.67.211.241":{"type":"Ip","value":"172.67.211.241"},"Url:/+n_A3yiwNZa5kZmRi":{"type":"Url","value":"/+n_A3yiwNZa5kZmRi"},"Url:/0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/config":{"type":"Url","value":"/0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/config"},"Url:/0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/faq":{"type":"Url","value":"/0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/faq"}},"chains":[{"id":"1560457665163182894","root":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}},{"id":"sandbox_network","root":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","edges":[{"edge_kind":"contacted_ip","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"Ip:149.154.167.99"},{"edge_kind":"contacted_ip","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"Ip:172.67.211.241"},{"edge_kind":"contacted_domain","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"Domain:pub.futsalbandung.org"},{"edge_kind":"resolves_to","from_key":"Domain:pub.futsalbandung.org","to_key":"Ip:172.67.211.241"},{"edge_kind":"contacted_domain","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"Domain:t.me"},{"edge_kind":"resolves_to","from_key":"Domain:t.me","to_key":"Ip:149.154.167.99"},{"edge_kind":"contacted_url","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"Url:/0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/faq"},{"edge_kind":"contacted_url","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"Url:/0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/config"},{"edge_kind":"contacted_url","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"Url:/+n_A3yiwNZa5kZmRi"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","edges":[{"edge_kind":"extracted","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"File:6a695fd4f2601c695d66b42f5b5130c8b0fbd8a176f516475ee2d38be97339a8"},{"edge_kind":"extracted","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"File:5c0cc3992a03546436ee52240fed0b7145d111ae726755c43232bc9e05f6eb3b"},{"edge_kind":"extracted","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"File:28e4acbcca3f785d7a817aff5e3d0ad6d2489f2b48666b229dd9c24dfd416624"},{"edge_kind":"extracted","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"File:5c9dec1886cc01f5f2307ee1ea87f9b32a4cef0f8f9a2c68beebc558013bedab"},{"edge_kind":"extracted","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"File:ee2b479bf2f9463b3ceca505294bc852de026868dba45077ba30c2b4b5e5e342"},{"edge_kind":"extracted","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"File:43f8d85a9e8c2c4e5b3facb7a4b7e04c6258d7f532ee5db8d3990d8fffb00c4b"},{"edge_kind":"extracted","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"File:d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e"},{"edge_kind":"extracted","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"File:94753ce0a152b0508798829b2b041377d7f012f4e49dbda52d249424a44e880e"},{"edge_kind":"extracted","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"File:ad12579c2a22b18a6c24f274d7d0f04c345c5b12719f270607c644922576f6e2"},{"edge_kind":"extracted","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"File:40a9673b321f1f6f93c69b36a85a45ca94d42941b8cdbceb972d9fb304b01d6e"},{"edge_kind":"extracted","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"File:9f569a7e01b53d7d86257aaa7dc6c1f503bcda4c182c386e77d80fc8c606cd86"},{"edge_kind":"extracted","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"File:64bfa88c8d4e47ae8e1a23654b17fc68def68d20c8cf55b3e10f509d31ad376b"},{"edge_kind":"extracted","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"File:97276563ed76994895268cbe51b007d140abfbff73c400f21758a719c31b8b92"},{"edge_kind":"extracted","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"File:41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304"},{"edge_kind":"extracted","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"File:d9aac3b331ab957ded38ea04f671f36f3e916f508bc0ecb584ec66c04e9ab67a"},{"edge_kind":"extracted","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"File:bbd30ac699ee354eac335dce2daa1c7c3bce445a9b4f43b888b83051d971f1d3"},{"edge_kind":"extracted","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"File:e803c38c38fcc8c8527c4acf0a06f71b78ca8eed7189e8466a9405370db1e713"},{"edge_kind":"extracted","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"File:c5e606355e30127ffaf893ee29b6ff81e1ecc2222688a9b342e5fbf02904b314"},{"edge_kind":"extracted","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"File:fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d"},{"edge_kind":"extracted","from_key":"File:e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","to_key":"File:ad2cae8c8850085c71f03bcaf084db887b7d12b9a95c11bbc4a4488aaad519be"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":47,"spawned_processes_count":47,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":108,"imported_dlls_count":187,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":222,"files_deleted_count":0,"registry_keys_created_count":41,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":41,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":["suspicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"6ad149c8100d89dedb0b685b","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"contacted_countries":["NLD"],"submit_name":"2FA_Code_Engine.exe","analysis_start_time":"2026-10-15T21:46:51+00:00","indicators_count":{"informative":324,"suspicious":83,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"address":"172.67.211.241","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]}],"dns_resolutions":[{"domain":"pub.futsalbandung.org","address":"172.67.211.241","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"domain":"t.me","address":"149.154.167.99","ttl":107,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]}],"http_requests":[{"host":"pub.futsalbandung.org","host_ip":"172.67.211.241:443","url":"/0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/faq","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/faq HTTP/1.1\nHost: pub.futsalbandung.org\nUser-Agent: Go-http-client/1.1\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"host":"pub.futsalbandung.org","host_ip":"172.67.211.241:443","url":"/0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/config","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /0xa560979152cd0584a1902271b0B0FD11C017a8B0/0xEb5D490443cDEd405360745C027B4d8D849b3A1E/config HTTP/1.1\nHost: pub.futsalbandung.org\nUser-Agent: Go-http-client/1.1\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"host":"t.me","host_ip":"149.154.167.99:443","url":"/+n_A3yiwNZa5kZmRi","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /+n_A3yiwNZa5kZmRi HTTP/2\nHost: t.me\nUser-Agent: Go-http-client/2.0\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}],"processes":[{"pid":7864,"ppid":0,"name":"2FA_Code_Engine.exe","command_line":"","sha256":"e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3","normalized_path":"C:\\2FA_Code_Engine.exe","uid":"00000000-00007864","icon":"$9e"},{"pid":5964,"ppid":7864,"name":"msiexec.exe","command_line":"/i \"%APPDATA%\\Notonlycode\\2FA Code Engine 93.11.1\\install\\2FA Code Engine.msi\" /qn AI_SETUPEXEPATH=C:\\2FA_Code_Engine.exe SETUPEXEDIR=C:\\ EXE_CMD_LINE=\"/exenoupdates /forcecleanup /wintime 1792094406 \"","sha256":"04de630d6f6cd8888597b55581032d01d6b6f1c26e106e7aae40ce6f2374d865","normalized_path":"%WINDIR%\\SysWOW64\\msiexec.exe","parent_uid":"00000000-00007864","uid":"00000000-00005964"},{"pid":6032,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00006032","icon":"$9f"},{"pid":2664,"ppid":6032,"name":"MsiExec.exe","command_line":"-Embedding FA337FD2F14F7C0D5075CEFB69B2C322 C","sha256":"04de630d6f6cd8888597b55581032d01d6b6f1c26e106e7aae40ce6f2374d865","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00006032","uid":"00000000-00002664"},{"pid":2108,"ppid":6032,"name":"MsiExec.exe","command_line":"-Embedding 32887C1A40FCFBA6EAB85C83ABB00F1B","sha256":"04de630d6f6cd8888597b55581032d01d6b6f1c26e106e7aae40ce6f2374d865","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00006032","uid":"00000000-00002108"},{"pid":7612,"ppid":6032,"name":"MSI972D.tmp","command_line":"/DontWait /dir \"%LOCALAPPDATA%\\Notonlycode\\2FA Code Engine\\\" \"%LOCALAPPDATA%\\Notonlycode\\2FA Code Engine\\2FA Code Engine.exe\"","sha256":"13e52d3fcaec81c3d31bf097220f2da027e9eedcd2646e7870212b529095cea9","normalized_path":"%WINDIR%\\Installer\\MSI972D.tmp","parent_uid":"00000000-00006032","uid":"00000000-00007612"},{"pid":5740,"ppid":0,"name":"2FA Code Engine.exe","command_line":"","sha256":"65bb68bc934757abeece91a377d528e4fb1960e9da5f781ee5776b2f6be18c25","normalized_path":"%LOCALAPPDATA%\\Notonlycode\\2FA Code Engine\\2FA Code Engine.exe","uid":"00000000-00005740","icon":"$a0"},{"pid":5224,"ppid":5740,"name":"msedgewebview2.exe","command_line":"--embedded-browser-webview=1 --webview-exe-name=\"2FA Code Engine.exe\" --webview-exe-version=93.11.1 --user-data-dir=\"%APPDATA%\\2FA Code Engine.exe\\EBWebView\" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=5740.952.7889707601427223284 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4","sha256":"7ba451571c764e009725550cb31ce227a0ebb5055847c180d631d726f73c619e","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe","parent_uid":"00000000-00005740","uid":"00000000-00005224"},{"pid":4400,"ppid":5224,"name":"msedgewebview2.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%APPDATA%\\2FA Code Engine.exe\\EBWebView\" /prefetch:4 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=144.0.7559.133 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe\" --annotation=plat=Win64 \"--annotation=prod=Edge WebView2\" --annotation=ver=144.0.3719.115 --initial-client-data=0x1ec,0x1f0,0x1f4,0x1cc,0x1fc,0x7ffe5d012c98,0x7ffe5d012ca4,0x7ffe5d012cb0","sha256":"7ba451571c764e009725550cb31ce227a0ebb5055847c180d631d726f73c619e","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe","parent_uid":"00000000-00005224","uid":"00000000-00004400"},{"pid":2584,"ppid":5224,"name":"msedgewebview2.exe","command_line":"--type=gpu-process --noerrdialogs --user-data-dir=\"%APPDATA%\\2FA Code Engine.exe\\EBWebView\" --webview-exe-name=\"2FA Code Engine.exe\" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1560,i,7135221318738348128,17153472583956656550,262144 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1916 /prefetch:2 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4","sha256":"7ba451571c764e009725550cb31ce227a0ebb5055847c180d631d726f73c619e","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe","parent_uid":"00000000-00005224","uid":"00000000-00002584"},{"pid":2972,"ppid":2584,"name":"WerFault.exe","command_line":"-u -p 2584 -s 416","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002584","uid":"00000000-00002972"},{"pid":6628,"ppid":5224,"name":"msedgewebview2.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir=\"%APPDATA%\\2FA Code Engine.exe\\EBWebView\" --webview-exe-name=\"2FA Code Engine.exe\" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --startup-read-main-dll --metrics-shmem-handle=2188,i,10029634921436890177,12213248626881894889,524288 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2192 /prefetch:11 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4","sha256":"7ba451571c764e009725550cb31ce227a0ebb5055847c180d631d726f73c619e","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe","parent_uid":"00000000-00005224","uid":"00000000-00006628"},{"pid":7300,"ppid":5224,"name":"msedgewebview2.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir=\"%APPDATA%\\2FA Code Engine.exe\\EBWebView\" --webview-exe-name=\"2FA Code Engine.exe\" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --startup-read-main-dll --metrics-shmem-handle=2320,i,4449242312814079140,14670654105106157457,524288 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2336 /prefetch:13 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4","sha256":"7ba451571c764e009725550cb31ce227a0ebb5055847c180d631d726f73c619e","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe","parent_uid":"00000000-00005224","uid":"00000000-00007300"},{"pid":2360,"ppid":7300,"name":"WerFault.exe","command_line":"-u -p 7300 -s 396","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00007300","uid":"00000000-00002360"},{"pid":6072,"ppid":5224,"name":"msedgewebview2.exe","command_line":"--type=renderer --noerrdialogs --user-data-dir=\"%APPDATA%\\2FA Code Engine.exe\\EBWebView\" --webview-exe-name=\"2FA Code Engine.exe\" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--expose-gc --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1792096162439330 --launch-time-ticks=4706633067 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3528,i,948724515679154959,2113731586124519774,2097152 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3536 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4 /prefetch:1","sha256":"7ba451571c764e009725550cb31ce227a0ebb5055847c180d631d726f73c619e","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe","parent_uid":"00000000-00005224","uid":"00000000-00006072"},{"pid":6356,"ppid":5224,"name":"msedgewebview2.exe","command_line":"--type=gpu-process --noerrdialogs --user-data-dir=\"%APPDATA%\\2FA Code Engine.exe\\EBWebView\" --webview-exe-name=\"2FA Code Engine.exe\" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --skip-read-main-dll --metrics-shmem-handle=3588,i,1396378995022175724,7932194887759781919,262144 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2124 /prefetch:2 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4","sha256":"7ba451571c764e009725550cb31ce227a0ebb5055847c180d631d726f73c619e","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe","parent_uid":"00000000-00005224","uid":"00000000-00006356"},{"pid":7376,"ppid":6356,"name":"WerFault.exe","command_line":"-u -p 6356 -s 412","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00006356","uid":"00000000-00007376"},{"pid":2196,"ppid":5224,"name":"msedgewebview2.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir=\"%APPDATA%\\2FA Code Engine.exe\\EBWebView\" --webview-exe-name=\"2FA Code Engine.exe\" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --skip-read-main-dll --metrics-shmem-handle=2328,i,7838783191710588682,5462908635907611202,524288 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3008 /prefetch:13 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4","sha256":"7ba451571c764e009725550cb31ce227a0ebb5055847c180d631d726f73c619e","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe","parent_uid":"00000000-00005224","uid":"00000000-00002196"},{"pid":7976,"ppid":2196,"name":"WerFault.exe","command_line":"-u -p 2196 -s 416","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002196","uid":"00000000-00007976"},{"pid":3476,"ppid":5224,"name":"msedgewebview2.exe","command_line":"--type=gpu-process --noerrdialogs --user-data-dir=\"%APPDATA%\\2FA Code Engine.exe\\EBWebView\" --webview-exe-name=\"2FA Code Engine.exe\" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --skip-read-main-dll --metrics-shmem-handle=3972,i,2420863170057958433,2580433206524639466,262144 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=2080 /prefetch:2 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4","sha256":"7ba451571c764e009725550cb31ce227a0ebb5055847c180d631d726f73c619e","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe","parent_uid":"00000000-00005224","uid":"00000000-00003476"},{"pid":6860,"ppid":3476,"name":"WerFault.exe","command_line":"-u -p 3476 -s 412","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003476","uid":"00000000-00006860"},{"pid":5412,"ppid":5224,"name":"msedgewebview2.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir=\"%APPDATA%\\2FA Code Engine.exe\\EBWebView\" --webview-exe-name=\"2FA Code Engine.exe\" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --skip-read-main-dll --metrics-shmem-handle=2320,i,8203678854322192269,18076336309383939207,524288 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=2652 /prefetch:13 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4","sha256":"7ba451571c764e009725550cb31ce227a0ebb5055847c180d631d726f73c619e","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe","parent_uid":"00000000-00005224","uid":"00000000-00005412"},{"pid":7272,"ppid":5412,"name":"WerFault.exe","command_line":"-u -p 5412 -s 404","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00005412","uid":"00000000-00007272"},{"pid":7204,"ppid":5224,"name":"msedgewebview2.exe","command_line":"--type=gpu-process --noerrdialogs --user-data-dir=\"%APPDATA%\\2FA Code Engine.exe\\EBWebView\" --webview-exe-name=\"2FA Code Engine.exe\" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --skip-read-main-dll --metrics-shmem-handle=2152,i,4561646623240771927,3397197724944642047,262144 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4100 /prefetch:2 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4","sha256":"7ba451571c764e009725550cb31ce227a0ebb5055847c180d631d726f73c619e","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe","parent_uid":"00000000-00005224","uid":"00000000-00007204"},{"pid":3692,"ppid":7204,"name":"WerFault.exe","command_line":"-u -p 7204 -s 424","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00007204","uid":"00000000-00003692"},{"pid":2132,"ppid":5224,"name":"msedgewebview2.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir=\"%APPDATA%\\2FA Code Engine.exe\\EBWebView\" --webview-exe-name=\"2FA Code Engine.exe\" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --skip-read-main-dll --metrics-shmem-handle=2328,i,9120693241969524970,6174647175900877566,524288 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=2652 /prefetch:13 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4","sha256":"7ba451571c764e009725550cb31ce227a0ebb5055847c180d631d726f73c619e","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe","parent_uid":"00000000-00005224","uid":"00000000-00002132"},{"pid":2928,"ppid":2132,"name":"WerFault.exe","command_line":"-u -p 2132 -s 396","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002132","uid":"00000000-00002928"},{"pid":2220,"ppid":5224,"name":"msedgewebview2.exe","command_line":"--type=gpu-process --noerrdialogs --user-data-dir=\"%APPDATA%\\2FA Code Engine.exe\\EBWebView\" --webview-exe-name=\"2FA Code Engine.exe\" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --skip-read-main-dll --metrics-shmem-handle=4496,i,9757061989068158769,1907043909376031204,262144 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4460 /prefetch:2 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4","sha256":"7ba451571c764e009725550cb31ce227a0ebb5055847c180d631d726f73c619e","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe","parent_uid":"00000000-00005224","uid":"00000000-00002220"},{"pid":4452,"ppid":2220,"name":"WerFault.exe","command_line":"-u -p 2220 -s 420","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002220","uid":"00000000-00004452"},{"pid":1904,"ppid":5224,"name":"msedgewebview2.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir=\"%APPDATA%\\2FA Code Engine.exe\\EBWebView\" --webview-exe-name=\"2FA Code Engine.exe\" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --skip-read-main-dll --metrics-shmem-handle=2320,i,11815893434193215517,16844125244836349847,524288 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=2576 /prefetch:13 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4","sha256":"7ba451571c764e009725550cb31ce227a0ebb5055847c180d631d726f73c619e","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe","parent_uid":"00000000-00005224","uid":"00000000-00001904"},{"pid":5008,"ppid":1904,"name":"WerFault.exe","command_line":"-u -p 1904 -s 396","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00001904","uid":"00000000-00005008"},{"pid":5752,"ppid":5224,"name":"msedgewebview2.exe","command_line":"--type=gpu-process --noerrdialogs --user-data-dir=\"%APPDATA%\\2FA Code Engine.exe\\EBWebView\" --webview-exe-name=\"2FA Code Engine.exe\" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --skip-read-main-dll --metrics-shmem-handle=4648,i,9522653075563452907,11453059068208672766,262144 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4640 /prefetch:2 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4","sha256":"7ba451571c764e009725550cb31ce227a0ebb5055847c180d631d726f73c619e","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe","parent_uid":"00000000-00005224","uid":"00000000-00005752"},{"pid":6816,"ppid":5752,"name":"WerFault.exe","command_line":"-u -p 5752 -s 416","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00005752","uid":"00000000-00006816"},{"pid":3932,"ppid":5224,"name":"msedgewebview2.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir=\"%APPDATA%\\2FA Code Engine.exe\\EBWebView\" --webview-exe-name=\"2FA Code Engine.exe\" --webview-exe-version=93.11.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --skip-read-main-dll --metrics-shmem-handle=2328,i,540686530873696741,17350240333834508214,524288 --field-trial-handle=1920,i,9611259427607524710,3309140187303151694,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=2064 /prefetch:13 /pfhostedapp:edfada611bf9433ffe5848114d1a8a60d3d364b4","sha256":"7ba451571c764e009725550cb31ce227a0ebb5055847c180d631d726f73c619e","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe","parent_uid":"00000000-00005224","uid":"00000000-00003932"},{"pid":4984,"ppid":3932,"name":"WerFault.exe","command_line":"-u -p 3932 -s 400","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003932","uid":"00000000-00004984"},{"pid":4724,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 424 -p 2584 -ip 2584","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00004724","icon":"$a1"},{"pid":5376,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 428 -p 7300 -ip 7300","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00005376","icon":"$a2"},{"pid":7960,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 568 -p 6356 -ip 6356","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007960","icon":"$a3"},{"pid":7388,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 604 -p 2196 -ip 2196","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007388","icon":"$a4"},{"pid":4748,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 604 -p 3476 -ip 3476","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00004748","icon":"$a5"},{"pid":6884,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 576 -p 5412 -ip 5412","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00006884","icon":"$a6"},{"pid":4828,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 576 -p 7204 -ip 7204","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00004828","icon":"$a7"},{"pid":5528,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 576 -p 2132 -ip 2132","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00005528","icon":"$a8"},{"pid":4128,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 576 -p 2220 -ip 2220","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00004128","icon":"$a9"},{"pid":7416,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 596 -p 1904 -ip 1904","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007416","icon":"$aa"},{"pid":5700,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 596 -p 5752 -ip 5752","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00005700","icon":"$ab"},{"pid":2568,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 592 -p 3932 -ip 3932","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00002568","icon":"$ac"}],"all_imported_dlls":["winmm.dll","ole32.dll","uxtheme.dll","comdlg32.dll","netutils.dll","wldp.dll","EmbeddedBrowserWebView.dll","twinapi.appcore.dll","edputil.dll","KBDUS.DLL","PCPKsp.dll","Windows.Security.Authentication.OnlineId.dll","wow64base.dll","CorePrivacySettingsStore.dll","TenantRestrictionsPlugin.dll","fcon.dll","OnDemandConnRouteHelper.dll","taskschd.dll","sfc.dll","verifier.dll","cscapi.dll","ncryptsslp.dll","rpcrt4.dll","vcruntime140_1_clr0400.dll","KernelBase.dll","gdi32full.dll","msasn1.dll","vcruntime140_1.dll","ntshrui.dll","TextInputFramework.dll","netprofm.dll","sechost.dll","dsreg.dll","oneds.dll","ws2_32.dll","user32.dll","mpr.dll","urlmon.dll","srpapi.dll","msedge_elf.dll","winhttp.dll","Windows.Security.Authentication.Web.Core.dll","version.dll","dbghelp.dll","OneCoreCommonProxyStub.dll","OneCoreUAPCommonProxyStub.dll","TextShaping.dll","DiagnosticDataSettings.dll","UserMgrProxy.dll","vaultcli.dll","sxs.dll","kernel32.dll","fltLib.dll","userenv.dll","crypt32.dll","lpk.dll","netapi32.dll","wkscli.dll","msvcp_win.dll","riched20.dll","dhcpcsvc.dll","mscms.dll","atlthunk.dll","ncryptprov.dll","dwmapi.dll","cabinet.dll","ntmarta.dll","IPHLPAPI.DLL","dnsapi.dll","policymanager.dll","ffmpeg.dll","AcLayers.dll","fusion.dll","linkinfo.dll","GdiPlus.dll","wow64con.dll","win32u.dll","MicrosoftAccountWAMExtension.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","Windows.UI.Immersive.dll","cryptsp.dll","msi.dll","msedge.dll","Windows.System.Launcher.dll","winnsi.dll","VxSSL32.dll","bcrypt.dll","vcruntime140_clr0400.dll","ncrypt.dll","gpapi.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","directmanipulation.dll","webio.dll","WindowsCodecs.dll","dpapi.dll","npmproxy.dll","ucrtbase_clr0400.dll","powrprof.dll","Windows.Web.dll","tbs.dll","ntdll.dll","psapi.dll","profapi.dll","rsaenh.dll","secur32.dll","clr.dll","sspicli.dll","samcli.dll","msctf.dll","wtsapi32.dll","telclient.dll","devobj.dll","FlightSettings.dll","wow64cpu.dll","gdi32.dll","msimg32.dll","wintrust.dll","coml2.dll","dhcpcsvc6.dll","advapi32.dll","combase.dll","usp10.dll","CoreMessaging.dll","CoreUIComponents.dll","nsi.dll","omadmapi.dll","microsoft_shell_integration.dll","pcacli.dll","Windows.UI.dll","cryptbase.dll","FWPUCLNT.DLL","Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient.dll","msvcp140.dll","imm32.dll","setupapi.dll","windows.storage.dll","clbcatq.dll","mscoreei.dll","umpdc.dll","mdmregistration.dll","RstrtMgr.dll","DWrite.dll","winsta.dll","InputHost.dll","wow64win.dll","vcruntime140.dll","bcryptprimitives.dll","ntasn1.dll","sfc_os.dll","msvcp110_win.dll","Windows.StateRepositoryCore.dll","schannel.dll","SHCore.dll","iertutil.dll","srvcli.dll","propsys.dll","apphelp.dll","CapabilityAccessManagerClient.dll","webauthn.dll","imagehlp.dll","cfgmgr32.dll","mswsock.dll","nlansp_c.dll","oneauth.dll","usermgrcli.dll","shell32.dll","msihnd.dll","WinTypes.dll","DataExchange.dll","oleacc.dll","aadWamExtension.dll","dbgcore.dll","VxSSL64.dll","ServicingCommon.dll","logoncli.dll","wininet.dll","oleaut32.dll","wow64.dll","msvcrt.dll","kernel.appcore.dll","davhlpr.dll","comctl32.dll","ucrtbase.dll","shlwapi.dll","msls31.dll","mscoree.dll","rasadhlp.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"watson_metadata","sha256":"6a695fd4f2601c695d66b42f5b5130c8b0fbd8a176f516475ee2d38be97339a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"590acc37-4811-4445-aa4b-eeab148b9016.tmp","sha256":"5c0cc3992a03546436ee52240fed0b7145d111ae726755c43232bc9e05f6eb3b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"e2ab07a9-6db2-4b59-beae-075096067543.dmp","sha256":"28e4acbcca3f785d7a817aff5e3d0ad6d2489f2b48666b229dd9c24dfd416624","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"DIPS","sha256":"5c9dec1886cc01f5f2307ee1ea87f9b32a4cef0f8f9a2c68beebc558013bedab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"settings.dat","sha256":"ee2b479bf2f9463b3ceca505294bc852de026868dba45077ba30c2b4b5e5e342","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"16c6c9790eb4e7c1_0","sha256":"43f8d85a9e8c2c4e5b3facb7a4b7e04c6258d7f532ee5db8d3990d8fffb00c4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"data_0","sha256":"d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"2FA Code Engine.msi","sha256":"94753ce0a152b0508798829b2b041377d7f012f4e49dbda52d249424a44e880e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"91344438-3207-4d8a-9d5d-a2e977597f0b.tmp","sha256":"ad12579c2a22b18a6c24f274d7d0f04c345c5b12719f270607c644922576f6e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"metadata","sha256":"40a9673b321f1f6f93c69b36a85a45ca94d42941b8cdbceb972d9fb304b01d6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"1afe9cacc9803fd2_0","sha256":"9f569a7e01b53d7d86257aaa7dc6c1f503bcda4c182c386e77d80fc8c606cd86","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"877c0fad-fc65-4ffc-8304-6d23f9faa8cd.tmp","sha256":"64bfa88c8d4e47ae8e1a23654b17fc68def68d20c8cf55b3e10f509d31ad376b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"97276563ed76994895268cbe51b007d140abfbff73c400f21758a719c31b8b92","sha256":"97276563ed76994895268cbe51b007d140abfbff73c400f21758a719c31b8b92","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"throttle_store.dat","sha256":"41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"temp-index","sha256":"d9aac3b331ab957ded38ea04f671f36f3e916f508bc0ecb584ec66c04e9ab67a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"26c92cf6-3300-41ab-a984-7e34c75c4207.tmp","sha256":"bbd30ac699ee354eac335dce2daa1c7c3bce445a9b4f43b888b83051d971f1d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"DIPS-wal","sha256":"e803c38c38fcc8c8527c4acf0a06f71b78ca8eed7189e8466a9405370db1e713","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"BrowsingTopicsSiteData","sha256":"c5e606355e30127ffaf893ee29b6ff81e1ecc2222688a9b342e5fbf02904b314","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"index","sha256":"fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"DIPS-journal","sha256":"ad2cae8c8850085c71f03bcaf084db887b7d12b9a95c11bbc4a4488aaad519be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\Notonlycode\\2FA Code Engine 93.11.1\\install\\holder0.aiph","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\Notonlycode","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\Notonlycode\\2FA Code Engine 93.11.1","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\Notonlycode\\2FA Code Engine 93.11.1\\install","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\Notonlycode\\2FA Code Engine 93.11.1\\install\\2FA Code Engine.msi","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"\\SystemRoot\\AppPatch\\msimain.sdb","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%WINDIR%\\Fonts","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%TEMP%\\shi7A66.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%TEMP%\\MSI7AC5.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%TEMP%\\MSI7E60.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%TEMP%\\MSI7F6A.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\Notonlycode\\2FA Code Engine 93.11.1\\install\\2FA Code Engine1.cab","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%SAMPLEDIR%\\MSI783fd.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"pipe\\ToServerAdvinst_Extract_C:\\2FA_Code_Engine.exe","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Crashpad\\throttle_store.dat","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Crashpad\\settings.dat","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"pipe\\crashpad_5224_XAFNIEVZNFZVXIRL","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\BrowserMetrics\\BrowserMetrics-6AD149FC-1468.pma","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\lockfile","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Variations","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Edge-Local-State-Tmp-70350048-5b2d-4143-85a5-ab9d674c9d92.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"pipe\\LOCAL\\mojo.5224.7872.10617734820277754850","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\ShaderCache\\index","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\ShaderCache\\data_0","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\ShaderCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\ShaderCache\\data_2","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\ShaderCache\\data_3","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%TEMP%\\sslkey.txt","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"pipe\\LOCAL\\mojo.5224.7872.13169556438417274843","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Last Version","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\README","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Edge-Local-State-Tmp-c7700705-7278-4621-8d98-0101023c7ffc.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Local State~RF47c22d.TMP","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"pipe\\LOCAL\\mojo.5224.7872.12768388708972171360","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\History","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\History-journal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\ServerCertificate","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Web Data","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Web Data-journal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Vpn Tokens","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Network\\NetworkDataMigrated","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Code Cache\\js\\index","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Code Cache\\wasm\\index","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Code Cache\\js\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Code Cache\\wasm\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Vpn Tokens-journal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\ServerCertificate-journal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Favicons","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Favicons-journal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\ClientCertificates\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\ClientCertificates\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Login Data","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Login Data-journal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Login Data For Account","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Site Characteristics Database\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Login Data For Account-journal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Site Characteristics Database\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\commerce_subscription_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\commerce_subscription_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\discount_infos_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\discount_infos_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\PersistentOriginTrials\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\PersistentOriginTrials\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Site Characteristics Database\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Site Characteristics Database\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"pipe\\LOCAL\\mojo.5740.952.7889707601427223284","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\discounts_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\discounts_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Edge-Local-State-Tmp-f49aaa2a-3679-494c-9d31-566a7614d0df.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Safe Browsing Network\\NetworkDataMigrated","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Sync Data\\LevelDB\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Sync Data\\LevelDB\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Sync Data\\LevelDB\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\parcel_tracking_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\parcel_tracking_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Extension Rules\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Extension Rules\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Extension Rules\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Local State~RF47cf7b.TMP","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Sync Data\\LevelDB\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Edge-Local-State-Tmp-5fa6f309-a801-4465-abed-e15d4d7cca78.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\SharedStorage","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Extension Rules\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\SharedStorage-journal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\shared_proto_db\\metadata\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\shared_proto_db\\metadata\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\shared_proto_db\\metadata\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\SharedStorage-wal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\shared_proto_db\\metadata\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Local State~RF47d027.TMP","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\GPUCache\\index","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"pipe\\LOCAL\\mojo.5224.7872.16756401638841479819","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"pipe\\LOCAL\\mojo.5224.7872.4300140392835298955","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\GPUCache\\data_0","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\GPUCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\GPUCache\\data_2","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\GPUCache\\data_3","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\DawnWebGPUCache\\index","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\DawnWebGPUCache\\data_0","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\DawnWebGPUCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\DawnWebGPUCache\\data_2","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\DawnWebGPUCache\\data_3","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\DawnGraphiteCache\\index","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\DawnGraphiteCache\\data_0","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\DawnGraphiteCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\DawnGraphiteCache\\data_2","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\DawnGraphiteCache\\data_3","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%TEMP%\\3304d5bf-c2dd-47b9-8653-0954a89622a0.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"pipe\\LOCAL\\mojo.5224.5396.20675590498264754","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Site Characteristics Database\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\shared_proto_db\\metadata\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Sync Data\\LevelDB\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Extension Rules\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\shared_proto_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\shared_proto_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\shared_proto_db\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\shared_proto_db\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\component_crx_cache\\96a9b59d-f7ca-4b07-a825-1ac09477c17d.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Extension Scripts\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Extension Scripts\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Extension Scripts\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\shared_proto_db\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Extension Scripts\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Extension Scripts\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Extension State\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Extension State\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Extension State\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Extension State\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\91344438-3207-4d8a-9d5d-a2e977597f0b.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\877c0fad-fc65-4ffc-8304-6d23f9faa8cd.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Extension State\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\TokenBroker\\Cache\\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\TokenBroker\\Cache\\8ae9f0c30ea1668425d0f7d6255d597ead710776.tbres","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Edge-Local-State-Tmp-aaaba18f-ad04-4a7a-a667-4952a8367dfc.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Local State~RF47f35f.TMP","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"pipe\\LOCAL\\mojo.5224.5396.8412957839668860662","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"pipe\\LOCAL\\mojo.5224.5396.4368391447242615935","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Code Cache\\js\\1afe9cacc9803fd2_0","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Code Cache\\js\\16c6c9790eb4e7c1_0","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"pipe\\LOCAL\\mojo.5224.7872.11744763582972715185","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\ExtensionActivityEdge","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\ExtensionActivityEdge-journal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Top Sites","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Top Sites-journal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\ExtensionActivityComp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\heavy_ad_intervention_opt_out.db","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\heavy_ad_intervention_opt_out.db-journal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\EdgeJourneys\\EdgeJourneys.db","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\EdgeJourneys\\EdgeJourneys.db-journal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\EdgeJourneys\\EdgeJourneys.db-wal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\favorites_diagnostic.log","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\DIPS","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\DIPS-journal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Network Action Predictor","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Network Action Predictor-journal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\DIPS-wal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\c3d37513-63cb-4a63-97ae-9fc059fb37d9.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\AutofillAiModelCache\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\AutofillAiModelCache\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"pipe\\LOCAL\\mojo.5224.7872.4698943305848615906","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\BrowsingTopicsSiteData","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\optimization_guide_hint_cache_store\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\optimization_guide_hint_cache_store\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\BrowsingTopicsSiteData-journal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\AutofillStrikeDatabase\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\AutofillStrikeDatabase\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\BudgetDatabase\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\BudgetDatabase\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Feature Engagement Tracker\\AvailabilityDB\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Feature Engagement Tracker\\AvailabilityDB\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Feature Engagement Tracker\\EventDB\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Feature Engagement Tracker\\EventDB\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\26c92cf6-3300-41ab-a984-7e34c75c4207.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"pipe\\LOCAL\\mojo.5224.7872.221297647453062745","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"pipe\\LOCAL\\mojo.5224.7872.11948996118894005865","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\590acc37-4811-4445-aa4b-eeab148b9016.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Preferences~RF481a8e.TMP","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Edge-Local-State-Tmp-ada0f613-b9ed-486d-904a-8ffb36f2a88b.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Local State~RF481c73.TMP","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"pipe\\LOCAL\\mojo.5224.7872.1077791773805025704","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"pipe\\LOCAL\\mojo.5224.7872.17596327187753490309","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Crashpad","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Crashpad\\reports","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Crashpad\\attachments","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Crashpad\\metadata","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Crashpad\\temp\\edge_shutdown_crash.txt","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Crashpad\\reports\\e2ab07a9-6db2-4b59-beae-075096067543.dmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Crashpad\\watson_metadata","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Shared Dictionary\\cache\\index","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Shared Dictionary\\db","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Network\\a19009cc-e1e8-48a2-a0b5-0bca836f6aed.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Shared Dictionary\\db-journal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Network\\Trust Tokens","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Network\\Trust Tokens-journal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Safe Browsing Network\\Safe Browsing Cookies","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Safe Browsing Network\\Safe Browsing Cookies-journal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Shared Dictionary\\cache\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Network\\Reporting and NEL","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Network\\Reporting and NEL-journal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Network\\Cookies","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Network\\Cookies-journal","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Network\\773c2107-5329-4a59-9962-2b83031bea9b.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Network\\SCT Auditing Pending Reports~RF47f5ef.TMP","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Network\\74fca1bf-042f-45d9-b80a-6a884bfa483b.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Network\\SCT Auditing Pending Reports~RF47f7a5.TMP","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Network\\4da9de47-855f-4c03-bc4f-003f15510514.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Network\\2c6793b3-1e32-4919-946b-e65c657c0c19.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"%APPDATA%\\2FA Code Engine.exe\\EBWebView\\Default\\Network\\b68ab906-43c1-48a9-8199-3e2b27e338e6.tmp","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"path":"pipe\\LOCAL\\mojo.6072.4432.17305025798141891310","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\STORE\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\STORE\\ALLOWTELEMETRY\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DEVICEACCESS\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\EDITION\\DEVICEPOLICY\\ALLOWTELEMETRY\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\DEVICEPOLICY\\ALLOWTELEMETRY\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\DEVICEPOLICY\\ALLOWTELEMETRY\\\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\DATACOLLECTION\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWSSELFHOST\\FIDS\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWSSELFHOST\\FIDS\\BYFID\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWSSELFHOST\\FIDS\\UNKNOWN\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\FLIGHTING\\BUILD\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"key":"HKCUHKCU\\\\","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7864:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7864:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"Local\\SM0:7864:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:7864:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:7864:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7864:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\BaseNamedObjects\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5964:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:5964:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"Local\\SM0:5964:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:5964:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5964:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5964:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:6032:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\BaseNamedObjects\\SM0:6032:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\BaseNamedObjects\\SM0:6032:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2664:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2664:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:2664:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"Local\\SM0:2664:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2108:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2108:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:2108:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"Local\\SM0:2108:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7612:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7612:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7612:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:7612:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"Local\\SM0:7612:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:7612:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\wails-app-feb6b138-f17d-4c8e-9227-2f1289d003b5sim","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5740:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5740:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"wails-app-feb6b138-f17d-4c8e-9227-2f1289d003b5sim","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"Local\\SM0:5740:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"Local\\SM0:5740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:5740:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:5740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"Local\\SM0:5224:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"Local\\SM0:5224:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:5224:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:5224:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5224:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5224:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5224:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5224:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4400:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4400:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"Local\\SM0:4400:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:4400:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:4400:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4400:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:2584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"Local\\SM0:2584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6628:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6628:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"Local\\SM0:6628:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:6628:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:6628:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6628:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:7300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6072:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:6072:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6356:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6356:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"Local\\SM0:6356:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:6356:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:2196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"Local\\SM0:3476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:3476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5412:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:5412:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7204:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"Local\\SM0:7204:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2132:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:2132:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2220:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2220:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:2220:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"Local\\SM0:2220:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1904:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:1904:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"Local\\SM0:5752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:5752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3932:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]},{"name":"SM0:3932:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad149c8100d89dedb0b685b"}]}]}},"report_ids":{"sandbox_job_ids":["6ad149c8100d89dedb0b685b"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Suspicious Sample e27d133c3b29… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample e27d133c3b29…. Threat score 35/100. 0/27 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample e27d133c3b29… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample e27d133c3b29…. Threat score 35/100. 0/27 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample e27d133c3b29… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample e27d133c3b29…. Threat score 35/100. 0/27 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$Lad","11",{}]]